[Linphone-users] hoping for help in protocol analyzation

[Dennis Filder]

So, I'm looking at the PCAP dumps, and what I see is rather strange:

    fon-init_LAN.pcap:
    Contact: <sip:04315936434@192.168.23.10:5060>

    fon-init_WAN.pcap:
    Contact: <sip:04315936434@217.70.192.188:5060>

Something on your LEAF box is altering the SIP headers and replacing
the internal IP with the external one (and back).  My only guess is
that this is done by the kernel itself.  Can you check if you have the
module nf_nat_sip loaded?  Because if so, you'll probably have to
adjust your firewall rules to also apply the SIP NAT to Linphone's
traffic.  Sometimes getting the ordering of the rules correct for all
cases can become tricky.

Also try to get PCAP dumps for Linphone's initialization attempts to
see what is actually happening.  If the IP addresses aren't translated
and it proves impossible to get it to work then there is a
not-so-small chance that it might be an interoperability bug in
nf_nat_sip.

However, since the connection is interrupted after 15 minutes, I
suspect the firewall might actually drop the packets for the response
to the STUN request Linphone sends out (or some other packets).  In
this case you'll have to adjust your firewall rules to actually let
everything pertaining to Linphone's SIP traffic through.  That will
probably involve nf_conntrack_sip to accept new connections related to
already established connections.

Regards