Linux Firewall NAT-SIP network topology, natsip

Linux Firewall NAT-SIP network topology, natsip

Environment:

Firewall: Ubuntu Server 17.10.

SIP-Yate client, Asterisk Server

Network Topology:

1) configure the IP address of the firewall and enable forwarding:

   ifconfig enp2s0 192.168.1.131   ifconfig enp3s0 192.168.100.1      echo 1 > /proc/sys/net/ipv4/ip_forward

2) load the nf_nat_sip module to create expectations:

modprobe nf_nat_sip

3) configure the FORWARD chain to only receive new data streams and established or associated data streams from the 192.168.1.0/24 network segment:

   iptables -t filter -P FORWARD DROP   iptables -t filter -A FORWARD -s 192.168.1.0/24 -j ACCEPT   iptables -t filter -A FORWARD -p udp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT   iptables -t filter -A FORWARD -j LOG

4) Enable the conntrack SIP helper:

Echo 1>/proc/sys/net/netfilter/nf_conntrack_helper or: iptables-t raw-a prerouting-p udp-m udp -- dport 5060-j CT -- helper sip

5) Configure SNAT:

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source 192.168.100.1

6) Check conntrack creation:

root@localhost:~# conntrack  -Ludp      17 28 src=192.168.1.104 dst=192.168.100.100 sport=20551 dport=15061 src=192.168.100.100 dst=192.168.100.1 sport=15061 dport=20551 mark=0 use=1udp      17 179 src=192.168.1.104 dst=192.168.100.100 sport=20550 dport=15060 src=192.168.100.100 dst=192.168.100.1 sport=15060 dport=20550 [ASSURED] mark=0 use=1udp      17 3596 src=192.168.1.104 dst=192.168.100.100 sport=65309 dport=5060 src=192.168.100.100 dst=192.168.100.1 sport=5060 dport=65309 [ASSURED] mark=0 helper=sip use=3root@localhost:~#

Creates a master session with a dport equal to 5060, a rtp (dport equal to 20550), and a RTCP sub-session.

Or configure DNAT:

iptables -t nat -A PREROUTING -d 192.168.1.131 -i enp2s0 -j DNAT --to-destination 192.168.100.100

Check conntrack creation again:

root@localhost:~# conntrack -Ludp      17 179 src=192.168.1.104 dst=192.168.1.131 sport=29448 dport=16988 src=192.168.100.100 dst=192.168.1.104 sport=16988 dport=29448 [ASSURED] mark=0 use=1udp      17 3595 src=192.168.1.104 dst=192.168.1.131 sport=53966 dport=5060 src=192.168.100.100 dst=192.168.1.104 sport=5060 dport=53966 [ASSURED] mark=0 helper=sip use=3udp      17 27 src=192.168.1.104 dst=192.168.1.131 sport=29449 dport=16989 src=192.168.100.100 dst=192.168.1.104 sport=16989 dport=29449 mark=0 use=1root@localhost:~#

The test interval must be cleared to avoid the impact of residual connection on new connections.