2008-09-24-astricon-stun-turn-ice.pdfVIP

NAT and Firewall Traversal with STUN / TURN / ICE Simon Perreault Viagénie {mailto|sip}:Simon.Perreault@viagenie.ca http://www.viagenie.ca Copyright Viagénie 2008 Credentials ● Consultant in IP networking and VoIP at Viagénie. ● Developed Numb, a STUN / TURN server. ● Ported FreeSWITCH to IPv6. ● Co-ported Asterisk to IPv6. ● Developed many custom VoIP applications. Copyright Viagénie 2008 Plan ● The problem of NAT and firewalls in VoIP ● How STUN, TURN, and ICE solve it ● Asterisk specifics ● Wireshark traces Copyright Viagénie 2008 The Problem of NAT and Firewalls in VoIP ● Network address translators (NATs) are common devices that “hide” private networks behind public IP addresses. ● Connections can be initiated from the private network to the Internet, but not the other way around. ● Having separate addresses for signaling and media makes the situation worse. Copyright Viagénie 2008 Server-Reflexive Address ● A NAT device works by associating a public address and port with a private destination address and port. Public Private 7 : 55123 : 5060 ● Valid for duration of flow – Meaning of “flow” for UDP? – Must be kept alive. ● Useful to discover this address. Copyright Viagénie 2008 STUN ● Session Traversal Utilities for NAT (STUN): simple protocol for discovering the server-reflexive address. – Client: Where do you see me at? – Server: I see you at 7:55123. ● A STUN server is located in the publ