Kerio Tech KERIO WINROUTE FIREWALL 6, Руководство администратора

Страница: 103 / 368

7.9 Media hairpinning
103
Example: Two SIP telephones in the LAN
Let us suppose two SIP telephones are located in the LAN. These telephones authenticate at
a SIP server in the Internet. The parameters may be as follows:
• IP addresses of the phones: 192.168.1.100 and 192.168.1.101
• Public IP address of the firewall: 195.192.33.1
• SIP server: sip.server.com
For the telephones, define corresponding traffic rules — see chapter 7.8 (as apparent from
figure 7.39 , simply specify Source of the Full cone NAT traffic rule by IP address of the other
telephone).
Both telephones will be registered on SIP server under the firewall’s public IP address
( 195.192.33.1 ). If these telephones establish mutual connection, data packets (for voice
transmission) from both telephones will be sent to the firewall’s public IP address (and to the
port of the other telephone). Under normal conditions, such packets would be dropped. How-
ever, WinRoute is capable of using a corresponding record in the NAT table to recognize that
a packet is addressed to a client in the local network. Then it translates the destination IP
address and sends the packet back to the local network (as well as in case of port mapping).
This ensures that traffic between the two phones will work correctly.
Note:
1. Hairpinning requires traffic between the local network and the Internet being allowed (be-
fore processed by the firewall, packets use a local source address and an Internet destina-
tion address — i.e. this is an outgoing traffic from the local network to the Internet). In
default traffic rules created by the wizard (see chapter 7.1 ), this condition is met by the
NAT rule.
2. In principle, hairpinning does not require that Full cone NAT is allowed (see chapter 7.8 ).
However, in our example, Full cone NAT is required for correct functioning of the SIP
protocol.