We have a customer that wants to add some additional security configurations on their firewall, and are complaining that the local IP’s of the WebRTC users is shown in the in the 200 OK SDP response we receive when Asterisk calls them.
When they enable their new restrictions, then we instead receive 0.0.0.0 as the IP, and there is no a=candidate header present. From the events it seems that the call is connected, but no audio is getting through.
The WebRTC clients only ever receive calls from Asterisk and never initiates calls them selves.
Is there a way to configure Asterisk to work under these conditions?
The only thing I have in the [ice_host_candidates] is localIP => publicIP, so our public IP is used.
Would additional address resolutions be able to handle this problem?
Without their restrictions, the SDP in the response looks like this, with the users IP 10.116.197.205 shown, and a a=candidate header present.
v=0
o=- 3608525858142418577 2 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE audio-0
a=msid-semantic: WMS 11e63ba6-0527-48e6-8bb8-6f4a2c4284fe
m=audio 58460 UDP/TLS/RTP/SAVPF 107 101
c=IN IP4 10.116.197.205
a=rtcp:9 IN IP4 0.0.0.0
a=candidate:660261827 1 udp 2113937151 10.116.197.205 58460 typ host generation 0 network-cost 999
a=ice-ufrag:sfef
a=ice-pwd:XR3uxcUE5TwzYcQgpCUx9bGz
a=ice-options:trickle
a=fingerprint:sha-256 94:84:D0:00:1E:31:3D:A5:C2:31:D1:0A:4E:F1:32:4D:36:C6:69:08:8B:5C:54:CB:A5:36:D0:C0:35:31:34:22
a=setup:active
a=mid:audio-0
a=sendrecv
a=msid:11e63ba6-0527-48e6-8bb8-6f4a2c4284fe 791cbf45-39ac-41e5-9530-c9f07bbeabf6
a=rtcp-mux
a=rtpmap:107 opus/48000/2
a=rtcp-fb:107 transport-cc
a=fmtp:107 minptime=10;useinbandfec=1
a=rtpmap:101 telephone-event/8000
a=ssrc:2025324176 cname:gc/BxCVZ8W31mOZU
With their new security configurations enabled we receive this in the response:
v=0
o=- 991398919128466525 2 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE audio-0
a=msid-semantic: WMS 2b361399-6356-4186-84b6-046716e0b238
m=audio 9 UDP/TLS/RTP/SAVPF 107 101
c=IN IP4 0.0.0.0
a=rtcp:9 IN IP4 0.0.0.0
a=ice-ufrag:znQI
a=ice-pwd:DR679urHQgktBmykhuAEk50J
a=ice-options:trickle
a=fingerprint:sha-256 AB:86:AE:4F:EA:C7:52:AF:50:03:53:4E:75:CA:F7:4A:A8:77:C3:26:9D:63:46:99:E0:A3:5A:30:F5:6D:40:C4
a=setup:active
a=mid:audio-0
a=sendrecv
a=msid:2b361399-6356-4186-84b6-046716e0b238 f4b3ba3b-5c62-47f8-a5b5-811649a86a62
a=rtcp-mux
a=rtpmap:107 opus/48000/2
a=rtcp-fb:107 transport-cc
a=fmtp:107 minptime=10;useinbandfec=1
a=rtpmap:101 telephone-event/8000
a=ssrc:2197018627 cname:q3iflIGAKzyXuhIi