Firewall – SIP and NAT routers

firewallnat;sip

SIP was not built with NAT routers in mind, and I'd like to get to the bottom of this issue to check what needs to be done on all devices so it works with NAT routers, and understand in what context it just can't be used and I should check more NAT-friendly alternatives like IAX.

A picture being worth a thousand words, here's the layout I need to use:

http://img62.imageshack.us/img62/4077/sipandnatrouters.jpg

  1. The PBX server is located in the private LAN behind a NAT router connected to the Internet (I know it'd be easier if it were located in the public network, but this router doesn't support DMZ's so the server has to be in the private network)

  2. A couple of (soft|hard)phones are located on the same LAN and connected to the PBX server, along with a PSTN gateway (Linksys 3102 or a Digium PCI card)

  3. Remote users using (soft|hard)phones are located somewhere on the Net with dynamic IP's and are also located behind NAT routers

  4. I may or may not have control over the local NAT router where the PBX server is located, but I have no control over the remote NAT routers, either because the users don't have the computer knowledge to map ports or because the routers are off-limit (eg. web cafés, hotel LAN's, etc.)

Is it possible to configure the PBX server, the (soft|hard)phones, and the PSTN gateway so that the all conversations work fine, no matter the endpoints (POTS caller/local phone, POTS caller/remote phone, local phones, remote phone/local phone)?

In which cases may I expect problems, and are there solutions?

FWIW, I'm leaning toward using Freeswitch, but I could end up using Asterisk if there are technical advantages to it in this context.

Thank you for any info.

Best Answer

Without the full control of the router in front of FreeSwitch such scenario won't be possible.

You need to tell the router to forward all packets to FreeSwitch machine ever if there is no NAT association - it can be done with DMZ or UPNP (which is supported by FS).

There is some info available at FreeSwitch Wiki

But the best to have a Static REAL IP address on FreeSwitch machine.

P.S. I'm multi years Asterisk user and currently moving all services toward FreeSwitch because of it's stability, community and features.

Related Topic