feat: Add NAT localnet support with custom ports 6060/6061 #113
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds support for NAT configurations with custom ports 6060/6061 and introduces a LOCAL_SOURCE_SUBNETS feature to handle SIP clients from local subnets differently than external clients, avoiding the use of advertised public IP for internal clients.
Key changes:
- Added custom TCP/UDP port 6060 and TLS port 6061 for SIP traffic
- Implemented LOCAL_SOURCE_SUBNETS functionality to selectively use private IP for clients in specified local subnets
- Added firewall rules, configuration validation, and comprehensive documentation
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
imageroot/actions/create-module/20firewall |
Opens custom ports 6060 (TCP/UDP) and 6061 (TCP) in firewall |
modules/kamailio/bootstrap.sh |
Adds listen directives for custom ports 6060/6061 and initializes LOCAL_SOURCE_SUBNETS environment variable |
modules/kamailio/config/kamailio.cfg |
Implements CHECK_LOCAL_SOURCE route to selectively use private IP for requests from configured local subnets |
modules/kamailio/config/template.kamailio-local.cfg |
Adds LOCAL_SOURCE_SUBNETS configuration variable |
imageroot/actions/configure-module/20configure |
Handles LOCAL_SOURCE_SUBNETS configuration from API input |
imageroot/actions/get-configuration/20read |
Returns LOCAL_SOURCE_SUBNETS in configuration output |
imageroot/actions/configure-module/validate-input.json |
Adds validation schema for local_source_subnets array with CIDR pattern |
tests/10_actions/15_configure_local_source_subnets.robot |
Adds automated tests for LOCAL_SOURCE_SUBNETS configuration |
examples/test-local-source-subnets.sh |
Provides test script for manual verification of LOCAL_SOURCE_SUBNETS |
examples/configure-with-local-subnets.json |
Sample configuration with local_source_subnets |
docs/LOCAL_SOURCE_SUBNETS.md |
Technical documentation for LOCAL_SOURCE_SUBNETS feature |
README_LOCAL_SOURCE_SUBNETS_IT.md |
Italian user guide for LOCAL_SOURCE_SUBNETS |
CHANGELOG.md |
Documents the new LOCAL_SOURCE_SUBNETS feature |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Amygos
force-pushed
the
157-under-nat-localnet
branch
from
4e2b18c to
33786ee
Compare
added 6 commits
January 26, 2026 10:36
Open custom ports: * 6060 udp/tcp: SIP * 6061 tcp: SIPS
Enable port 6060 and 6061 in the Kamailio bootstrap script.
Update SET_SOCKET route to handle LOCALNETWORKS and INTERNAL_NETWORK more accurately. This forces PRIVATE_IP for LAN SIP traffic and uses SERVICE_IP for service network destinations (e.g., Asterisk). Fixes NAT connectivity issues for clients behind local subnets by ensuring advertised address matches network scope.
Add a script for making SIP calls using the baresip application. The script includes functions for printing banners, scenarios, usage, steps, success messages, and information messages. It also includes functions for starting the caller and callee, initiating the call, displaying progress, and cleaning up after the call. The script supports LAN, WAN reverse call scenarios.
Updated the rsync destination path in.sh script to correctly sync files the specified directory on the server.
Added .cursorindexingignore to exclude SpecStory auto-save files from indexing and allow explicit context inclusion via @ references. Also added .specstory/.gitignore to ignore SpecStory project identity and explanation files.
Amygos
force-pushed
the
157-under-nat-localnet
branch
from
33786ee to
93fc0b7
Compare
Wrap TT157 xlog statements in conditional debug checks to reduce unnecessary log noise in production.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces several improvements and fixes related to SIP proxy networking, firewall configuration, and developer tooling. The main focus is on enhancing Kamailio's handling of internal and external networks, opening new SIP-related ports, and providing new scripts and ignore rules for development convenience.
Kamailio SIP Proxy Improvements:
SET_SOCKETroute inkamailio.cfgto more robustly determine and set the correct network socket for SIP messages, including explicit handling forINTERNAL_NETWORK(service network for Asterisk) andLOCALNETWORKS, with improved logging for debugging. [1] [2] [3] [4]bootstrap.shto add listeners for new SIP ports (6060/udp, 6060/tcp, 6061/tls) when behind NAT.SERVICE_IPvariable in the Kamailio configuration template for better separation of service and private networks.Firewall and Network Configuration:
Developer Tooling and Scripts:
baresipCall.shto automate SIP call testing between different network scenarios (LAN, WAN, reverse), including colored output and progress visualization.rsync.shscript by fixing the remote path for syncing project files to use/home/$2/ns8-nethvoice-proxy/.specstory/. [1] [2]