Changes between Version 3 and Version 4 of NAT_Routers_Issues

Timestamp:

Nov 12, 2008 3:31:54 PM (16 years ago)

Author:

bennylp

Comment:

--

NAT_Routers_Issues

@@ -1 +1 @@
 = Issues with NAT/Routers =
 
-Lets use this page to document peculiar things that NAT/routers do when it comes to processing SIP/STUN messages.
+Lets use this page to document ~~nasty~~peculiar things that NAT/routers do when it comes to processing SIP/STUN messages. 
 
 == Behavior Classification ==
@@ -20 +20 @@
 === Immediate binding remapping of SIP address ===
 
-The router immediately changes the public map of an internal SIP UDP address after STUN resolution is performed on other client sockets.
+The router immediately changes the public map of an internal SIP UDP address after some STUN resolutions are performed on other client sockets.
 
 Scenario:
@@ -31 +31 @@
 == Known Behavior of Some Router Brands ==
 
+This is not wall of shame! :)
+
 === Belkin Wireless ADSL Router ===
 
 || Reported in: || UK ||
+|| Reported by: || Benny Prijono ||
 || Version: || Firmware: 6.01.06 (Jun 7 2006 20:25:29), boot version: 0.70.2v6, hardware: 01 ||
 || Base type: || Full cone ||
 
- '''Inspects and modifies SIP/SDP messages'''::
- This router inspects and modifies SIP/SDP messages if the outer address is UDP port 5060. It seems to do simple text search/replace against SIP/SDP message elements, replacing all occurrences of private IP address/port with the corresponding public/mapped IP address/port. It seems to recognize SIP and SDP message structure.
+ '''Inspects and modifies SIP messages'''::
+ When STUN is not used, the router modifies the (private) IP addresses/ports in Via and Contact headers of outgoing REGISTER request to the public address/port mapping of the SIP socket, and translates these addresses back to private IP addresses/ports in the REGISTER response. When STUN is used and public IP addresses are specified in Via/Contact headers of REGISTER request, there don't seem to be any modifications done by the router.
 
- This behavior can be stopped by changing the destination/public server port to port number other than 5060, or by using TCP.
+ '''Inspects and modifies SDP'''::
+ The router modifies the (private) IP addresses in SDP c= line, and port number in SDP m= line. In addition, it also modifies the private IP address in a=rtcp attribute to the public IP address, but it doesn't modify the port number on this attribute (the port number stays private). It also replaces the private IP addresses of the ICE host candidate in ICE a=candidate attribute to the public IP address, but as with a=rtcp attribute, it doesn't modify the port number of the host candidate. This will make ICE offer/answer negotiation fails with ice-mismatch.
 
+ Interestingly, it doesn't seem to modify the private IP address in ICE host candidate when STUN is enabled. Perhaps the router has a heuristic to disable IP mangling when it sees the SDP contains parts with public IP address in it (which indicates that the client is NAT aware).
+
+ Below is the SDP as sent by client and as received by server, when STUN is '''not''' used:
+
+ {{{
+v=0
+o=- 3435482710 3435482710 IN IP4 192.168.0.15
+s=pjmedia
+c=IN IP4 192.168.0.15
+t=0 0
+a=X-nat:0
+m=audio 3160 RTP/AVP 118 0 8 119 120 101
+a=rtcp:3161 IN IP4 192.168.0.15
+a=rtpmap:118 iLBC/8000
+a=fmtp:118 mode=30
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:119 AMR/8000
+a=rtpmap:120 AMR-WB/16000
+a=sendrecv
+a=rtpmap:101 telephone-event/8000
+a=fmtp:101 0-15
+a=ice-ufrag:4fdc3f4e
+a=ice-pwd:03476f5f
+a=candidate:H 1 UDP 39 192.168.0.15 3160 typ host
+a=candidate:H 2 UDP 38 192.168.0.15 3161 typ host
+ }}}
+
+ {{{
+v=0
+o=- 3435482710 3435482710 IN IP4 81.178.58.134
+s=pjmedia
+c=IN IP4 81.178.58.134
+t=0 0
+a=X-nat:0
+m=audio 3176 RTP/AVP 118 0 8 119 120 101
+a=rtcp:3161 IN IP4 81.178.58.134
+a=rtpmap:118 iLBC/8000
+a=fmtp:118 mode=30
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:119 AMR/8000
+a=rtpmap:120 AMR-WB/16000
+a=sendrecv
+a=rtpmap:101 telephone-event/8000
+a=fmtp:101 0-15
+a=ice-ufrag:4fdc3f4e
+a=ice-pwd:03476f5f
+a=candidate:H 1 UDP 39 81.178.58.134 3160 typ host
+a=candidate:H 2 UDP 38 81.178.58.134 3161 typ host
+ }}}
+
+ And below is the SDPs as sent by client and as received by server when STUN '''is''' used:
+
+ {{{
+v=0
+o=- 3435482833 3435482833 IN IP4 81.178.58.134
+s=pjmedia
+c=IN IP4 81.178.58.134
+t=0 0
+a=X-nat:5
+m=audio 3174 RTP/AVP 118 0 8 119 120 101
+a=rtcp:3175 IN IP4 81.178.58.134
+a=rtpmap:118 iLBC/8000
+a=fmtp:118 mode=30
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:119 AMR/8000
+a=rtpmap:120 AMR-WB/16000
+a=sendrecv
+a=rtpmap:101 telephone-event/8000
+a=fmtp:101 0-15
+a=ice-ufrag:7c334999
+a=ice-pwd:32960288
+a=candidate:S 1 UDP 31 81.178.58.134 3174 typ srflx raddr 192.168.0.15 rport 3174
+a=candidate:H 1 UDP 23 192.168.0.15 3174 typ host
+a=candidate:S 2 UDP 30 81.178.58.134 3175 typ srflx raddr 192.168.0.15 rport 3175
+a=candidate:H 2 UDP 22 192.168.0.15 3175 typ host
+ }}}
+
+ {{{
+v=0
+o=- 3435482833 3435482833 IN IP4 81.178.58.134
+s=pjmedia
+c=IN IP4 81.178.58.134
+t=0 0
+a=X-nat:5
+m=audio 3174 RTP/AVP 118 0 8 119 120 101
+a=rtcp:3175 IN IP4 81.178.58.134
+a=rtpmap:118 iLBC/8000
+a=fmtp:118 mode=30
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:119 AMR/8000
+a=rtpmap:120 AMR-WB/16000
+a=sendrecv
+a=rtpmap:101 telephone-event/8000
+a=fmtp:101 0-15
+a=ice-ufrag:7c334999
+a=ice-pwd:32960288
+a=candidate:S 1 UDP 31 81.178.58.134 3174 typ srflx raddr 192.168.0.15 rport 3174
+a=candidate:H 1 UDP 23 192.168.0.15 3174 typ host
+a=candidate:S 2 UDP 30 81.178.58.134 3175 typ srflx raddr 192.168.0.15 rport 3175
+a=candidate:H 2 UDP 22 192.168.0.15 3175 typ host
+ }}}
+
+
+This behavior can be bypassed by changing the destination/public server port to port number other than 5060, or by using TCP.
+