Bypassing VOIP ISP block in Asterisk

This is an article I shared before on my LinkedIn profile a while ago, but I decided to re-share it on my blog with minor changes. You can find the LinkedIn article here.


Introduction

I was a new guy to Asterisk. I set up my users, my dialplan and everything seemed fine, until I wanted to let my users connect to my server from the internet. I set up port forwarding on my router, but when I tried to connect from an internet device, nothing would happen.
Living in Egypt, I discovered that my ISP is blocking SIP. Attempting to use SIP over UDP port 5060 (which is the default) always resulted in failure. I decided to change the port number, tried again but to no avail. I also tried SIP over a random TCP port but it still did not work. I concluded that my ISP blocks SIP using deep packet inspection. So I did some research, read some RFCs (Request for comments) and I will share here the concepts I learnt and how they helped me get over these restrictions.
Please know that this article is not a how-to step by step guide. It will only explain the concepts you need to solve this problem. I am currently (as of this article) NOT a professional and only sharing this to document my trials. To understand what is written here, one must have a basic understanding of networking, NAT and encryption.

Brief Review of a normal SIP call

A call consists of a signal and the media, the signal and the media are 2 completely separate things that just happen to work together in our case.
For Alice to call Bob, Alice crafts a SIP invite message (signal) and sends it to Asterisk. Asterisk then forwards this signal to Bob. Bob's phone starts ringing and he answers the call. SDP takes place which is basically how everyone agrees on how this call will be running; which ports they will use for sending media, which codecs will they use and so on. After this agreement is made, Alice should now have a port for sending media to Bob and another port for receiving media from Bob and the same goes for Bob.
Image from https://asterisktechs.wordpress.com
Alice can now start sending media (voice and/or video) to Bob and receiving media from Bob.

How ISPs block calls

After countless tests, I concluded that, ISPs block the signal and not the media. Afterall, if Bob cannot know that Alice is calling him, then no call could take place. Moreover, blocking the media is more troublesome. This is because it can take countless forms and can use any random port; it is difficult to identify.

How to deliver the signal

By encrypting the signal that gets sent to Bob so that no-one can determine it is actually a SIP invite message. This can be accomplished by using SIP over TLS operating at a random port number. Now the signalling becomes encrypted, the ISP (or any eavsdropper) cannot determine whether its a SIP message or Facebook or YouTube or anything! This way, we can guarantee that the signal will arrive to its destination.

How to deliver the media

Now that the signal can arrive at its destination, the caller and the called can agree on how to exchange media but this is not enough. Most internet users are behind a NAT device one way or the other, specially mobile internet users. When NAT is involved, no internet address can communicate with an inside device unless the inside device communicated with it first. This is a problem, cause when we described the operation of a normal call, every party allocated a UDP port for sending voice and another UDP port for receiving voice. In order to traverse NAT, one must use the same port for sending and receiving.

Symmetric RTP

Configuring Asterisk to use Symmetric RTP makes the user send and receive their data from the same UDP port. Now when Alice sends her voice from this port to Bob, Alice's port number gets recorded in the NAT table. When Bob sends his voice to Alice, then Alice's NAT will
know where to send Bob's voice because the port number she is using is already recorded in the NAT table.

Other Considerations

SIP Re-invites

In my setup, disabling SIP re-invites solved a lot of headaches, because I only had to worry about getting the data from the user to Asterisk and from Asterisk to the user. However, I plan to try again re-invites as soon as I am able.

Media Encryption

If your only goal is getting calls to work, then there is no need to encrypt the media considering that it is not blocked anyway. The more encryption you do, the larger the overhead and the lesser the overall call quality. You will also have to do more configuration to get it to work correctly. Moreover, if the eavesdropper did not see the signal then it cannot quite be sure which codec you are using, it cannot even determine if this is voice RTP media or just random UDP messages.

Conclusion

I hope this article was of use to you. I am no Asterisk professional but I do this because I enjoy doing it ^_^. If  you are like me and could not find the help you needed on the internet, be sure to follow my blog because I do not intend to share the regular stuff you find everywhere.

