Scenario:
private IP address range : Internet
10.0.0.x : (public IP address range)
:
: foo.bar.org
+-------------+ +--------------+
! !.10 .1 ! masquerading ! publicIP
! Asterisk !---------------! Firewall !------------>>
! ! SIP trunk ! siproxd !
+-------------+ +--------------+
! ! ! ! ! eth0 : ppp0
..!.!.!.!.!.....
extensions
(local SIP clients) |
Siproxd can also be used to masquerade an Asterisk server.
The Asterisk server will register itself as a SIP UA (Client)
to an external SIP registrar. In this example this would be
again sipphone.com. As Asterisk does not allow to specify an
SIP outbound proxy we use the same setup for transparent proxying.
The context values of the asterisk configuration probably must
be adapted to fit your needs.
siproxd.conf:
if_inbound = eth0
if_outbound = ppp0
hosts_allow_reg = 10.0.0.0/24
sip_listen_port = 5060
daemonize = 1
silence_log = 1
log_calls = 1
user = siproxd
registration_file = /var/lib/siproxd_registrations
pid_file = /var/run/siproxd/siproxd.pid
rtp_proxy_enable = 1
rtp_port_low = 7070
rtp_port_high = 7079
rtp_timeout = 300
default_expires = 600
debug_level = 0
debug_port = 0 |
Firewall configuration (iptables):
# redirect outgoing SIP traffic to siproxd (myself)
iptables -t nat -A PREROUTING -m udp -p udp -i eth0 \
--source 10.0.0.11 --destination-port 5060 -j REDIRECT
# allow incoming SIP and RTP traffic
iptables -A INPUT -m udp -p udp -i ppp0 --dport 5060 -j ACCEPT
iptables -A INPUT -m udp -p udp -i ppp0 --dport 7070:7080 -j ACCEPT |
Asterisk configuration (SIP related part):
sip.conf:
[general]
port = 5060 ; Port to bind to (SIP is 5060)
bindaddr = 0.0.0.0 ; Address to bind to (all addresses on machine)
context = from-sip-external ; Send unknown SIP callers to this context
callerid = Unknown
defaultexpirey = 900
; codecs
disallow=all
allow=gsm ; 13 Kbps
allow=ulaw ; 64 Kbps
allow=alaw ; 64 Kbps
; SIP Trunk to sipphone.com
; the SIP number is taken randomly for this example
register=17476691234:<password>@proxy01.sipphone.com
[17476691234]
type=user
nat=never
context=from-pstn
canreinvite=no
[sipphone1]
username=17476691234
type=peer
qualify=2000
host=proxy01.sipphone.com
fromuser=17476691234
fromdomain=proxy01.sipphone.com
context=from-pstn
canreinvite=no
secret=<password>
; local SIP extensions
[200]
username=200
type=friend
secret=XXXXXX
qualify=500
port=5060
pickupgroup=
nat=never
mailbox=
host=dynamic
dtmfmode=rfc2833
disallow=
context=from-internal
canreinvite=no
callgroup=
callerid="Extension 200" <200>
allow=all |