I have a FreePBX machine behind NAT. Trying to get a remote, NAT'ed TLS endpoint working. Despite forcing rport and all other NAT settings, Asterisk sends audio to the local address of the device. Below is a capture and some relevant configurations. Let me know if you'd like to see anything else:
<--- Received SIP request (985 bytes) from TLS:63.226.155.94:42460 --->
INVITE sips:*43@pbx.sk.user.domain.us:5161 SIP/2.0
Via: SIP/2.0/TLS 10.4.20.61;branch=z9hG4bK9c87554024e84194c;rport
Max-Forwards: 70
From: "2174" <sips:2174@pbx.sk.user.domain.us:5161>;tag=2660231b40
To: <sips:*43@pbx.sk.user.domain.us:5161>
Call-ID: f4f54805eac9f55d
CSeq: 1096918606 INVITE
Accept-Language: en
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, OPTIONS, UPDATE, PRACK, SUBSCRIBE, INFO, PUBLISH
Allow-Events: aastra-xml, vdp-session, talk, hold, conference, LocalModeStatus
Contact: "2174" <sips:2174@63.226.155.94:35517>
Supported: path, 100rel, replaces
User-Agent: Aastra 6865i/4.3.0.1052
Content-Type: application/sdp
Content-Length: 314
v=0
o=MxSIP 0 1 IN IP4 10.4.20.61
s=SIP Call
c=IN IP4 10.4.20.61
t=0 0
m=audio 3000 RTP/SAVP 0 101
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=silenceSupp:off - - - -
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:OjtKRi4iSElpPDtzT01AP1BgMU1GLGBsLV99WEwz
a=fmtp:101 0-15
a=ptime:20
a=sendrecv
<--- Transmitting SIP response (505 bytes) to TLS:63.226.155.94:42460 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/TLS 10.4.20.61;rport=42460;received=63.226.155.94;branch=z9hG4bK9c87554024e84194c
Call-ID: f4f54805eac9f55d
From: "2174" <sips:2174@pbx.sk.user.domain.us>;tag=2660231b40
To: <sips:*43@pbx.sk.user.domain.us>;tag=z9hG4bK9c87554024e84194c
CSeq: 1096918606 INVITE
WWW-Authenticate: Digest realm="asterisk",nonce="1499124704/e1b5bac8cd1ab11b9730ff072481bc24",opaque="223a5fca6dd9e2c3",algorithm=md5,qop="auth"
Server: FPBX-13.0.192.9(13.16.0)
Content-Length: 0
<--- Received SIP request (373 bytes) from TLS:63.226.155.94:42460 --->
ACK sips:*43@pbx.sk.user.domain.us:5161 SIP/2.0
Via: SIP/2.0/TLS 10.4.20.61;branch=z9hG4bK9c87554024e84194c;rport
Max-Forwards: 70
From: "2174" <sips:2174@pbx.sk.user.domain.us:5161>;tag=2660231b40
To: <sips:*43@pbx.sk.user.domain.us>;tag=z9hG4bK9c87554024e84194c
Call-ID: f4f54805eac9f55d
CSeq: 1096918606 ACK
User-Agent: Aastra 6865i/4.3.0.1052
Content-Length: 0
<--- Received SIP request (1257 bytes) from TLS:63.226.155.94:42460 --->
INVITE sips:*43@pbx.sk.user.domain.us:5161 SIP/2.0
Via: SIP/2.0/TLS 10.4.20.61;branch=z9hG4bK106dfa1bb9e9924ab;rport
Max-Forwards: 70
From: "2174" <sips:2174@pbx.sk.user.domain.us:5161>;tag=2660231b40
To: <sips:*43@pbx.sk.user.domain.us:5161>
Call-ID: f4f54805eac9f55d
CSeq: 1096918607 INVITE
Accept-Language: en
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, OPTIONS, UPDATE, PRACK, SUBSCRIBE, INFO, PUBLISH
Allow-Events: aastra-xml, vdp-session, talk, hold, conference, LocalModeStatus
Authorization: Digest username="2174",realm="asterisk",nonce="1499124704/e1b5bac8cd1ab11b9730ff072481bc24",uri="sips:*43@pbx.sk.user.domain.us:5161",response="b691d08a2c1ca692b8a9b4b24a599f21",algorithm=md5,opaque="223a5fca6dd9e2c3",qop=auth,cnonce="5a6b506b",nc=00000001