Comments

Post a Comment

Featured Posts

Using Squid, Apache and Python To Develop a Captive Portal Solution

Image
You can also read this article from my LinkedIn from this URL  https://www.linkedin.com/pulse/using-squid-apache-python-develop-captive-portal-solution-peter-emil When I was a student in high school, I was always fascinated with captive portals. It always felt like a super-secret powerful thing to redirect someone’s traffic to a website of my choice. Despite having this weird fascination, I never knew that this was called a captive portal until I went to my network security internship. During my internship, I was introduced to lots of concepts but never really learnt how to combine the ones I need to produce something like a captive portal page. Before we dive into this article you must first Have squid installed and configured as a transparent proxy. There are lots of guides on the internet that will i ns truct you on how to complete this step. Have Apache (or similar) installed and configured to use CGI (in our case, for a python script). [OPTIONAL] Have a local...
Read more

Hello World!!

Hey and welcome to my blog. About Me. I would like to welcome you to my blog. I am Peter, a human being who lives in Cairo, Egypt with a passion for technology. I go to Engineering school at Ain Shams University (for obvious reasons) and I major in Electronics and Communication systems. I like to study a lot of technology related topics like VOIP, Python programming, computer networking and embedded systems among other stuff but I still haven't picked my favourite. I am also quite interested in humanities like history and arts. Moreover, I am huge video game enthusiast. a 3ds max design 2010 certified associate, and have regularly developed personal gameplay and graphical mods for the games I play. My gaming philosophy is, If you can't mod it, don't play it. I am very passionate about what I do and I take it very seriously all the while keeping it fun and exciting. I can't say I will be blogging regularly but I promise to blog whenever I have something int...
Read more

Binding Class Attributes In Python (Part 2)

Image
Hello everyone, sorry I haven’t blogged for a while but I was busy with other matters and barely managed to allocate enough time over the weeks to write this article. My last article was about how you can use Python to bind to class attributes together so that updating one automatically updates the other. I also demonstrated how we used this method in a college project to implement a MIPS processor by defining each block, defining its inputs and outputs (in terms of inputs) and then, using the demonstrated method, tell Python that the output of this block is connected to the input of the other block and just letting everything evaluate itself automatically. This was, by far, the most viewed article on my blog, so if you haven’t read this article, I recommend you go do that now, just follow this link . The old article also contains a lot of essential background which is required for understanding this article, so if you want to make the most of this article, read the old one firs...
Read more

Realtime Distributed Deduplication: How storagebox Works

Image
StorageBox is a Python module that allows you to put items inside a storagebox (commonly referred to as the "Item Bank") and take items outside of the "Item Bank". As is the case with any physical storage box, the number of items you put in, is exactly the number of items you can take out. Nothing is lost and/or duplicated due to multiple distributed nodes doing simultaneous read/writes. StorageBox is ideal for projects that need to be developed really quickly without needing to worry about all potential race conditions. From a running cost prespective, It's also ideal for projects that receive a burst of requests at a specific point in time and then things start calming down. At the current state, StorageBox works with Amazon's DynamoDB but the same algorithm can be used with other databases! How does it work behind the scenes? Think of a Digital Box Let's start simple and imagine your run a movie store! You have 3 voucher codes you'd like to give t...
Read more

Building A Completely Serverless PyPI Repository On AWS

Image
So maybe you're a team focused on Python and you've been looking into the best ways to deliver your packages to other members of your team or even to production environments. You start having thoughtful debate about the issu *skip forward* you realize that pip might be your best option; everybody knows how to use pip , it works perfectly with virtual environments, does dependency management, it's basically awesome. But then reality hits you; In order to use pip , you need a PyPI repository to host your code and you don't want all your team's hard work to be out on the public PyPI repository  for obvious reasons. So you start looking around learning how to build a private PyPI repository and you stumble upon  PEP 503 -- Simple Repository API . Huzzah! You finally figured out how this thing works but then you go like Oh man, so I have to get a machine, install web server software on it, go through all the trouble of setting it up and using best practices, an...
Read more

Binding Class Attributes In Python

Image
You can also read this article from my LinkedIn here . If you’re not interested in my personal motivation to do this, you can skip right to the Essential Python Background section. Introduction During my last semester, my friends and I were studying a course called Computer Architecture . This course covered topics concerning how a computer processor works and how it is built and wired up internally. As a project, we were asked to build a software simulator that should be given input in the same manner a computer processor is given input, and then it produces the same output as the processor. After a lot of discussion, and despite facing some opposition, we decided that Python was the right tool for the job. The thing is, we had something in mind, that would make the whole process a trivial piece of cake but that something was not offered by default in Python. We had to build it ourselves. I was given the task of making this magic happen and I will explain what this magic wa...
Read more