On 10/16/2016 05:39 PM, Jerry Geis wrote:
I am running asterisk (11.23.0) on a C5 machine. Working fine on port 5060
udp. I have need to tcpenable=yes SIP and run that on port 5068.
Since port 5060 is already running I was going to redirect 5068 to 5060.
Oh, yuck. SIP includes information about an endpoint's address and port
in the payload of its data. The NAT helpers *should* rewrite that, but
only if your payload isn't encrypted. Asterisk can be configured with
knowledge of its NATed address and port, but... Well, this all becomes
kind of a mess.
It's best to avoid NAT where ever possible, in general, but more so with
SIP than with some other common protocols.
192.168.10.201 is my machine, 192.168.1.3 is the other machine. 1.3 should
connect to 10.201 on port 5068.
so I did:
iptables -t nat -A PREROUTING -p tcp -d 192.168.10.201 --dport 5068 -j
REDIRECT --to-port 5060
iptables -t nat -A POSTROUTING -p tcp -d 192.168.1.3 --dport
5060 -j REDIRECT --to-port 5068
This did not seem to work. iptable -t nat -L -n -v shows packets going out
1.3 but "0" on the input for 5068.
Is there a reason you can't configure asterisk to connect to
192.168.1.3:5068, without using NAT? And the reverse? Can 192.168.1.3
not connect to 5060?
And if you're not seeing packets hit that rule, are you really sure
192.168.1.3 is sending packets to 192.168.10.201 port 5068? Do you see
them using a diagnostic tool like tcpdump?
So then I added
iptables -t nat -A OUTPUT -p tcp -d 192.168.10.201 --dport 5068 -j REDIRECT
iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 5068 -j REDIRECT
The output chain with a destination address of the local machine? I'm
not really sure what you're trying to do here.
CentOS mailing list