Linux Networking Cookbook

5.20. Getting SIP Traffic Through iptables NAT Firewalls

Problem

You're having fits with SIP traffic because it's difficult to get it past NAT firewalls. You could put your Asterisk server in your DMZ, if you have a spare routable public IP address. Or, you could use some kind of a SIP proxy, but those come with a different kind of pain. Can't you just schlep those SIP packets through your NAT-ed iptables firewall with connection tracking?

Solution

Yes, you can, thanks to the shiny new iptables SIP connection-tracking module. It comes with the 2.6.18 Linux kernel, or, you can use Netfilter's Patch-O-Matic to apply it to older kernels. If you have a 2.6.18 kernel or newer, look in /boot/config-[kernel version] to see if SIP connection tracking is already enabled. Look for:

	CONFIG_IP_NF_NAT_SIP=y
	CONFIG_IP_NF_SIP=y

If you see those magic words, then all you need are a few iptables rules in your iptables script, and to load the kernel modules. This example is for a standalone NAT firewall and router that forwards your SIP traffic to a separate Asterisk server with a private IP address of 192.168.1.25, and follows the conventions in Chapter 3:

	$ipt -t nat -A PREROUTING -p tcp -i $WAN_IFACE --dport 5060 -j DNAT --to-destination
	192.168.2.25:5060
	$ipt -A FORWARD -p tcp -i $WAN_IFACE -o $DMZ_IFACE -d 192.168.2.25 --dport 5060 -j
	ACCEPT

These rules are for an Asterisk server with a public IP address that is directly exposed to the Internet:

 $ipt -A INPUT -p udp --dport 5060 -j ACCEPT $ipt -A ...