One way A/V when connected over wireguard VPN

[ekutner]

I'm using the add on with a SIP door phone and linphone on my phone. Everything works great as long as the phone is on my home wifi network. However, when I leave home I automatically connect to the home network over the cellular network using wireguard client on the phone and the wireguard add-on on Home Assistant. Under this scenario when I dial to the door phone (or vice versa), my voice is heard on the door phone but I don't get the audio or video from the door phone to my mobile phone app.

I'm pretty sure this is caused by NAT issues on the RTP stream and there are several layers of NAT involved here:

1. My phone gets a virtual address assigned by wireguard (in my case that's 172.27.x.x)
2. The wireguard add-on NAts this to its external address, which is the address of the docker container running the add-on (in my case that's 172.33.x.x)
3. When this traffic is going out to the LAN it gets NATed again by the Home Assistant host (in my case that's 192.268.x.x)

In Linphone the SIP account is registered with the external address of the host (192.168.x.x) however, when connecting over the VPN I see in the asterisk console that the connection is registered as coming from 172.33.x.x (the external address of the wireguard container). I guess it makes sense because both containers are running on the same host, so the external address of wireguard doesn't get NATed in this case.

Now the problem is that the door phone is trying to send the RTP stream to the 172.33.x.x address but it doesn't have any route to it. The other direction, from the mobile phone to the door phone is working fine because there are no NAT issues with the door phone, hence the uni-directional A/V.

Any ideas how to solve this?

[ekutner]

It took me nearly two full days of going down the deepest network rabbit hole to figure this one out, so I'll share my solution to save other people the time.

Asterisk Add-On Configuration

In the pjsip_custom.conf file add this section:

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060  ; Binds to all IP addresses on port 5060
; --- Network and NAT Configuration ---
; This is the most critical part for your use case.
; Add your local LAN and the VPN subnet here.
; Asterisk will treat any traffic from these networks as internal.
local_net=192.168.1.0/24   ; Your main LAN subnet - CHANGE THIS IF YOU USE A DIFFERENT NETWORK
local_net=172.27.66.0/24   ; The VPN clients virtual addresses subnet - ASSUMING YOU'RE USING THE DEFAULT WIREGUARD ADD-ON SETTINGS

In the same file modify the extension template section:

[sipjs-ext-endpoint](!)   ; <- This is the template header, it should already exist and you should add the following lines under it
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
direct_media=no

WireGuard Add-On Configuration

Add the following to the "Server" section in the add-on config page:

post_up: >
  iptables -A FORWARD -i %i -j ACCEPT ;  
  iptables -A FORWARD -o %i -j ACCEPT ;
  iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE ;  
  iptables -t nat -I POSTROUTING 1 -p udp -s 172.30.32.1 -d  172.27.66.0/24 --sport 10000:20000 -j SNAT --to-source <YOUR HOME ASSISTANT IP ADDRESS HERE> ; 
  iptables -t nat -I POSTROUTING 1 -p udp -s 172.27.66.0/24 -d <YOUR HOME ASSISTANT IP ADDRESS HERE> --dport 10000:20000 -j RETURN  
post_down: >
  iptables -D FORWARD -i %i -j ACCEPT ;  
  iptables -D FORWARD -o %i -j ACCEPT ;
  iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE ;  
  iptables -t nat -D POSTROUTING 1 -p udp -s 172.30.32.1 -d  172.27.66.0/24 --sport 10000:20000 -j SNAT --to-source <YOUR HOME ASSISTANT IP ADDRESS HERE> ; 
  iptables -t nat -D POSTROUTING 1 -p udp -s 172.27.66.0/24 -d <YOUR HOME ASSISTANT IP ADDRESS HERE> --dport 10000:20000 -j RETURN  

Notes:

1. Make sure you replace the place holders with your Home Assistant server IP address.
2. After saving this configuration the UI will wrap the text but that's fine.

Home Assistant Configuration

Add the following to your configuration.yaml file then restart Home Assistant:

shell_command:
  add_vpn_rtp_route: ip route add 172.27.66.0/24 via 172.30.33.3

Then create the following automation in Home Assistant UI:

alias: Add static routes on Home Assistant startup
description: "Add the necessary static route for VOIP calls to work over VPN after a HA restart"
triggers:
  - event: start
    trigger: homeassistant
conditions: []
actions:
  - action: shell_command.add_vpn_rtp_route
    data: {}
mode: single

That's it, you should now be able to have fully functional audio and video even when connecting remotely over WireGuard VPN.

[TECH7Fox]

Hi, thanks for sharing! Do you mind if I put your findings in the sip hass docs?

[ekutner]

Of course not, happy to share. Thank you for your work on the add-on.