Re: [Siproxd-users] Configuration help needed for Cisco 7905

[Thomas R. <tr...@gm...>]

Still the same.

As long as your internal IP 192.168.15.200 does show up in INCOMING messages
(via header) something between siproxd and the pulic internet is fiddling with
the SIP traffic. This source must be identified and reconfigured to NOT do this.


08:31:52 sock.c:281 received UDP packet from [85.234.150.85:5060] count=341
---BUFFER DUMP follows---
  53 49 50 2f 32 2e 30 20 31 30 30 20 54 72 79 69 SIP/2.0 100 Tryi
  6e 67 0d 0a 56 69 61 3a 20 53 49 50 2f 32 2e 30 ng..Via: SIP/2.0
  2f 55 44 50 20 31 39 32 2e 31 36 38 2e 31 35 2e /UDP 192.168.15.
  32 30 30 3a 35 30 36 30 3b 62 72 61 6e 63 68 3d 200:5060;branch=
  7a 39 68 47 34 62 4b 39 33 31 64 38 30 66 39 66 z9hG4bK931d80f9f
[...]

As you mention D-Link DIR-605L, a quick google brings up an disturbing fact
that with t least some FW revisions  the SIP ALG is alwasy turned on and
cannot be switched off. (So this device DOES somehow fiddle around with SIP
traffic).

Before anythjing else you need to get that fixed.

On 09/09/2013 02:56 AM, Jeremy Malcolm wrote:
> On 08/09/2013, at 8:21 PM, Thomas Ries <tr...@gm...> wrote:
> 
>> Hmm, the dumps look funny.
>>
>> Your internal address 192.168.15.200 (which supposedly ist the internal IP of
>> the siproxd host) does unexpectedly show up in VIA header of incoming SIP
>> messages (whereas the matching outgoing message clearly did *NOT* contain the
>> internal IP but the public IP address).
>>
>> This makes me believe *strongly* that some other toys in your network are
>> messing around with the SIP protocol. Do you have a SIP aware NAT
>> Router/Firewall in place (between siporxd and the Internet)? If so, do disable
>> *all* SIP processing on those devices.
> 
> Thanks, I do indeed have a D-Link DIR-605L, and just noticed a (default-on) setting for "RTSP application-level gateway".  I disabled it and rebooted - the D-Link now just has a DMZ host setting pointing to the machine running siproxd.  But still no success.
> 
> Here is the new log.
> 
[snip]