|
|
Troubleshooting - More than 1 sip phone behind NAT Router
If you install an XtenLite softphone client on more than one machine on your LAN, the RTP and SIP ports you specify on each machine must not conflict. In other words, don't use the same SIP port on more than one machine. The same holds true for RTP port numbers. Don't let the clients conflict. It is probably safest to make sure the RTP ports are 2 apart rather than consecutive as there is also a RTCP port used which is 1 higher than the current RTP port. I'm not absolutely certain on this last point, but going every 2 on the RTP is safe. Consecutive numbering for the RTP port may not be safe.
If you forward SIP and RTP ports on your router to your client machines, be certain the ports forwarded to each client are actually the ones you specified for use on each client. I don't know the proper way to hand forwarding of the other ports used by the softclients when there are multiple clients on a LAN. On my Netgear router, there is no apparent need for port forwarding so long as I keep the RTP and SIP ports different between the various clients.
Troubleshooting your SIP connection
If you're having trouble connecting to VoIP.brujula.net,
the most likely cause is a firewall preventing your SIP
phone from connecting to VoIP.brujula.net.
Because SIP and RTP are emerging protocols, most firewalls do not allow SIP and RTP traffic
to pass through them.
Understanding firewall issues
SIP provides significant challenges to firewalls:
- SIP uses UDP (and sometimes TCP) on port 5060.
- The voice streams setup by SIP are transported using RTP (another UDP-based protocol).
- The IP addresses and ports for each end of the RTP stream are negotiated
within the SIP messages, using Session Description Protocol (SDP).
Since the IP addresses and ports are embedded within the SIP payload,
firewalls that use Network Address Translation (NAT) must read the SIP
messages, and perform NAT on the embedded SDP.
Very few exisiting NAT implementations support this today.
There are several ways to solve issues with your firewall:
- To continue using your existing firewall:
- Allow SIP and RTP traffic to pass through it by opening port 5060 for UDP and TCP packets.
- Open a range of UDP ports for RTP. Configure your SIP clients to use the range of ports you
have configured.
- Disable NAT.
- Put SIP phones outside the firewall.
- Replace your firewall with one that is SIP-aware.
VoIP.brujula.net has experience with several SIP-friendly firewall products for both home and corporate use:
- Intertex IX66 firewall
-
For home or small office use, VoIP.brujula.net has tested and deployed the Linux LiveCD Router
firewall. It is a free download. Or there is a PRO
version that includes an Administration Web Interface and VoIP packet priority.
- Jasomi PeerPoint
-
For enterprise use, VoIP.brujula.net has tested and deployed the Jasomi PeerPoint
which augments a traditional firewall by adding SIP support.
- Cisco PIX
-
While VoIP.brujula.net has not explicitly run tests,
recent software releases, version 6.2 and later, of the Cisco PIX product line have added support for SIP and RTP.
For additional information on VoIP security and SIP-friendly firewall products,
see Border Patrol: New Products Bolster VoIP Security.
Troubleshooting - Firewall blocked ports
If sip ports are blocked by a firewall you may be able to go around it
by using a ssh tunnel. see details at
SSH Tunnels
HOWTO: Secure Internet Access using a PuTTY Tunnel and Linux LiveCD Router
SocksCAP HowTo
Or you can use a PPTP tunnel service such as https://www.relakks.com/
I've already configured my phone. How come I still can't make calls?
In addition to configuring your phone, you may also need to configure your router.
Download and run Netcheck,
a diagnostic tool which will display your network status. If this tool shows that
ports 5060 and 5082 are blocked, please go to http://www.portforward.com/ for information
on how to unblock those ports for your specific router. Then run Netcheck again to ensure
that these ports are now open. Try making a call.
In addition, the Netcheck program will also tell you whether your router is
symmetric our asymmetric. If your router is symmetric, you cannot use STUN,
please use an Outbound proxy.
|