· 9 years ago · Jul 23, 2017, 09:02 PM
1#####################################################################
2#### FREESWITCH CLUSTER
3#####################################################################
4####
5#### A receipt for a FreeSWITCH cluster on AWS, made by 2 loadbalancers-rtpproxies
6#### in High Availability, 2 file-database servers in High Availability,
7#### and N FreeSWITCH machines load balanced.
8####
9#### Load Balancers distribute sip traffic and manage NAT traversal,
10#### FreeSWITCHes have pgsql in core and in sofia, relevant file systems
11#### parts are served via GlusterFS from the database machines.
12####
13#### Postgresql is in BiDirectional Replication (BDR), master-master.
14####
15#### GlusterFS is an auto-healing cluster file system, enterprise ready.
16####
17#### On each FS machine there is an HAproxy that proxies postgresql connections
18#### to the active postgresql machine (eg: no need for floating IP on DB machines)
19####
20#### On Load balancer machines, Kamailio will fairly distribute "generic"
21#### calls, while calls to conferences will be dispatched to a specific FS
22#### box (or to its failover).
23####
24#### Load balancers have a floating public IP address (EIP, Elastic IP) that
25#### is assigned via keepalived to the active machine. Both machines are
26#### active at same time, only EIP will switch.
27####
28#### That EIP is the only "public" IP, the one of the SIP domain.
29####
30#### Only critical part is the /etc/hosts file, that contains the addresses
31#### of database-file servers. Only those two addresses (for two database
32#### machines) are needed. Also, after startup it would work if at least
33#### one of the two entries are ok. Best would be to synchronize that file
34#### /etc/hosts via rsync or unison on all machines.
35####
36#### This is just a draft, but is tested to work. Need more documentation,
37#### explanations, etc
38####
39#### -giovanni
40####
41#####################################################################
42
43
44# Jessie 64 minimal on AWS
45# https://wiki.debian.org/Cloud/AmazonEC2Image/Jessie
46
47#####################################################################
48#####################################################################
49#####################################################################
50##
51## POSTGRESQL + GLUSTER export BOXES
52##
53#####################################################################
54#####################################################################
55#####################################################################
56
57apt-get clean && apt-get update
58
59apt-get install locales
60
61# choose en_US.UTF-8 UTF-8
62dpkg-reconfigure locales
63
64# your xterm locale will mess the server's locale. Prevent it from doing evil
65# commenting out AcceptEnv
66
67vi /etc/ssh/sshd_config
68# Allow client to pass locale environment variables
69# AcceptEnv LANG LC_*
70
71reboot
72
73
74apt-get clean && apt-get update && apt-get -y upgrade && apt-get -y dist-upgrade
75
76reboot
77
78# GLUSTERFS
79
80##############################################
81### on BOTH gd01 and gd02
82##############################################
83apt-get install glusterfs-server
84
85vi /etc/hosts
86------------------------------------------------
87127.0.0.1 localhost
88::1 localhost ip6-localhost ip6-loopback
89ff02::1 ip6-allnodes
90ff02::2 ip6-allrouters
91172.31.2.187 gd01
92172.31.2.238 gd02
9352.28.144.113 sip.mydomain.com
94------------------------------------------------
95
96mkdir /exported01
97
98##############################################
99### only on gd01
100##############################################
101gluster peer probe gd02
102gluster peer status
103
104##############################################
105### only on gd02
106##############################################
107gluster peer probe gd01
108gluster peer status
109
110##############################################
111### only on gd01
112##############################################
113
114gluster volume create volume01 replica 2 transport tcp gd01:/exported01 gd02:/exported01 force
115
116gluster volume start volume01
117
118gluster volume info
119
120#
121# YOU NEVER EVER WRITE DIRECTLY IN /exported01 DIRECTORY !!!!!!!!!!
122# you need to mount it !
123# FORGET /export01 EVEN EXISTS !!!!!
124#
125##############################################
126### on BOTH gd01 and gd02
127##############################################
128
129mkdir /imported01
130
131vi /etc/fstab
132---------------------------
133gd01:/volume01 /imported01 glusterfs defaults,_netdev,backupvolfile-server=gd02 0 0
134---------------------------
135
136mount /imported01
137
138ls -l /imported01/
139
140vi /imported01/ciao
141
142gluster volume status
143
144#####################################################################
145
146echo "deb http://apt.postgresql.org/pub/repos/apt/ jessie-pgdg main" > /etc/apt/sources.list.d/2ndquadrant.list
147echo "deb http://packages.2ndquadrant.com/bdr/apt/ jessie-2ndquadrant main" >>
148
149cat /etc/apt/sources.list.d/2ndquadrant.list
150
151wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
152
153wget --quiet -O - http://packages.2ndquadrant.com/bdr/apt/AA7A6805.asc | apt-key add -
154
155apt-get update
156
157apt-get install postgresql-bdr-9.4 postgresql-bdr-contrib-9.4 postgresql-bdr-9.4-bdr-plugin
158
159#####################################################################
160
161# add at end of config file:
162 vi /etc/postgresql/9.4/main/postgresql.conf
163------------------------------------------------------------------------------------
164 listen_addresses = '*'
165 shared_preload_libraries = 'bdr'
166 wal_level = 'logical'
167 track_commit_timestamp = on
168 max_connections = 100
169 max_wal_senders = 10
170 max_replication_slots = 10
171 # Make sure there are enough background worker slots for BDR to run
172 max_worker_processes = 10
173
174 # These aren't required, but are useful for diagnosing problems
175 #log_error_verbosity = verbose
176 #log_min_messages = debug1
177 #log_line_prefix = 'd=%d p=%p a=%a%q '
178
179 # Useful options for playing with conflicts
180 #bdr.default_apply_delay=2000 # milliseconds
181 #bdr.log_conflicts_to_table=on
182
183bdr.skip_ddl_locking = on
184
185------------------------------------------------------------------------------------
186
187
188# SECURITY RISK !!!!! PUT PASSWORD !!!!
189# USER postgres CAN ENTER WITHOUT PASSWORD
190# FROM ENTIRE 172.31.XXX.XXX (all AWS)
191
192# add at end of config file:
193vi /etc/postgresql/9.4/main/pg_hba.conf
194------------------------------------------------------------------------------------
195local replication postgres trust
196host replication postgres 127.0.0.1/32 trust
197host replication postgres ::1/128 trust
198host replication postgres 172.31.0.0/8 trust
199host all postgres 172.31.0.0/8 trust
200------------------------------------------------------------------------------------
201
202/etc/init.d/postgresql restart
203
204#####################################################################
205
206##############################################
207### only on gd01
208##############################################
209su - postgres
210
211# as user "postgres"
212
213createdb -U postgres freeswitch
214
215psql freeswitch
216
217 CREATE EXTENSION btree_gist;
218 CREATE EXTENSION bdr;
219 CREATE EXTENSION pgcrypto;
220
221
222 SELECT bdr.bdr_group_create(
223 local_node_name := 'gd01',
224 node_external_dsn := 'host=gd01 port=5432 dbname=freeswitch'
225);
226
227SELECT bdr.bdr_node_join_wait_for_ready();
228
229##############
230
231##############################################
232### only on gd02
233##############################################
234su - postgres
235
236# as user "postgres"
237
238createdb -U postgres freeswitch
239
240psql freeswitch
241
242 CREATE EXTENSION btree_gist;
243 CREATE EXTENSION bdr;
244 CREATE EXTENSION pgcrypto;
245
246
247SELECT bdr.bdr_group_join(
248 local_node_name := 'gd02',
