I have a SIP-trunk without registration. So I must forward Port 5060 from external to my SBC. Right now it’s simple open, the goal is to reduce this to providers IP. This is done by a Destination-NAT.
Service-Port SIP is activated, but unfortunately no SIP-package will be manipulated. I can checked it via packet-tracing. Is this caused by the Destination-NAT?

Niels

SIP helper modules are best disabled. SBC is meant to be the outside device, it's the equivelent of a firewall for VOIP. If your filtering traffic going to the SBC I guess that means you don't have any remote-worker phones set up.

Thanks for your answer.
I wrote it a little bit wrong. I haven’t a real SBC, it‘s only a a small appliance of my phone system and not really save enough to connect it directly to the internet. At the moment it is and it’s hard working on defending all attacks.
Remote worker are connected via WebRTC or H.323 over a ReverseProxy and another internet-connection. Yes, H.323 sounds old but it‘s cool! Not so much attacks, a lower overhead and a big featureset, but it‘s harder to debug.
Most providers replacing the private IP in SDP automatically with the public IP, but the provider at this case doesn’t. So came up the idea with the SIP-helper. Mostly I say also ‚turn it off‘ to, but if it‘s working well it is a cool feature. If not it’s needless.

Niels