Asterisk Portforwarding NAT

[Thomas-B]

Dear community,
Does anyone have an idea how to forward RTP ports right? Port 10000-20000 for Asterisk. Without RTP no sound.

Here is my example of what does not work: (Does everything work. Only no sound at Sip Port 5060)

auto vmbr100
iface vmbr100 inet static
address 192.168.100.254
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '192.168.100.0/24' -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.100.0/24' -o vmbr0 -j MASQUERADE
post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 80 -j DNAT --to 192.168.100.1:80
post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 80 -j DNAT --to 192.168.100.1:80
post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 1022 -j DNAT --to 192.168.100.1:22
post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 1022 -j DNAT --to 192.168.100.1:22

post-up iptables -t nat -A PREROUTING -i vmbr0 -p udp --dport 4569 -j DNAT --to 192.168.100.1:4569
post-down iptables -t nat -D PREROUTING -i vmbr0 -p udp --dport 4569 -j DNAT --to 192.168.100.1:4569



post-up iptables -t nat -A PREROUTING -p udp -m multiport --dport 5060,10000:20000 -j DNAT --to-destination 192.168.100.1
post-down iptables -t nat -D PREROUTING -p udp -m multiport --dport 5060,10000:20000 -j DNAT --to-destination 192.168.100.1
post-up iptables -A FORWARD -p udp -s 192.168.100.1 -j ACCEPT
post-down iptables -D FORWARD -p udp -s 192.168.100.1 -j ACCEPT
>>>>> post-up iptables -A FORWARD -p udp -m multiport --dport 5060,10000:20000 -d 192.168.100.1 -j ACCEPT
>>>>> post-down iptables -D FORWARD -p udp -m multiport --dport 5060,10000:20000 -d 192.168.100.1 -j ACCEPT

Thank you for help

Thomas

 

[spirit]

Hi,
I never tested sip with nat, but maybe this can help

#modprobe ip_conntrack_sip ip_nat_sip nf_nat_sip

 

[Thomas-B]

Hi,
I never tested sip with nat, but maybe this can help

#modprobe ip_conntrack_sip ip_nat_sip nf_nat_sip

Solved, it was an issue in sip.conf in Asterisk

https://www.didww.com/Knowledgebase/sip_with_firewall_nat_using_asterisk/

 

[remark]

Solved, it was an issue in sip.conf in Asterisk

https://www.didww.com/Knowledgebase/sip_with_firewall_nat_using_asterisk/

"The easiest solution to this is to avoid NAT entirely. If you have a public IP address available for your call server, use it."
That's true. If you have free public IP, you can use it within your Asterisk VM using VLAN.

 

[Nashwan]

Dear community,
Does anyone have an idea how to forward RTP ports right? Port 10000-20000 for Asterisk. Without RTP no sound.

Here is my example of what does not work: (Does everything work. Only no sound at Sip Port 5060)

auto vmbr100
iface vmbr100 inet static
address 192.168.100.254
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '192.168.100.0/24' -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.100.0/24' -o vmbr0 -j MASQUERADE
post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 80 -j DNAT --to 192.168.100.1:80
post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 80 -j DNAT --to 192.168.100.1:80
post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 1022 -j DNAT --to 192.168.100.1:22
post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 1022 -j DNAT --to 192.168.100.1:22

post-up iptables -t nat -A PREROUTING -i vmbr0 -p udp --dport 4569 -j DNAT --to 192.168.100.1:4569
post-down iptables -t nat -D PREROUTING -i vmbr0 -p udp --dport 4569 -j DNAT --to 192.168.100.1:4569



post-up iptables -t nat -A PREROUTING -p udp -m multiport --dport 5060,10000:20000 -j DNAT --to-destination 192.168.100.1
post-down iptables -t nat -D PREROUTING -p udp -m multiport --dport 5060,10000:20000 -j DNAT --to-destination 192.168.100.1
post-up iptables -A FORWARD -p udp -s 192.168.100.1 -j ACCEPT
post-down iptables -D FORWARD -p udp -s 192.168.100.1 -j ACCEPT
>>>>> post-up iptables -A FORWARD -p udp -m multiport --dport 5060,10000:20000 -d 192.168.100.1 -j ACCEPT
>>>>> post-down iptables -D FORWARD -p udp -m multiport --dport 5060,10000:20000 -d 192.168.100.1 -j ACCEPT

Thank you for help

Thomas

Hi mate,
I am facing almost same issue, but am using elasix, can you tel me in your case, if I call elastix UI which port would be used with the IP address?
cheers