#2 h245 mediaChannel and mediControlChannel merged

[Stephane Chazelas]

I've got a h323 endpoint behind a NAT firewall running with the helper.

I see instances of

PDU Type: response (1)
response: openLogicalChannelAck (5)
openLogicalChannelAck
forwardLogicalChannelNumber: 1
forwardMultiplexAckParameters: h2250LogicalChannelAckParameters (0)
h2250LogicalChannelAckParameters
sessionID: 1
mediaChannel: unicastAddress (0)
unicastAddress: iPAddress (0)
iPAddress
network: x.x.x.x (x.x.x.x)
tsapIdentifier: 60000
mediaControlChannel: unicastAddress (0)
unicastAddress: iPAddress (0)
iPAddress
network: x.x.x.x (x.x.x.x)
tsapIdentifier: 60001

being translated to:

H.245
PDU Type: response (1)
response: openLogicalChannelAck (5)
openLogicalChannelAck
forwardLogicalChannelNumber: 1
forwardMultiplexAckParameters: h2250LogicalChannelAckParameters (0)
h2250LogicalChannelAckParameters
sessionID: 1
mediaChannel: unicastAddress (0)
unicastAddress: iPAddress (0)
iPAddress
network: y.y.y.y (y.y.y.y)
tsapIdentifier: 60000
mediaControlChannel: unicastAddress (0)
unicastAddress: iPAddress (0)
iPAddress
network: y.y.y.y (y.y.y.y)
tsapIdentifier: 60000

See how the mediaControlChannel and mediaChannel are merged on same port, and RTCP packets with udpport 60001 are not translated to 60000. That confuses the h323 endpoint and wireshark a lot.

Thats for packets going out. It doesn't happen in the other direction.

The firewall is running debian squeeze with linux 2.6.32-5-amd64 and shorewall.

There's 1:1 NAT between x.x.x.x and y.y.y.y:

-A PREROUTING -d y.y.y.y/32 -j DNAT --to-destination x.x.x.x
-A POSTROUTING -s x.x.x.x/32 -j SNAT --to-source y.y.y.y