1

When running Asterisk on Amazon EC2 with an EIP, what are the NAT configurations for Asterisk?

[general]
nat=yes
externip=xxx.yyy.zzz.vvv
localnet=192.168.0.0/255.255.0.0 ; RFC 1918 addresses
localnet=10.0.0.0/255.0.0.0      ; Also RFC1918
localnet=172.16.0.0/12           ; Another RFC1918 with CIDR notation
localnet=169.254.0.0/255.255.0.0 ; Zero conf local network

Apparently, EIC uses NAT:

If your EC2 instance is in a private subnet in your VPC, then it can use your NAT to make outbound connections. The outside world would see it's IP address as your NAT's IP address, but the NAT's IP address would never "be" the Public IP address of the instance.

Overview of how EIP works:

Before going into an example, let's review how the Elastic IPs work:

...

Remember that each instance has an internal IP address and an external (public) one, which is translated to the internal one. If two external IPs were translated to the same internal IP then inbound packets would arrive fine, but sorting out outgoing packets (i.e. determining which external IP address to assign to outgoing packets) would be very difficult. Hence, the limitation of a single external IP address per instance at any given point in time.

wikipedia (for my reference):

Elastic IP addresses Amazon Elastic IP

Amazon's elastic IP address feature is similar to static IP address in traditional data centers, with one key difference. A user can programmatically map an elastic IP address to any virtual machine instance without a network administrator's help and without having to wait for DNS to propagate the binding. In this sense an Elastic IP Address belongs to the account and not to a virtual machine instance. It exists until it is explicitly removed, and remains associated with the account even while it is associated with no instance.

Getting down to nuts and bolts, in the context of SIP and Asterisk:

1.3. Different types of NATs and firewalls.

There are several ways UDP might be handled by a specific NAT or firewall implementations, these are categorized into:

1.3.1 Full Cone NAT

A full cone NAT is one where all requests from the same internal IP address and port are mapped to the same external IP address and port. Furthermore, any external host can send a packet to the internal host, by sending a packet to the mapped external address.

1.3.2 Restricted Cone:

A restricted cone NAT is one where all requests from the same internal IP address and port are mapped to the same external IP address and port. Unlike a full cone NAT, an external host (with IP address X) can send a packet to the internal host only if the internal host had previously sent a packet to IP address X.

1.3.3 Port Restricted Cone:

A port restricted cone NAT is like a restricted cone NAT, but the restriction includes port numbers.

Specifically, an external host can send a packet, with source IP address X and source port P, to the internal host only if the internal host had previously sent a packet to IP address X and port P.

1.3.4 Symmetric Nat:

A symmetric NAT is one where all requests from the same internal IP address and port, to a specific destination IP address and port, are mapped to the same external IP address and port. If the same host sends a packet with the same source address and port, but to a different destination, a different mapping is used. Furthermore, only the external host that receives a packet can send a UDP packet back to the internal host.

It sounds like EIC uses "full cone" NAT. What would be the Asterisk settings for NAT, then?

1 Answer 1

1

Externip should be set to external ip

Localnet set to local network(check using ifconfig).

Sure

nat=comedia,force_rport

(nat=yes not work in modern versions).

;   nat = no                ; Do no special NAT handling other than RFC3581
;   nat = force_rport       ; Pretend there was an rport parameter even if there wasn't
;   nat = comedia           ; Send media to the port Asterisk received it from regardless
;                           ; of where the SDP says to send it.
;   nat = auto_force_rport  ; Set the force_rport option if Asterisk detects NAT (default)
;   nat = auto_comedia      ; Set the comedia option if Asterisk detects NAT
4
  • This is an old thread but I am wondering if nat=yes works in version 15 or above? Also a little explanation of comedia,rport would be helpful.
    – Rahatur
    Apr 24, 2020 at 22:14
  • 1
    You should not use nat=yes in version 16. Even if worked at this moment(not sure). Changed above description of current modes. In short comedia,force_rport mean "i know better about client's NAT", which is true for most older phones and low-end softphones without STUN enabled.
    – arheops
    Apr 25, 2020 at 0:54
  • Thanks for the update. We have a NAT on the Asterisk 15.6.1 server. Problem is the voice on the extension (Bria softphone) is not working. Do we have to set a port number for rport? So I was wondering what should be the correct configuration for asterisk under NAT.
    – Rahatur
    Apr 25, 2020 at 7:00
  • Sorry, i not do debug on SO. You have debug yourself or write question with correct info about your nat and settings(including network picture) and wait till someone answer.
    – arheops
    Apr 25, 2020 at 11:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .