Tag Archives: OpenBSC

Setting arbitary destination IP for RTP packets (NAT mangling)

Gosh, those VoIP specs need to be more friendly to NAT!

In short, as RFC standards does not state anything about NAT, the server assumes that the IP included with SDP packets is the true WAN IP of the client, which is not the case in NAT scenarios and leads to problems.
This is a temporary workaround for getting voice packets go through NAT in OpenBSC. It would fix the one way audio that many people are experiencing.
I might try branching out from the main code for proper NAT support. IMO it is pretty riciculous to assume that picocells are connected to the internet directly, haha.

NAT mangling does not work with translated ports, so you need to turn off port translation in some routers.

Edit the following code

abis_rsl.c :

static void ipac_parse_rtp(struct gsm_lchan *lchan, struct tlv_parsed *tv)
	struct in_addr ip;
	uint16_t port, conn_id;

		ip.s_addr = tlvp_val32_unal(tv, RSL_IE_IPAC_LOCAL_IP);
		DEBUGPC(DRSL, "LOCAL_IP=%s ", inet_ntoa(ip));
		lchan->abis_ip.bound_ip = ntohl(ip.s_addr);

Add a section to replace the IP with proper one.

		ip.s_addr = *((uint32_t *) TLVP_VAL(tv, RSL_IE_IPAC_LOCAL_IP));

		if (strcmp(inet_ntoa(ip), "/*internal IP*/") == 0)
			DEBUGP(DRSL, "Overwriting internal IP to a real one\n");
			inet_aton("/*external IP*/", &ip);

		DEBUGPC(DRSL, "LOCAL_IP=%s ", inet_ntoa(ip));
		lchan->abis_ip.bound_ip = ntohl(ip.s_addr);

You should replace the internal IP with the internal IP of the nanoBTS. And external IP with the router’s IP as seen from the BSC

SGSN temporary MCC/MNC authentication hack

From gprs_gmm.c

                        char mccmnc[16];
                        snprintf(mccmnc, sizeof(mccmnc), "%03d%02d", ra_id.mcc, ra_id.mnc);
                        if (strncmp(mccmnc, mi_string, 5) &&
                            (sgsn->cfg.acl_enabled &&
                             !sgsn_acl_lookup(mi_string))) {
                                LOGP(DMM, LOGL_INFO, "Rejecting ATTACH REQUESET IMSI=%s\n",
                                return gsm48_tx_gmm_att_rej_oldmsg(msg,

It needs to be commented out to allow roaming IMSIs to receive PDP contexts