Contact: "2174" <sips:2174@63.226.155.94:35517>
Supported: path, 100rel, replaces
User-Agent: Aastra 6865i/4.3.0.1052
Content-Type: application/sdp
Content-Length: 314
v=0
o=MxSIP 0 1 IN IP4 10.4.20.61
s=SIP Call
c=IN IP4 10.4.20.61
t=0 0
m=audio 3000 RTP/SAVP 0 101
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=silenceSupp:off - - - -
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:OjtKRi4iSElpPDtzT01AP1BgMU1GLGBsLV99WEwz
a=fmtp:101 0-15
a=ptime:20
a=sendrecv
== Setting global variable 'SIPDOMAIN' to 'pbx.sk.user.domain.us'
<--- Transmitting SIP response (323 bytes) to TLS:63.226.155.94:42460 --->
SIP/2.0 100 Trying
Via: SIP/2.0/TLS 10.4.20.61;rport=42460;received=63.226.155.94;branch=z9hG4bK106dfa1bb9e9924ab
Call-ID: f4f54805eac9f55d
From: "2174" <sips:2174@pbx.sk.user.domain.us>;tag=2660231b40
To: <sips:*43@pbx.sk.user.domain.us>
CSeq: 1096918607 INVITE
Server: FPBX-13.0.192.9(13.16.0)
Content-Length: 0
-- Executing [*43@from-internal:1] Set("PJSIP/2174-00000002", "CONNECTEDLINE(name-charset,i)=utf8") in new stack
-- Executing [*43@from-internal:2] Set("PJSIP/2174-00000002", "CONNECTEDLINE(name,i)=Echo Test") in new stack
-- Executing [*43@from-internal:3] Set("PJSIP/2174-00000002", "CONNECTEDLINE(num,i)=*43") in new stack
-- Executing [*43@from-internal:4] Answer("PJSIP/2174-00000002", "") in new stack
<--- Transmitting SIP response (968 bytes) to TLS:63.226.155.94:42460 --->
SIP/2.0 200 OK
Via: SIP/2.0/TLS 10.4.20.61;rport=42460;received=63.226.155.94;branch=z9hG4bK106dfa1bb9e9924ab
Call-ID: f4f54805eac9f55d
From: "2174" <sips:2174@pbx.sk.user.domain.us>;tag=2660231b40
To: <sips:*43@pbx.sk.user.domain.us>;tag=f1f5ddd2-c75d-4e23-87a5-1dcb9188d3c8
CSeq: 1096918607 INVITE
Server: FPBX-13.0.192.9(13.16.0)
Contact: <sips:208.22.189.243:5161;transport=TLS>
Allow: OPTIONS, SUBSCRIBE, NOTIFY, PUBLISH, INVITE, ACK, BYE, CANCEL, UPDATE, PRACK, REGISTER, MESSAGE, REFER
Supported: 100rel, timer, replaces, norefersub
P-Asserted-Identity: "Echo Test" <sips:*43@pbx.sk.user.domain.us>
Content-Type: application/sdp
Content-Length: 298
v=0
o=- 0 3 IN IP4 10.9.2.20
s=Asterisk
c=IN IP4 10.9.2.20
t=0 0
m=audio 13320 RTP/SAVP 0 101
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:E+It536b8vzTqNK0QReGOMxM1265vog3SHZOl29Y
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
a=maxptime:150
a=sendrecv
<--- Received SIP request (656 bytes) from TLS:63.226.155.94:42460 --->
ACK sips:208.22.189.243:5161;transport=TLS SIP/2.0
Via: SIP/2.0/TLS 10.4.20.61;branch=z9hG4bK862f8fbfa1f02b82f;rport
Max-Forwards: 70
From: "2174" <sips:2174@pbx.sk.user.domain.us>;tag=2660231b40
To: <sips:*43@pbx.sk.user.domain.us>;tag=f1f5ddd2-c75d-4e23-87a5-1dcb9188d3c8
Call-ID: f4f54805eac9f55d
CSeq: 1096918607 ACK
Authorization: Digest username="2174",realm="asterisk",nonce="1499124704/e1b5bac8cd1ab11b9730ff072481bc24",uri="sips:*43@pbx.sk.user.domain.us:5161",response="b691d08a2c1ca692b8a9b4b24a599f21",algorithm=md5,opaque="223a5fca6dd9e2c3",qop=auth,cnonce="5a6b506b",nc=00000001
