5 ms·

I am using baresip on my phone(from fdroid). I don't have my whole stack plumbed yet so I can't say how well it works. but it connects to my asterisk server via

by somat 3y ago

I am using baresip on my phone(from fdroid). I don't have my whole stack plumbed yet so I can't say how well it works. but it connects to my asterisk server via wifi well enough. I was expecting sip to be built into android but apparently it was removed in 10 or 11. but found the baresip package. I like baresip well enough for desktop use so I decided to try it on the phone. It is one of those slow burn projects I work on every couple of months. mainly because I hate doing anything on the phone. but the idea is I have an asterisk server at the office that ties into the dialed phone world via sip trunk. I should be able to put a sip client on the phone, tunnel a secure connection to the office then the cell phone is just another office phone... anywhere in the world. Only piece left is the tunnel, I have my heart set on ipsec. is this folly? should I be looking into other tunnel tech?

mgsouth 3y ago
ipsec for the control plane (SIP) might be OK, but you'll probably run into jitter and latency issues with the media (RTP/RTCP). Also RTP has provisions for packet loss, but end-to-end encryption won't like that. SIP already has an encrypted mode [1], but I don't know how well it's currently supported in the wild. The purpose-built secure media protocols are Secure RTP/Secure RTCP [2]. Getting just plain SIP and RTP through consumer, enterprise, and cell carrier nets can be troublesome. For example, SIP especially is NAT-antagonistic, and edge routers can try to be "helpful" and do half-baked proxying or deep packet mangling that just messes up your smarter VoIP server. Consumer ISPs have a tendency to block SIP altogether. Throwing in encryption complications may give you another layer of hard-to-diagnose headaches. (Of course, if you can get the secure layer through the net it might force intermediaries to keep their fingers out. Other tricks like using non-standard ports can help with that, too.) Source: used to run the signalling/media dev team for a VoIP provder many moons ago, but we didn't bother with the secure modes/protocols. [1] https://en.wikipedia.org/wiki/Session_Initiation_Protocol#Encryption https://en.wikipedia.org/wiki/Session_Initiation_Protocol#En... [2] https://en.wikipedia.org/wiki/Secure_Real-time_Transport_Protocol https://en.wikipedia.org/wiki/Secure_Real-time_Transport_Pro...
flas9sd 3y ago
VoWifi is using an ipsec tunnel for both SIP/RTP to the providers IMS stack. With its popularity I think it's likely network admins increasingly allow for it in networks you do not control.

by somat 3y ago

mgsouth 3y ago

ipsec for the control plane (SIP) might be OK, but you'll probably run into jitter and latency issues with the media (RTP/RTCP). Also RTP has provisions for packet loss, but end-to-end encryption won't like that. SIP already has an encrypted mode [1], but I don't know how well it's currently supported in the wild. The purpose-built secure media protocols are Secure RTP/Secure RTCP [2]. Getting just plain SIP and RTP through consumer, enterprise, and cell carrier nets can be troublesome. For example, SIP especially is NAT-antagonistic, and edge routers can try to be "helpful" and do half-baked proxying or deep packet mangling that just messes up your smarter VoIP server. Consumer ISPs have a tendency to block SIP altogether. Throwing in encryption complications may give you another layer of hard-to-diagnose headaches. (Of course, if you can get the secure layer through the net it might force intermediaries to keep their fingers out. Other tricks like using non-standard ports can help with that, too.) Source: used to run the signalling/media dev team for a VoIP provder many moons ago, but we didn't bother with the secure modes/protocols. [1] https://en.wikipedia.org/wiki/Session_Initiation_Protocol#Encryption https://en.wikipedia.org/wiki/Session_Initiation_Protocol#En... [2] https://en.wikipedia.org/wiki/Secure_Real-time_Transport_Protocol https://en.wikipedia.org/wiki/Secure_Real-time_Transport_Pro...

flas9sd 3y ago

VoWifi is using an ipsec tunnel for both SIP/RTP to the providers IMS stack. With its popularity I think it's likely network admins increasingly allow for it in networks you do not control.