249 node_external_dsn := 'port=5432 dbname=freeswitch host=gd02',
250 join_using_dsn := 'port=5432 dbname=freeswitch host=gd01'
251 );
252
253SELECT bdr.bdr_node_join_wait_for_ready();
254
255#####################################################################
256#####################################################################
257
258
259
260#####################################################################
261#####################################################################
262## HOW TO RE-CREATE A NODE FROM A PARTED ONE
263## EG: ONCE PARTED YOU CANNOT RE-ADD IT
264#####################################################################
265#####################################################################
266
267# http://www.postgresql.org/message-id/CALXsgcRo=dCkTZ2FdRerKUKXJKPVYOs4CYQy2QtVeNOFSxj0Ow@mail.gmail.com
268# http://www.postgresql.org/message-id/BC0E70C8-EDD4-4DFB-B5FC-CF2880D9ACBD@vipaar.com
269# http://www.postgresql.org/message-id/CAMsr+YGmtNwd7-fFY7hJqwp-TXGg9+w1wVUYpd_mCGgYA+oFNQ@mail.gmail.com
270
271##############################
272##############################
273#
274# we want to part node gd02, or perhaps gd02 is failed
275#
276##############################
277##############################
278
279
280##############################
281# on node gd02
282
283service postgresql stop
284
285
286##############################
287# then, on node gd01 part and clean
288
289SELECT bdr.bdr_part_by_node_names(ARRAY['gd02']);
290
291select * from bdr.bdr_connections;
292delete from bdr.bdr_connections where conn_sysid='6192121455480583424';
293
294select * from bdr.bdr_nodes;
295delete from bdr.bdr_nodes where node_status='k';
296
297select * from pg_catalog.pg_replication_slots;
298select * from pg_replication_slots;
299select pg_drop_replication_slot('bdr_16391_6145085940943605149_1_16391__');
300
301select * from bdr.bdr_connections;
302select * from bdr.bdr_nodes;
303select * from pg_catalog.pg_replication_slots;
304select * from pg_replication_slots;
305select * from pg_stat_replication;
306
307##############################
308# then, on node gd02 purge and reinstall all
309
310apt-get purge postgresql-bdr-9.4
311apt-get install postgresql-bdr-9.4 postgresql-bdr-contrib-9.4 postgresql-bdr-9.4-bdr-plugin
312
313service postgresql stop
314
315cp pg_hba.conf /etc/postgresql/9.4/main/pg_hba.conf
316cp postgresql.conf /etc/postgresql/9.4/main/postgresql.conf
317
318service postgresql restart
319
320su - postgres
321
322# as user 'postgres' :
323
324createdb -U postgres freeswitch
325psql freeswitch
326
327 CREATE EXTENSION btree_gist;
328 CREATE EXTENSION bdr;
329 CREATE EXTENSION pgcrypto;
330
331 SELECT bdr.bdr_group_join(
332 local_node_name := 'gd02',
333 node_external_dsn := 'port=5432 dbname=freeswitch host=gd02',
334 join_using_dsn := 'port=5432 dbname=freeswitch host=gd01'
335 );
336
337 SELECT bdr.bdr_node_join_wait_for_ready();
338
339#####################################################################
340#####################################################################
341#####################################################################
342
343# TEST:
344
345##############################################
346### only on gd02
347##############################################
348------------------------------------
349 CREATE TABLE t1bdr (c1 INT, PRIMARY KEY (c1));
350 INSERT INTO t1bdr VALUES (1);
351 INSERT INTO t1bdr VALUES (2);
352 -- you will see two rows
353 SELECT * FROM t1bdr;
354------------------------------------
355
356##############################################
357### only on gd01
358##############################################
359 -- you will see two rows
