Info about SIP conntrack module...

My VoIP provider recently split their server pool from one server to
a pools of servers.

My iptables rules (particulary: conntracking ones) stop working; my
rules was:

	root@vfwacpn1:~# iptables -vnL -t raw
	Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
	 pkts bytes target     prot opt in     out     source               destin=
ation        =20
	  118 81333 CT         udp  --  ens18  *       10.172.0.0/21        0.0.0.=
0/0            match-set sip.messagenet.it_a dst multiport dports 5060,5061=
 CT helper sip
	  [...]

where 'sip.messagenet.it_a' is a set (ipset) with the IP of sip.messagenet.=
it
inside.


In this way, a typical SIP session was:

 root@vfwacpn1:/etc/network# tshark -ni ens18 -f 'host 10.172.1.7'
 Running as user "root" and group "root". This could be dangerous.
 Capturing on 'ens18'
    1 0.000000000 212.97.59.76 =E2=86=92 10.172.1.7   UDP 46 5061 =E2=86=92=
 5061 Len=3D4
    2 5.175179711 92:68:28:81:1e:9e =E2=86=92 9a:67:e6:c4:1f:ee ARP 42 Who =
has 10.172.1.7? Tell 10.172.1.254
    3 5.175692973 9a:67:e6:c4:1f:ee =E2=86=92 92:68:28:81:1e:9e ARP 42 10.1=
72.1.7 is at 9a:67:e6:c4:1f:ee
    4 11.790186903   10.172.1.7 =E2=86=92 212.97.59.76 SIP 604 Request: OPT=
IONS sip:sip.messagenet.it |=20
    5 11.809489686 212.97.59.76 =E2=86=92 10.172.1.7   SIP 666 Status: 200 =
OK |=20
    6 15.786333503 212.97.59.76 =E2=86=92 10.172.1.7   SIP/SDP 1326 Request=
: INVITE sip:[email protected]:5061 |=20
    7 15.789126709   10.172.1.7 =E2=86=92 212.97.59.76 SIP 812 Status: 100 =
Trying |=20
    8 15.944411484   10.172.1.7 =E2=86=92 212.97.59.76 SIP 828 Status: 180 =
Ringing |=20
    9 16.910168496 9a:67:e6:c4:1f:ee =E2=86=92 92:68:28:81:1e:9e ARP 42 Who=
 has 10.172.1.254? Tell 10.172.1.7
   10 16.910202553 92:68:28:81:1e:9e =E2=86=92 9a:67:e6:c4:1f:ee ARP 42 10.=
172.1.254 is at 92:68:28:81:1e:9e
   11 25.103626405 212.97.59.76 =E2=86=92 10.172.1.7   UDP 46 5061 =E2=86=
=92 5061 Len=3D4
   12 41.793771381   10.172.1.7 =E2=86=92 212.97.59.76 SIP 764 Request: REG=
ISTER sip:sip.messagenet.it:5061  (1 binding) |=20
   13 41.813853175 212.97.59.76 =E2=86=92 10.172.1.7   SIP 732 Status: 200 =
OK  (1 binding) |=20
   14 45.926054588   10.172.1.7 =E2=86=92 212.97.59.76 SIP/SDP 1235 Status:=
 200 OK |=20
   15 45.953153763 212.97.59.76 =E2=86=92 10.172.1.7   SIP 652 Request: ACK=
 sip:[email protected]:5061 |=20
   16 46.428107261   10.172.1.7 =E2=86=92 193.227.104.40 RTP 74 PT=3DITU-T =
G.729, SSRC=3D0x221261E, Seq'010, Time=160, Mark
   17 46.428260850 10.172.1.254 =E2=86=92 10.172.1.7   ICMP 102 Destination=
 unreachable (Communication administratively filtered)
   18 46.448437789   10.172.1.7 =E2=86=92 193.227.104.40 RTP 74 PT=3DITU-T =
G.729, SSRC=3D0x221261E, Seq'011, Time20
   19 46.448571326 10.172.1.254 =E2=86=92 10.172.1.7   ICMP 102 Destination=
 unreachable (Communication administratively filtered)
   20 46.468450353   10.172.1.7 =E2=86=92 193.227.104.40 RTP 74 PT=3DITU-T =
G.729, SSRC=3D0x221261E, Seq'012, TimeH0
   21 46.468561938 10.172.1.254 =E2=86=92 10.172.1.7   ICMP 102 Destination=
 unreachable (Communication administratively filtered)
   22 46.488464348   10.172.1.7 =E2=86=92 193.227.104.40 RTP 74 PT=3DITU-T =
G.729, SSRC=3D0x221261E, Seq'013, Timed0
   23 46.488576021 10.172.1.254 =E2=86=92 10.172.1.7   ICMP 102 Destination=
 unreachable (Communication administratively filtered)
   24 46.508439908   10.172.1.7 =E2=86=92 193.227.104.40 RTP 74 PT=3DITU-T =
G.729, SSRC=3D0x221261E, Seq'014, Time=800
   25 46.508545271 10.172.1.254 =E2=86=92 10.172.1.7   ICMP 102 Destination=
 unreachable (Communication administratively filtered)
   26 46.528491436   10.172.1.7 =E2=86=92 193.227.104.40 RTP 74 PT=3DITU-T =
G.729, SSRC=3D0x221261E, Seq'015, Time=960
   27 46.528580081 10.172.1.254 =E2=86=92 10.172.1.7   ICMP 102 Destination=
 unreachable (Communication administratively filtered)


Note the SIP traffic to 212.97.59.76 AKA sip.messagenet.it, and the RTP
traffic to 193.227.104.40.


I've looked at conntrack helper sip options:

	root@vfwacpn1:~# modinfo nf_conntrack_sip
	filename:       /lib/modules/4.19.0-17-amd64/kernel/net/netfilter/nf_connt=
rack_sip.ko
	alias:          nfct-helper-sip
	alias:          ip_conntrack_sip
	description:    SIP connection tracking helper
	author:         Christian Hentschel <[email protected]>
	[...]
	parm:           ports:port numbers of SIP servers (array of ushort)
	parm:           sip_timeout:timeout for the master SIP session (uint)
	parm:           sip_direct_signalling:expect incoming calls from registrar=
 only (default 1) (int)
	parm:           sip_direct_media:Expect Media streams between signalling e=
ndpoints only (default 1) (int)

and seems that 'sip_direct_signalling' and 'sip_direct_media', if
relaxed (put to 0) could be a solution.


But i've found some documentation on SIP conntrack module, but found
nothing.


Someone here have some feedback? Thanks.

--=20
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''          http://www.lanostrafamiglia.=
it/
  Polo FVG   -   Via della Bont=C3=A0, 7 - 33078   -   San Vito al Tagliame=
nto (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842=
797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)