On Wed, Aug 07, 2024 at 07:04:07PM +0200, Marco Moock wrote:

Hello!

I use Linphone and SIP via TLS and SRTP.

I notice that the incoming SRTP is being blocked.

Is there any way to track that to allow it on demand?

There is a "sip" service that uses the kernel's connection tracking helpers. But the helper does not appear to be enabled for the "sips" service (TLS). Maybe because the packet in encrypted so the kernel can't read inside of it.

I don't see any evidence that Linux support conntrack helpers for sips.

Aug 07 18:46:57 zbook kernel: filter_IN_FedoraServer_REJECT: IN=vpn0 OUT= MAC= SRC=2a04:2100:0000:0300:0000:0000:0000:0160 DST=2a01:0170:xxxx LEN=80 TC=184 HOPLIMIT=57 FLOWLBL=0 PROTO=UDP SPT=13211 DPT=58422 LEN=40

I can set static dst ports for that, if that is a way.

That may be the only way, using --add-source-port.