360 SELECT * FROM t1bdr;
361 DELETE FROM t1bdr WHERE c1 = 2;
362 -- you will see one row
363 SELECT * FROM t1bdr;
364------------------------------------
365##############################################
366### only on gd02
367##############################################
368 -- you will see one row
369 SELECT * FROM t1bdr;
370##############################################
371
372
373
374#####################################################################
375## CREATE FREESWITCH TABLES
376#####################################################################
377
378##############################################
379### on gd01 or gd02
380##############################################
381# create FreeSWITCH 1.4.21 tables with UUID PKs
382
383su - postgres
384
385# as user postgres
386
387psql freeswitch < freeswitch.sql
388
389#####################################################################
390#####################################################################
391
392
393#####################################################################
394#####################################################################
395#####################################################################
396##
397## FREESWITCH + HAPROXY + GLUSTER client BOXES
398##
399#####################################################################
400#####################################################################
401#####################################################################
402
403apt-get clean && apt-get update
404
405apt-get install locales
406
407# choose en_US.UTF-8 UTF-8
408dpkg-reconfigure locales
409
410# your xterm locale will mess the server's locale. Prevent it from doing evil
411# commenting out AcceptEnv
412
413vi /etc/ssh/sshd_config
414# Allow client to pass locale environment variables
415# AcceptEnv LANG LC_*
416
417reboot
418
419
420apt-get clean && apt-get update && apt-get -y upgrade && apt-get -y dist-upgrade
421
422reboot
423
424#####################################################################
425
426vi /etc/hosts
427------------------------------------------------
428127.0.0.1 localhost
429::1 localhost ip6-localhost ip6-loopback
430ff02::1 ip6-allnodes
431ff02::2 ip6-allrouters
432172.31.2.187 gd01
433172.31.2.238 gd02
43452.28.144.113 sip.mydomain.com
435------------------------------------------------
436
437
438apt-get update && apt-get install -y curl
439curl http://files.freeswitch.org/repo/deb/debian/freeswitch_archive_g0.pub | apt-key add -
440
441cat >/etc/apt/sources.list.d/freeswitch.list <<EOT
442deb http://files.freeswitch.org/repo/deb/debian/ jessie main
443EOT
444
445apt-get update
446
447apt-get install freeswitch-meta-vanilla
448
449apt-get purge freeswitch-systemd freeswitch-sysvinit freeswitch-init
450
451apt-get install freeswitch-sysvinit
452
453cp -a /usr/share/freeswitch/conf/vanilla /etc/freeswitch
454
455adduser freeswitch daemon
456
457service freeswitch stop
458service freeswitch stop
459service freeswitch stop
460service freeswitch stop
461
462service freeswitch start
463
464service freeswitch status
465
466#####################################################################
467
468apt-get install haproxy hatop
469
470vi /etc/haproxy/haproxy.cfg
471-----------------------------------------------------------------
472global
473 log /dev/log local0
474 log /dev/log local1 notice
475 chroot /var/lib/haproxy
476 stats socket /run/haproxy/admin.sock mode 660 level admin
477 stats timeout 30s
478 user haproxy
479 group haproxy
480 daemon
481
482 # Default SSL material locations
483 ca-base /etc/ssl/certs
484 crt-base /etc/ssl/private
485
486 # Default ciphers to use on SSL-enabled listening sockets.