User-Agent: Aastra 6865i/4.3.0.1052
Content-Length: 0
-- Executing [*43@from-internal:5] Macro("PJSIP/2174-00000002", "user-callerid,") in new stack
-- Executing [s@macro-user-callerid:1] Set("PJSIP/2174-00000002", "TOUCH_MONITOR=1499124705.16") in new stack
-- Executing [s@macro-user-callerid:2] Set("PJSIP/2174-00000002", "AMPUSER=2174") in new stack
-- Executing [s@macro-user-callerid:3] GotoIf("PJSIP/2174-00000002", "0?report") in new stack
-- Executing [s@macro-user-callerid:4] ExecIf("PJSIP/2174-00000002", "1?Set(REALCALLERIDNUM=2174)") in new stack
-- Executing [s@macro-user-callerid:5] Set("PJSIP/2174-00000002", "AMPUSER=2174") in new stack
-- Executing [s@macro-user-callerid:6] GotoIf("PJSIP/2174-00000002", "0?limit") in new stack
-- Executing [s@macro-user-callerid:7] Set("PJSIP/2174-00000002", "AMPUSERCIDNAME=Alex Trebek") in new stack
-- Executing [s@macro-user-callerid:8] GotoIf("PJSIP/2174-00000002", "0?report") in new stack
-- Executing [s@macro-user-callerid:9] Set("PJSIP/2174-00000002", "AMPUSERCID=2174") in new stack
-- Executing [s@macro-user-callerid:10] Set("PJSIP/2174-00000002", "__DIAL_OPTIONS=Ttr") in new stack
-- Executing [s@macro-user-callerid:11] Set("PJSIP/2174-00000002", "CALLERID(all)="Alex Trebek" <2174>") in new stack
-- Executing [s@macro-user-callerid:12] GotoIf("PJSIP/2174-00000002", "0?limit") in new stack
-- Executing [s@macro-user-callerid:13] ExecIf("PJSIP/2174-00000002", "0?Set(GROUP(concurrency_limit)=2174)") in new stack
-- Executing [s@macro-user-callerid:14] ExecIf("PJSIP/2174-00000002", "0?Set(CHANNEL(language)=)") in new stack
-- Executing [s@macro-user-callerid:15] GotoIf("PJSIP/2174-00000002", "0?continue") in new stack
-- Executing [s@macro-user-callerid:16] ExecIf("PJSIP/2174-00000002", "1?Set(__CALLEE_ACCOUNCODE=)") in new stack
-- Executing [s@macro-user-callerid:17] Set("PJSIP/2174-00000002", "__TTL=64") in new stack
-- Executing [s@macro-user-callerid:18] GotoIf("PJSIP/2174-00000002", "1?continue") in new stack
-- Goto (macro-user-callerid,s,29)
-- Executing [s@macro-user-callerid:29] Set("PJSIP/2174-00000002", "CALLERID(number)=2174") in new stack
-- Executing [s@macro-user-callerid:30] Set("PJSIP/2174-00000002", "CALLERID(name)=Alex Trebek") in new stack
-- Executing [s@macro-user-callerid:31] GotoIf("PJSIP/2174-00000002", "0?cnum") in new stack
-- Executing [s@macro-user-callerid:32] Set("PJSIP/2174-00000002", "CDR(cnam)=Alex Trebek") in new stack
-- Executing [s@macro-user-callerid:33] Set("PJSIP/2174-00000002", "CDR(cnum)=2174") in new stack
-- Executing [s@macro-user-callerid:34] Set("PJSIP/2174-00000002", "CHANNEL(language)=en") in new stack
-- Executing [*43@from-internal:6] Wait("PJSIP/2174-00000002", "1") in new stack
-- Executing [*43@from-internal:7] BackGround("PJSIP/2174-00000002", "demo-echotest,,,app-echo-test-echo") in new stack
-- <PJSIP/2174-00000002> Playing 'demo-echotest.ulaw' (language 'en')
<--- Received SIP request (660 bytes) from TLS:63.226.155.94:42460 --->
BYE sips:208.22.189.243:5161;transport=TLS SIP/2.0
