Member Avatar for Malaka_1

Hi All, I Need LAN Computers (X lite Client) to be able to VoIP Server (Asterisk). How can i configure the proxy server for this purpose.my diagram is in link.can you help to connect X lite client to VoIP server.

Following are the Configuration.

  • LAN - X Lite Client

    • need to connct to example.com:5060 to register client

  • Proxy Server - Centos 7

    • Squid Proxy
    • etho0 - 192.168.1.250 /connect to ADSL Router ,Masquerade zone disable
    • etho1 - 192.168.1.0/24 connect to LAN , DHCP Server enable
  • VoIP Server - Asterisk 11.20.0 1.el7.centos
    • SIP ports 5004 - 5082 UDP
    • RTP Ports 10000 - 20000 UDP
  • 2 Contributors
  • 1 Reply
  • 490 Views
  • 2 Years Discussion Span
  • Latest Post Latest Post by drewgen

Dani AI

Generated

— concise, practical summary and steps.

Squid is an HTTP proxy and will not proxy SIP/RTP traffic. For X‑Lite clients to register to a remote SIP server you need one of two things on your CentOS gateway: (A) packet-level NAT/forwarding that allows UDP/TCP SIP and the RTP port range to pass through, or (B) an application-level SIP proxy + media relay (Kamailio/OpenSIPS + rtpproxy/rtpengine). The quickest, lowest-effort fix is (A): enable IP forwarding, enable NAT (MASQUERADE) for outbound traffic, and open the SIP + RTP UDP ranges in the firewall.

Enable IP forwarding and persist it:

sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p

Example iptables rules (replace interface names and port ranges with your actual values):

# NAT outbound (assume eth0=WAN)
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Allow SIP signaling and RTP media through
iptables -A FORWARD -i eth1 -o eth0 -m conntrack --ctstate NEW -p udp --dport 5060 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p udp --dport 10000:20000 -j ACCEPT

# Allow established/related return traffic
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

If you use firewalld, do the equivalent with firewall-cmd (check the zone attached to the WAN interface first):

firewall-cmd --get-active-zones
firewall-cmd --permanent --zone=<wan-zone> --add-masquerade
firewall-cmd --permanent --zone=<wan-zone> --add-port=5060/udp
firewall-cmd --permanent --zone=<wan-zone> --add-port=10000-20000/udp
firewall-cmd --reload

Notes and troubleshooting:

  • Disable SIP ALG on the ADSL router; ALG often mangles SIP.
  • If the gateway cannot NAT (policy reasons), deploy Kamailio/OpenSIPS as an outbound proxy and a media relay (rtpproxy/rtpengine) to handle RTP.
  • Use tcpdump or sngrep to capture SIP messages (e.g., tcpdump -i eth1 udp port 5060 or sngrep) and verify REGISTER/200 OK flows and RTP ports.
  • If clients use TLS/TCP or different port ranges, open those ports instead of the examples above.
  • For servers behind NAT, ensure Asterisk has correct external IP/external address settings (externaddr/externip) or uses a TURN/STUN solution for media.

To : the above is the usual working solution for this topology (Squid alone will not do it).

Member Avatar for drewgen

Were you able to figure this out?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.