487 # For more information, see ciphers(1SSL). This list is from:
488 # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
489 ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
490 ssl-default-bind-options no-sslv3
491
492listen pgsql_pool 0.0.0.0:10001
493 timeout connect 5000
494 timeout client 60m
495 timeout server 60m
496 mode tcp
497 option pgsql-check user postgres
498 balance roundrobin
499 # gd01 will get all traffic if up
500 server gd01 gd01:5432 check
501 # gd02 will get all traffic if gd01 is down
502 server gd02 gd02:5432 check backup
503-----------------------------------------------------------------
504
505service haproxy restart
506
507#####################################################################
508
509apt-get install glusterfs-client
510
511mkdir /imported01
512
513vi /etc/fstab
514---------------------------
515gd01:/volume01 /imported01 glusterfs defaults,_netdev,backupvolfile-server=gd02 0 0
516---------------------------
517
518mount /imported01
519
520ls -l /imported01/
521
522############################
523mkdir -p /imported01/haproxy/etc/
524cp -a /etc/haproxy/haproxy.cfg /imported01/haproxy/etc/
525mv /etc/haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg.ORIGINAL
526ln -s /imported01/haproxy/etc/haproxy.cfg /etc/haproxy/
527ls -l /etc/haproxy/haproxy.cfg
528############################
529
530service haproxy restart
531
532#####################################################################
533
534# fix password
535 vi /etc/freeswitch/vars.xml
536
537# fix core-dsn
538vi /etc/freeswitch/autoload_configs/switch.conf.xml
539----------------------------------------------------------------------
540 <param name="core-db-dsn" value="pgsql://hostaddr=127.0.0.1 dbname=freeswitch user=postgres port=10001 password='' options='-c client_min_messages=NOTICE'" />
541----------------------------------------------------------------------
542
543# fix sofia-dsn
544vi /etc/freeswitch/sip_profiles/internal.xml
545----------------------------------------------------------------------
546<param name="odbc-dsn" value="pgsql://hostaddr=127.0.0.1 port=10001 dbname=freeswitch user=postgres password='' options='-c client_min_messages=NOTICE' application_name='freeswitch'" />
547----------------------------------------------------------------------
548
549apt-get install postgresql-client
550
551psql -U postgres -h 127.0.0.1 -p 10001 freeswitch
552\d
553\q
554
555
556#####################################################################
557
558service freeswitch restart
559
560fs_cli
561
562# from fs_cli
563version
564sofia status
565fsctl shutdown
566
567#####################################################################
568
569mkdir -p /imported01/fsroot/etc
570mkdir -p /imported01/fsroot/var/lib
571
572chown -R freeswitch:freeswitch /imported01/fsroot
573
574cp -a /etc/freeswitch /imported01/fsroot/etc/
575cp -a /var/lib/freeswitch /imported01/fsroot/var/lib/
576
577ls -l /imported01/fsroot/var/lib/freeswitch/
578
579############################
580
581mv /etc/freeswitch /etc/freeswitch.ORIGINAL
582ln -s /imported01/fsroot/etc/freeswitch /etc/
583
584mv /var/lib/freeswitch /var/lib/freeswitch.ORIGINAL
585ln -s /imported01/fsroot/var/lib/freeswitch /var/lib/
586
587
588
589####################################
590# SET INTERNAL PROFILE SO REGISTRATION AND CALLS FROM KAMAILIO DON'T GET 401
591
592vi /etc/freeswitch/sip_profiles/internal.xml
593#add following 3 lines to section "<settings>"
594<param name="accept-blind-reg" value="true"/>
595<param name="accept-blind-auth" value="true"/>
596<param name="inbound-bypass-media" value="true"/>
597
598# add external (public) kamailio sip.mydomain.com ip address as domain
599vi /etc/freeswitch/vars.xml
600 <X-PRE-PROCESS cmd="set" data="domain=52.28.144.113"/>
601
602reboot
603
604############################
605
606cp /etc/rc.local /etc/rc.local.ORIGINAL
607vi /etc/rc.local
608----------------------------------------
609#!/bin/sh -e
610#
611# rc.local
612#
613# This script is executed at the end of each multiuser runlevel.
614# Make sure that the script will "exit 0" on success or any other
615# value on error.
616#
617# In order to enable or disable this script just change the execution
618# bits.
619#
620# By default this script does nothing.
