Should the module nf_conntrack_sip also be included in rc.net?

  IPCop contains two kernel modules related to sip of which neither are 
loaded automatically. The modules are nf_nat_sip (SIP ALG) and 
nf_conntrack_sip. The module nf_nat_sip needs nf_conntrack_sip but not 
the other way around. The module nf_nat_sip should not be loaded 
automatically, might not hurt to blacklist it as it is considered evil, 
broken etc. In VOIP forums, many problems are alleviated by turning off 
SIP ALG in commercial firewalls which unloads this module. I think it is 
only suited to firewalls which have the ATA built in if even then.

  I noticed rc.net loads the h.323 modules which are used for non sip 
audiovisual communications which is related to VOIP but used for virtual 
meetings and such.

  Without nf_conntrack_sip and it's default settings, IPCop keeps port 
5060 (default port in nf_conntrack_sip) connections initiated from the 
sip client open for only three minutes or so. With many providers this 
is not a problem. I have one that expects at least 500 seconds plus. The 
default time for the nf_conntrack_sip module is 3600 seconds. Loading 
only this module works nicely. My IP Phone does not have any real way to 
work around this. This link provides more information than most about 
what this module does.
https://wiki.freeswitch.org/wiki/Firewall

To use the options, probably a file called nf_conntrack_sip.conf could 
be added to /etc/modprobe.d. The entries would look like options 
nf_conntrack_sip [options]. For example,  options nf_conntrack_sip 
ports=5060,5070,5080 sip_direct_signalling=0 sip_direct_media=0. For 
default values obviously no options are needed.

The options that can be used are:
sip_direct_signalling= Expect incoming calls from registrar only 1 is 
the default, 0 will disable it.

sip_direct_media= Expect Media streams between signalling endpoints 
only, default is 1, 0 will disable it, this is for RTP, direct media 
would need 0.

sip_timeout= Timeout for the master SIP session, default is 3600, any 
integer will override the default value of 3600 seconds.

ports=  Port numbers of SIP servers, default is 5060, List of up to 8 
port numbers (comma-separated) eg. 5060,5070,5080.

It should be noted that if you use tls encrypted sip signaling which is 
usually port 5061, this module will do nothing. Also, invalid sip 
packets will be silently dropped by iptables such as lack of CSeq 
headers. I do not know if Asterisk ever has this problem.
-- 
Dave Studeman
http://www.raqcop.com


------------------------------------------------------------------------------