Normally the first thing you would think is that you should use the host network in Docker but this loses the isolation, in that case I'd rather use LXC and a public IP or a full VM with public IP to avoid these issues.

Before you Start

I assume you have also ruled out any firewall issues on either end, that RTP or SIP signaling is not being blocked by either side.

1.) Key Settings in Docker/Ports

Before starting, I assume you have forwarded the listening IP of Asterisk into the container and the relevant rtp ports (eg. forward port 5060 to the Asterisk in Docker and ports 10000-20000 to the same.

2.) Key Asterisk Settings

I assume in sip.conf that you have set externip and localnets appropriately (eg. externip is the public IP of Docker and localnets are your local/LAN  Docker subnet).  More on the Docker subnet fun part later.

I also assume the peer/clients sip.conf have nat enabled.

The Issue

If we watch tcpdump we can see anything that connects from a direct public IP shows a public IP even when connecting to Asterisk on port 5060.

However, when you also take a client that is behind NAT or not and connect to your Asterisk behind Docker, you will see the connecting client as docker0 IP/gateway eg. 172.17.0.1 (sip show peers) instead of their public IP when you check your peers in Docker.

First of all, .1 should not be considered local, even though it is but remember .1 really represents the path back to the public IP of the client.

Here is the problem I encountered.

1.) The client behind NAT connects to Asterisk, SIP signaling works fine, you can get and make calls but there is 0 audio in either direction.  If you run a tcpdump on the client side network, you will see it is not sending any UDP packets to the Asterisk IP.  This is because if you check the SDP while debugging in Asterisk (sip set debug on) you will see it tells the client to connect to the Docker IP of Asterisk eg. 172.17.0.x, of course that is impossible since that is local to Docker.

2.) The other problem is that the SDP that Docker has for the client will tell it to connect to the client on it's LAN IP eg. 10.0.0.x which again is impossible.

In both cases we should be dealing with the public IP of the client and of Asterisk, but even with localnets and externip, that doesn't happen (although it works fine to an external SIP trunk).

Solution - the only way I could fix it was to do this:

I set localnets as the IP of the Asterisk container itself, and that forced Asterisk to understand to use it's own public IP to the client and to use the client's public IP.

localnets=172.17.0.x ;where x is the actual IP of your Asterisk container, if previously tried the whole subnet but that broke things as we can understand .1 is not really local in effect

asterisk, rtp, audio, docker, nat, clientnormally, isolation, lxc, ip, vm, ruled, firewall, sip, signaling, blocked, settings, ports, forwarded, container, relevant, eg, conf, externip, localnets, appropriately, lan, subnet, peer, enabled, tcpdump, connects, connecting, gateway, peers, represents, encountered, udp, packets, sdp, debugging, debug, doesn, external, previously,

Latest Articles