[asterisk-bugs] [JIRA] (ASTERISK-24149) Routing problems on firewall with chan_pjsip packets on port 5060 (chan_sip and/or other port working)

[Matt Jordan (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-24149?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=221639#comment-221639 ] 

Matt Jordan commented on ASTERISK-24149:
----------------------------------------

I'm going to go out on a limb and say that this isn't just a firewall but a SIP ALG in the mix here, since the destination IP address and port are the same for both packets sent by {{chan_sip}} and {{chan_pjsip}}. There is one major difference in the two SIP packets sent by {{chan_sip}}/{{chan_pjsip}} - that being the {{Contact}} header.

I'm curious: does your firewall/ALG provide any information when the PJSIP packet hits it?

> Routing problems on firewall with chan_pjsip packets on port 5060 (chan_sip and/or other port working)
> ------------------------------------------------------------------------------------------------------
>
>                 Key: ASTERISK-24149
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-24149
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Channels/chan_pjsip
>    Affects Versions: 12.4.0
>         Environment: CentOS 6.5
> FreePBX 12.0.1beta29
> Asterisk 12.4
> openVZ Container on Proxmox 3.1
>            Reporter: Martin
>         Attachments: info_1.txt, issue_24149_1.cap, issue_24149_full_log_1
>
>
> Have a very weird bug on routing  chan_pjsip on the firewall. I thought it is a firewall/router problem but other ports than 5060 work and chan_sip works also on 5060.
> Short: My phone is behind a SNAT attached to a bridge to the servernet and registers well. When I try to call the phone, the SNAT is reverted correctly but the SIP/Invite packet is not routed to the correct interface. Exactly same constellation works with chan_sip and with other ports tzhan 5060 (e.g. 5061 or 5000). Firewall rules are the same for 5060 and 5061.
> Long: If it is okay, I would refer to this thread, it is explained there:
> http://community.freepbx.org/t/differences-in-nat-between-chan-sip-and-pjsip/23394
> If not, I will write one more summary.
> I know it sounds like a problem on the router/firewall, but there really is no special configuration. If there were a problem with port 5060 I think chan_sip would not work either.
> Are there any differences in packet construction between these sip stacks? I compared both invite packets in tcpdump/wireshark but I could not see a really offending problem.
> In pjsip the DF flag is set and the packet is larger than in sip, but is shorter than the MTU (1500). About 1120B length.



--
This message was sent by Atlassian JIRA
(v6.2#6252)