621
622sleep 10
623
624/imported01/fsroot/bin/startstuff.sh
625
626exit 0
627
628----------------------------------------
629
630############################
631vi /imported01/fsroot/bin/startstuff.sh
632----------------------------------------
633#!/bin/bash
634#
635
636sleep 10
637
638# be sure we mounted glusterfs
639/bin/mount -a
640
641sleep 3
642
643# insert my private address in dispatcher list
644MY_INTERNAL_IP_ADDRESS=`/usr/bin/curl -s http://169.254.169.254/latest/meta-data/local-ipv4`
645
646/bin/echo "1 sip:$MY_INTERNAL_IP_ADDRESS:5060 2" > /imported01/kamailio/etc/kamailio/dispatcher.list
647
648sleep 3
649
650/bin/mount -t tmpfs -o size=50m tmpfs /var/lib/freeswitch/db
651
652sleep 3
653
654/etc/init.d/freeswitch restart
655
656exit 0
657
658----------------------------------------
659############################
660
661
662#####################################################################
663#####################################################################
664#####################################################################
665##
666## KAMAILIO + RTPPROXY + GLUSTER client BOXES
667##
668#####################################################################
669#####################################################################
670#####################################################################
671
672
673apt-get clean && apt-get update
674
675apt-get install locales
676
677# choose en_US.UTF-8 UTF-8
678dpkg-reconfigure locales
679
680# your xterm locale will mess the server's locale. Prevent it from doing evil
681# commenting out AcceptEnv
682
683vi /etc/ssh/sshd_config
684# Allow client to pass locale environment variables
685# AcceptEnv LANG LC_*
686
687reboot
688
689
690apt-get clean && apt-get update && apt-get -y upgrade && apt-get -y dist-upgrade
691
692reboot
693
694#####################################################################
695
696# give it an EIP address, in this case 52.28.144.113, will be sip.mydomain.com
697
698vi /etc/hosts
699------------------------------------------------------
700127.0.0.1 localhost
701::1 localhost ip6-localhost ip6-loopback
702ff02::1 ip6-allnodes
703ff02::2 ip6-allrouters
704172.31.2.187 gd01
705172.31.2.238 gd02
70652.28.144.113 sip.mydomain.com
707------------------------------------------------------
708
709echo "deb http://deb.kamailio.org/kamailio jessie main" >> /etc/apt/sources.list
710echo "deb-src http://deb.kamailio.org/kamailio jessie main" >> /etc/apt/sources.list
711
712wget http://deb.kamailio.org/kamailiodebkey.gpg
713apt-key add kamailiodebkey.gpg
714
715apt-get update
716apt-get install kamailio kamailio-postgres-modules kamailio-nth build-essential
717
718cd /usr/src
719wget http://b2bua.org/chrome/site/rtpproxy-1.2.1.tar.gz
720tar xzf rtpproxy-1.2.1.tar.gz
721cd rtpproxy-1.2.1
722patch -p1 < rtpproxy-1.2.1_advertise.patch
723./configure
724make
725make install
726
727############################
728
729apt-get install glusterfs-client
730
731mkdir /imported01
732
733vi /etc/fstab
734---------------------------
735gd01:/volume01 /imported01 glusterfs defaults,_netdev,backupvolfile-server=gd02 0 0
736---------------------------
737
738mount /imported01
739
740ls -l /imported01/
741
742############################
743
744# copy and edit /etc/kamailio/kamailio.cfg, only addresses in first two lines
745
746# copy and edit /etc/kamailio/dispatcher.list
747
748## edit /etc/default/kamailio
749# change RUN_KAMAILIO to yes
750
751
752cp /etc/kamailio/dispatcher.list /imported01/kamailio/etc/kamailio/
753mv /etc/kamailio/dispatcher.list /etc/kamailio/dispatcher.list.ORIGINAL
754ln -s /imported01/kamailio/etc/kamailio/dispatcher.list /etc/kamailio/
755
756cp /etc/kamailio/kamailio.cfg /imported01/kamailio/etc/kamailio/
757mv /etc/kamailio/kamailio.cfg /etc/kamailio/kamailio.cfg.ORIGINAL
758ln -s /imported01/kamailio/etc/kamailio/kamailio.cfg /etc/kamailio/
759
760vi /etc/kamailio/kamailio-local.cfg
761
762service kamailio restart
763
764##########################################################################
765
766vi /etc/rc.local
767----------------------------------------------------------------------
768#!/bin/sh -e
769#
770# rc.local
771#
772# This script is executed at the end of each multiuser runlevel.
773# Make sure that the script will "exit 0" on success or any other
774# value on error.
