Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Firewall Issues

|

319

The second aspect of the NAT problem is the RTP media channel, which, like the

signaling conversation, is also bidirectional. Connectionless UDP packets are sent to

the VoIP server from the client and from the VoIP server back to the NAT firewall

that stands between the client and server. Simply port-forwarding RTP traffic is

fine—for a single client. But a more elegant solution is needed to support a group of

SIP endpoints behind a common NAT firewall.

In order to get VoIP phone calls to work through NAT firewalls, both signaling

transmissions and media streams must be able to flow in both directions, to multiple

clients simultaneously. Also, the endpoints must signal the appropriate IP address

during call setup—an IP address bound to the NAT firewall, an address that’s pub-

licly routable.

Neither of these issues has been resolved within the confines of SIP, MGCP, SCCP,

or H.323, although IAX2 has solved both of them because it requires just one socket

for all communications on a single call. Unfortunately, since there isn’t much com-

mercial support for IAX yet, you’ll most likely get stuck dealing with the NAT aller-

gies of the other protocols. There are several ways to tackle NAT, either by

eliminating it or by cooperating with it. Read on.

DMZ Eliminates the ...