Via: SIP/2.0/TLS 10.4.20.61;branch=z9hG4bK6207742a8a15b512a;rport
Max-Forwards: 70
From: "2174" <sips:2174@pbx.sk.user.domain.us>;tag=2660231b40
To: <sips:*43@pbx.sk.user.domain.us>;tag=f1f5ddd2-c75d-4e23-87a5-1dcb9188d3c8
Call-ID: f4f54805eac9f55d
CSeq: 1096918608 BYE
Authorization: Digest username="2174",realm="asterisk",nonce="1499124704/e1b5bac8cd1ab11b9730ff072481bc24",uri="sips:208.22.189.243:5161;transport=TLS",response="4d7eab00231e3dec60c38bc2506fe7b5",algorithm=md5,opaque="223a5fca6dd9e2c3",qop=auth,cnonce="5a6b506b",nc=00000002
User-Agent: Aastra 6865i/4.3.0.1052
Content-Length: 0
<--- Transmitting SIP response (357 bytes) to TLS:63.226.155.94:42460 --->
SIP/2.0 200 OK
Via: SIP/2.0/TLS 10.4.20.61;rport=42460;received=63.226.155.94;branch=z9hG4bK6207742a8a15b512a
Call-ID: f4f54805eac9f55d
From: "2174" <sips:2174@pbx.sk.user.domain.us>;tag=2660231b40
To: <sips:*43@pbx.sk.user.domain.us>;tag=f1f5ddd2-c75d-4e23-87a5-1dcb9188d3c8
CSeq: 1096918608 BYE
Server: FPBX-13.0.192.9(13.16.0)
Content-Length: 0
== Spawn extension (from-internal, *43, 7) exited non-zero on 'PJSIP/2174-00000002'
-- Executing [h@from-internal:1] Macro("PJSIP/2174-00000002", "hangupcall") in new stack
-- Executing [s@macro-hangupcall:1] GotoIf("PJSIP/2174-00000002", "1?theend") in new stack
-- Goto (macro-hangupcall,s,3)
-- Executing [s@macro-hangupcall:3] ExecIf("PJSIP/2174-00000002", "0?Set(CDR(recordingfile)=)") in new stack
-- Executing [s@macro-hangupcall:4] Hangup("PJSIP/2174-00000002", "") in new stack
== Spawn extension (macro-hangupcall, s, 4) exited non-zero on 'PJSIP/2174-00000002' in macro 'hangupcall'
== Spawn extension (from-internal, h, 1) exited non-zero on 'PJSIP/2174-00000002'
Transport:
> pjsip show transport 10.9.2.20-tls
Transport: <TransportId........> <Type> <cos> <tos> <BindAddress....................>
==========================================================================================
Transport: 10.9.2.20-tls tls 0 0 10.9.2.20:5161
ParameterName : ParameterValue
=======================================================
allow_reload : true
async_operations : 1
bind : 10.9.2.20:5161
ca_list_file :
ca_list_path :
cert_file : /etc/asterisk/keys/tls.crt
cipher :
cos : 0
domain :
external_media_address : 208.22.189.243
external_signaling_address : 208.22.189.243
external_signaling_port : 0
local_net : 10.9.2.0/255.255.255.0
local_net : 10.19.2.0/255.255.255.0
local_net : 10.9.102.0/255.255.255.0
local_net : 192.168.1.0/255.255.255.0
method : tlsv1
password :
priv_key_file : /etc/asterisk/keys/tls.key
protocol : tls
require_client_cert : No
symmetric_transport : false
tos : 0
verify_client : No
verify_server : No
websocket_write_timeout : 100
Endpoint:
> pjsip show endpoint 2174
Endpoint: <Endpoint/CID.....................................> <State.....> <Channels.>
I/OAuth: <AuthId/UserName...........................................................>
Aor: <Aor............................................> <MaxContact>
Contact: <Aor/ContactUri..........................> <Hash....> <Status> <RTT(ms)..>
Transport: <TransportId........> <Type> <cos> <tos> <BindAddress..................>
