Нет звука в оба направления.
Asterisk 21.3.1
FreePBX 17.0.15.25
SIP - pjsip
транспорт -TCP
порт - 56560
RTP range - 10000:10200
Локальный IP asterisk - 192.168.77.236
шлюз:
eth0 - 192.168.77.254 (локалка)
eth1 - 77.77.77.77 (внешка)
iptables-save (усечённый)
- Код: выделить все
*filter
-A INPUT -p tcp -j bad_tcp_packets
-A INPUT -s 77.77.77.77/32 -p udp -m multiport --ports 123 -j ACCEPT
-A INPUT -s 192.168.77.254/32 -p udp -m multiport --ports 123 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p udp -m multiport --ports 123 -j ACCEPT
-A INPUT -s 192.168.77.0/24 -i eth0 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -i lo -j ACCEPT
-A INPUT -s 192.168.77.254/32 -i lo -j ACCEPT
-A INPUT -s 192.168.77.0/24 -d 192.168.77.254/32 -j ACCEPT
-A INPUT -d 77.77.77.77/32 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -j tcp_packets
-A INPUT -i eth1 -p udp -j udp_packets
-A INPUT -i eth1 -p icmp -j icmp_packets
-A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT INPUT packet died: " --log-level 3
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT FORWARD packet died: " --log-level 3
-A FORWARD -s 192.168.77.0/24 -j ACCEPT
-A OUTPUT -p tcp -j bad_tcp_packets
-A OUTPUT -s 127.0.0.1/32 -j ACCEPT
-A OUTPUT -s 192.168.77.254/32 -j ACCEPT
-A OUTPUT -s 77.77.77.77/32 -j ACCEPT
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT OUTPUT packet died:" --log-level 3
-A allowed -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A allowed -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A allowed -p tcp -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not syn:"
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 0 -j ACCEPT
Софт-фон на адроид-телефоне(мобильный интернет - IP-55.55.55.55) и стационарный Fanvil (локальный IP-192.168.77.165)
Регистрация телефонов проходит. Но голоса нет.
Включаю дебаг в консоли астериска и вижу, во время разговора:
- Код: выделить все
CLI> rtp set debug on
...
Sent RTP packet to 10.240.233.175:39475 (type 08, seq 016768, ts 738177952, len 000160)
Got RTP packet from 192.168.77.165:10122 (type 08, seq 021570, ts 738178113, len 000160)
Sent RTP packet to 10.240.233.175:39475 (type 08, seq 016769, ts 738178112, len 000160)
Got RTP packet from 192.168.77.165:10122 (type 08, seq 021571, ts 738178273, len 000160)
Sent RTP packet to 10.240.233.175:39475 (type 08, seq 016770, ts 738178272, len 000160)
Got RTP packet from 192.168.77.165:10122 (type 08, seq 021572, ts 738178433, len 000160)
Sent RTP packet to 10.240.233.175:39475 (type 08, seq 016771, ts 738178432, len 000160)
Got RTP packet from 192.168.77.165:10122 (type 08, seq 021573, ts 738178593, len 000160)
Sent RTP packet to 10.240.233.175:39475 (type 08, seq 016772, ts 738178592, len 000160)
...
сети 10.0.0.0 - вообще нет в локалке, что-за фигня?
Начинаю мониторить на шлюзе:
- Код: выделить все
# tcpdump -i any '(host 192.168.77.254 or host 77.77.77.77 or host 10.240.233.175) and (portrange 10000-10200 or port 56560)'
...