775#
776# In order to enable or disable this script just change the execution
777# bits.
778#
779# By default this script does nothing.
780
781sleep 10
782
783/imported01/kamailio/bin/startstuff.sh
784
785exit 0
786----------------------------------------------------------------------
787
788vi /imported01/kamailio/bin/startstuff.sh
789----------------------------------------------------------------------
790#!/bin/bash
791#
792
793sleep 10
794
795# be sure we mounted glusterfs
796/bin/mount -a
797
798sleep 3
799
800# START RTPPROXY listening to the INTERNAL IP address
801MY_INTERNAL_IP_ADDRESS=`/usr/bin/curl -s http://169.254.169.254/latest/meta-data/local-ipv4`
802
803/usr/local/bin/rtpproxy -F -l 0.0.0.0 -A "$MY_INTERNAL_IP_ADDRESS" -s udp:localhost:7722
804
805sleep 3
806
807# START KAMAILIO
808/bin/echo "#!subst \"/MY_PRIVATE_IP_ADDRESS/$MY_INTERNAL_IP_ADDRESS/\"" > /etc/kamailio/kamailio-local.cfg
809/etc/init.d/kamailio restart
810
811exit 0
812----------------------------------------------------------------------
813
814############################
815
816
817#####################################################################
818
819vi /etc/kamailio/kamailio.cfg
820----------------------------------------------------------------------
821#!KAMAILIO
822
823#!subst "/MY_PUBLIC_IP_ADDRESS/52.28.144.113/"
824
825#!define WITH_FREESWITCH_HA
826#!define WITH_FREESWITCH_HA_CONFERENCES
827#!define WITH_NAT
828#!define WITH_DISPATCH
829#!define WITH_ANTIFLOOD
830#!define WITH_BLOCK3XX
831#!define NOT_WITH_ACC
832
833#
834# Kamailio (OpenSER) SIP Server v4.0 - configuration script
835# - web: http://www.kamailio.org
836# - git: http://sip-router.org
837#
838# Direct your questions about this file to: <sr-users@lists.sip-router.org>
839#
840# Refer to the Core CookBook at http://www.kamailio.org/dokuwiki/doku.php
841# for an explanation of possible statements, functions and parameters.
842#
843# Several features can be enabled using '#!define WITH_FEATURE' directives:
844#
845# *** To run in debug mode:
846# - define WITH_DEBUG
847#
848# *** To enable nat traversal execute:
849# - define WITH_NAT
850# - install RTPProxy: http://www.rtpproxy.org
851# - start RTPProxy:
852# (if no nat on rtpproxy host, eg here) rtpproxy -l publicip -s udp:localhost:7722
853# (if nat on here) rtpproxy -F -l localip -A publicip -s udp:localhost:7722
854# eg on Amazon EC2: rtpproxy -F -l 0.0.0.0 -A MY_PUBLIC_IP_ADDRESS -s udp:localhost:7722
855#
856# *** To enable anti-flood detection execute:
857# - adjust pike and htable=>ipban settings as needed (default is
858# block if more than 200 requests in 2 seconds and ban for 300 seconds)
859# - define WITH_ANTIFLOOD
860#
861# *** To block 3XX redirect replies execute:
862# - define WITH_BLOCK3XX
863#
864# *** To do call logging and accounting (printed via syslog)
865# - define WITH_ACC
866
867####### Include Local Config If Exists #########
868import_file "kamailio-local.cfg"
869
870####### Defined Values #########
871
872# *** Value defines - IDs used later in config
873# - flags
874# FLT_ - per transaction (message) flags
875# FLB_ - per branch flags
876#!define FLT_ACC 1
877#!define FLT_ACCMISSED 2
878#!define FLT_ACCFAILED 3
879#!define FLT_NATS 5
