[asterisk-bugs] [Asterisk 0013577]: If the source port changes on the router, the peer will become UNREACHABLE

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=13577 
====================================================================== 
Reported By:                ffadaie
Assigned To:                Corydon76
====================================================================== 
Project:                    Asterisk
Issue ID:                   13577
Category:                   Channels/chan_iax2
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     feedback
Asterisk Version:           1.4.21.2 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             2008-09-28 12:56 CDT
Last Modified:              2008-11-13 22:15 CST
====================================================================== 
Summary:                    If the source port changes on the router, the peer
will become UNREACHABLE
Description: 
There are two Asterisk servers. One of them is behind a firewall/NAT and
the other one has a public routable IP address. They both have static
public IP addresses.
Here is what I have on Asterisk one(Asterisk-1) in iax.conf:
[GW2]
type=friend
host=public_ip_address_of_GW2
qualify=yes
context=something

and on the second one [behind the firewall] (Asterisk-2):
[GW1]
type=friend
host=ip_address_of_GW1
qualify=yes
context=something_else

External IAX2 port, 4569, is forwarded to the internal 4569 on the
firewall. They however use dynamic source port overwriting which means if
Asterisk-2 tries to contact Asterisk-1 from 4569 on Asterisk-2 to 4569 on
Asterisk-1, then the firewall on Asterisk-2's side will overwrite 4569 to
some random port number.
Using this set up, both peers will be unreachable on the other one (using
a iax2 show peers command).
Now, if you can find out what is the port that is being overwritten to,
you can fix the problem this way:

on Asterisk-1 you can have:
[GW2]
type=friend
host=public_ip_address_of_GW2
qualify=yes
context=something
port=_public_port_of_GW2

Interestingly, you don't even have to port forward this second port on the
firewall. Just do a reload and everything will work!
Now, after it worked, you can come and remove than line and reload iax. It
will still work!
It looks like it does some sort of source port authentication. It expects
to "RECEIVE" packet on the specific port defined in IAX peer definition
section. Technically, this should be just for "SENDING" packets not
receiving.
====================================================================== 

---------------------------------------------------------------------- 
 (0094877) Corydon76 (administrator) - 2008-11-13 22:15
 http://bugs.digium.com/view.php?id=13577#c94877 
---------------------------------------------------------------------- 
Correct.  That is why registration is important.  The only way for a public
host to reach a host behind a NAT is for the host behind the NAT to
register to the public host and re-register on a regular basis, to keep the
NAT mapping active.

The way you've configured it in your example is very atypical and requires
quite a lot of setup (which is easily broken).  This is why host=dynamic
(on the public host) and the registration lines in iax.conf (on the host
behind the NAT) are the normal way to configure connections in this
situation. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2008-11-13 22:15 Corydon76      Note Added: 0094877                          
======================================================================