11:15:03.208492 eth1 In IP (tos 0x28, ttl 52, id 52193, offset 0, flags [DF], proto TCP (6), length 56)
55.55.55.55.5867 > 77.77.77.77.56560: Flags [P.], cksum 0x4679 (correct), seq 3006:3010, ack 1939, win 373, options [nop,nop,TS val 77852461 ecr 106731054], length 4
11:15:03.208551 eth0 Out IP (tos 0x28, ttl 51, id 52193, offset 0, flags [DF], proto TCP (6), length 56)
192.168.77.254.5867 > 192.168.77.236.56560: Flags [P.], cksum 0x892d (correct), seq 3006:3010, ack 1939, win 373, options [nop,nop,TS val 77852461 ecr 106731054], length 4
11:15:03.209002 eth0 In IP (tos 0x60, ttl 64, id 62764, offset 0, flags [DF], proto TCP (6), length 52)
192.168.77.236.56560 > 192.168.77.254.5867: Flags [.], cksum 0x9bc1 (correct), seq 1939, ack 3010, win 501, options [nop,nop,TS val 106732854 ecr 77852461], length 0
11:15:03.209026 eth1 Out IP (tos 0x60, ttl 63, id 62764, offset 0, flags [DF], proto TCP (6), length 52)
77.77.77.77.56560 > 55.55.55.55.5867: Flags [.], cksum 0x590d (correct), seq 1939, ack 3010, win 501, options [nop,nop,TS val 106732854 ecr 77852461], length 0
11:15:05.347838 eth0 In IP (tos 0x60, ttl 64, id 62765, offset 0, flags [DF], proto TCP (6), length 970)
192.168.77.236.56560 > 192.168.77.254.5867: Flags [P.], cksum 0xfaf6 (correct), seq 1939:2857, ack 3010, win 501, options [nop,nop,TS val 106734993 ecr 77852461], length 918
11:15:05.347901 eth1 Out IP (tos 0x60, ttl 63, id 62765, offset 0, flags [DF], proto TCP (6), length 970)
77.77.77.77.56560 > 55.55.55.55.5867: Flags [P.], cksum 0xb842 (correct), seq 1939:2857, ack 3010, win 501, options [nop,nop,TS val 106734993 ecr 77852461], length 918
11:15:05.348716 eth0 In IP (tos 0xb8, ttl 64, id 2832, offset 0, flags [DF], proto UDP (17), length 200)
192.168.77.236.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348763 eth1 Out IP (tos 0xb8, ttl 63, id 2832, offset 0, flags [DF], proto UDP (17), length 200)
77.77.77.77.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348825 eth0 In IP (tos 0xb8, ttl 64, id 2833, offset 0, flags [DF], proto UDP (17), length 200)
192.168.77.236.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348825 eth0 In IP (tos 0xb8, ttl 64, id 2834, offset 0, flags [DF], proto UDP (17), length 200)
192.168.77.236.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348825 eth0 In IP (tos 0xb8, ttl 64, id 2835, offset 0, flags [DF], proto UDP (17), length 200)
192.168.77.236.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348825 eth0 In IP (tos 0xb8, ttl 64, id 2836, offset 0, flags [DF], proto UDP (17), length 200)
192.168.77.236.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348842 eth1 Out IP (tos 0xb8, ttl 63, id 2833, offset 0, flags [DF], proto UDP (17), length 200)
77.77.77.77.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348856 eth1 Out IP (tos 0xb8, ttl 63, id 2834, offset 0, flags [DF], proto UDP (17), length 200)
77.77.77.77.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348862 eth1 Out IP (tos 0xb8, ttl 63, id 2835, offset 0, flags [DF], proto UDP (17), length 200)
77.77.77.77.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348867 eth1 Out IP (tos 0xb8, ttl 63, id 2836, offset 0, flags [DF], proto UDP (17), length 200)
77.77.77.77.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348874 eth0 In IP (tos 0xb8, ttl 64, id 2837, offset 0, flags [DF], proto UDP (17), length 200)
192.168.77.236.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
11:15:05.348874 eth0 In IP (tos 0xb8, ttl 64, id 2838, offset 0, flags [DF], proto UDP (17), length 200)
192.168.77.236.10114 > 10.240.233.175.41785: [no cksum] UDP, length 172
...
И тут этот адрес (10.240.233.175) !!!
От куда он взялся?
Почему туда валится RTP-трафик?
И как починить?