Identify: <Identify/Endpoint.........................................................>
Match: <criteria.........................>
Channel: <ChannelId......................................> <State.....> <Time.....>
Exten: <DialedExten...........> CLCID: <ConnectedLineCID.......>
==========================================================================================
Endpoint: 2174/2174 Not in use 0 of inf
InAuth: 2174-auth/2174
Aor: 2174 4
Contact: 2174/sips:2174@63.226.155.94:42460;transpo 4516433c04 Avail 68.272
Identify: 2174-identify/2174
ParameterName : ParameterValue
=========================================================
100rel : yes
accountcode :
acl :
aggregate_mwi : true
allow : (ulaw)
allow_overlap : true
allow_subscribe : true
allow_transfer : true
aors : 2174
asymmetric_rtp_codec : false
auth : 2174-auth
bind_rtp_to_media_address : true
call_group :
callerid : "device" <2174>
callerid_privacy : allowed_not_screened
callerid_tag :
connected_line_method : invite
contact_acl :
context : from-internal
cos_audio : 0
cos_video : 0
device_state_busy_at : 0
direct_media : true
direct_media_glare_mitigation : none
direct_media_method : invite
disable_direct_media_on_nat : false
dtls_ca_file :
dtls_ca_path :
dtls_cert_file :
dtls_cipher :
dtls_fingerprint : SHA-256
dtls_private_key :
dtls_rekey : 0
dtls_setup : active
dtls_verify : No
dtmf_mode : rfc4733
fax_detect : false
fax_detect_timeout : 0
force_avp : false
force_rport : true
from_domain :
from_user :
g726_non_standard : false
ice_support : false
identify_by : username
inband_progress : false
language : en
mailboxes : 2174@device
media_address :
media_encryption : sdes
media_encryption_optimistic : true
media_use_received_transport : false
message_context :
moh_suggest : default
mwi_from_user :
mwi_subscribe_replaces_unsolicited : true
named_call_group :
named_pickup_group :
one_touch_recording : false
outbound_auth :
outbound_proxy :
pickup_group :
record_off_feature : automixmon
record_on_feature : automixmon
rewrite_contact : true
rpid_immediate : false
rtcp_mux : false
rtp_engine : asterisk
rtp_ipv6 : false
rtp_keepalive : 0
rtp_symmetric : true
rtp_timeout : 0
rtp_timeout_hold : 0
sdp_owner : -
sdp_session : Asterisk
send_diversion : true
send_pai : true
send_rpid : false
set_var :
srtp_tag_32 : false
sub_min_expiry : 0
subscribe_context :
t38_udptl : false
t38_udptl_ec : none
t38_udptl_ipv6 : false
t38_udptl_maxdatagram : 0
t38_udptl_nat : false
timers : yes
timers_min_se : 90
timers_sess_expires : 1800
tone_zone :
tos_audio : 0
tos_video : 0
transport :
trust_id_inbound : true
trust_id_outbound : false
use_avpf : false
use_ptime : false
user_eq_phone : false
voicemail_extension :
Some things I've noticed; there is no directmedia option for PJSIP extension configuration in the GUI. The GUI saves the PJSIP endpoint config to disk with media_address=
; not sure if that matters but I couldn't find documentation suggesting that it was a good thing. Removing it and reloading asterisk didn't change anything, so it might not matter either way.