880#!define FLT_SAMENAT 30
881
882#!define FLB_NATB 6
883#!define FLB_NATSIPPING 7
884
885####### Global Parameters #########
886
887### LOG Levels: 3=DBG, 2=INFO, 1=NOTICE, 0=WARN, -1=ERR
888#!ifdef WITH_DEBUG
889debug=4
890log_stderror=yes
891#!else
892debug=2
893log_stderror=no
894#!endif
895
896memdbg=5
897memlog=5
898
899log_facility=LOG_LOCAL0
900
901fork=yes
902children=4
903
904/* uncomment the next line to disable TCP (default on) */
905#disable_tcp=yes
906
907/* uncomment the next line to disable the auto discovery of local aliases
908 based on reverse DNS on IPs (default on) */
909auto_aliases=no
910
911/* add local domain aliases */
912#alias = "sip.domain.com"
913
914/* uncomment and configure the following line if you want Kamailio to
915 bind on a specific interface/port/proto (default bind on all available) */
916listen=udp:"MY_PRIVATE_IP_ADDRESS":5060 advertise "MY_PUBLIC_IP_ADDRESS":5060
917listen=tcp:"MY_PRIVATE_IP_ADDRESS":5060 advertise "MY_PUBLIC_IP_ADDRESS":5060
918
919/* port to listen to
920 * - can be specified more than once if needed to listen on many ports */
921port=5060
922
923#!ifdef WITH_TLS
924enable_tls=yes
925#!endif
926
927# life time of TCP connection when there is no traffic
928# - a bit higher than registration expires to cope with UA behind NAT
929tcp_connection_lifetime=3605
930
931####### Modules Section ########
932
933# set paths to location of modules (to sources or installation folders)
934#!ifdef WITH_SRCPATH
935mpath="modules_k:modules"
936#!else
937#mpath="/usr/local/lib/kamailio/modules_k/:/usr/lib64/kamailio/modules/"
938mpath="/usr/lib/x86_64-linux-gnu/kamailio/modules/"
939#!endif
940
941loadmodule "mi_fifo.so"
942loadmodule "kex.so"
943loadmodule "corex.so"
944loadmodule "tm.so"
945loadmodule "tmx.so"
946loadmodule "sl.so"
947loadmodule "rr.so"
948loadmodule "pv.so"
949loadmodule "maxfwd.so"
950loadmodule "usrloc.so"
951loadmodule "registrar.so"
952loadmodule "textops.so"
953loadmodule "siputils.so"
954loadmodule "xlog.so"
955loadmodule "sanity.so"
956loadmodule "ctl.so"
957loadmodule "cfg_rpc.so"
958loadmodule "mi_rpc.so"
959
960#!ifdef WITH_ACC
961loadmodule "acc.so"
962#!endif
963
964#!ifdef WITH_NAT
965loadmodule "nathelper.so"
966loadmodule "rtpproxy.so"
967#!endif
968
969#!ifdef WITH_TLS
970loadmodule "tls.so"
971#!endif
972
973#!ifdef WITH_ANTIFLOOD
974loadmodule "htable.so"
975loadmodule "pike.so"
976#!endif
977
978#!ifdef WITH_DEBUG
979loadmodule "debugger.so"
980#!endif
981
982#!ifdef WITH_FREESWITCH_HA
983loadmodule "avpops.so"
984#!endif
985
986#!ifdef WITH_DISPATCH
987loadmodule "dispatcher.so"
988#!endif
989
990# ----------------- setting module-specific parameters ---------------
991
992
993# ----- ctl params -----
994modparam("ctl", "binrpc", "unix:/var/run/kamailio/kamailio_ctl")
995
996# ----- mi_fifo params -----
997modparam("mi_fifo", "fifo_name", "/tmp/kamailio_fifo")
998
999
1000# ----- tm params -----
1001# auto-discard branches from previous serial forking leg
1002modparam("tm", "failure_reply_mode", 3)
1003# default retransmission timeout: 30sec
1004modparam("tm", "fr_timer", 30000)
1005# default invite retransmission timeout after 1xx: 120sec
1006modparam("tm", "fr_inv_timer", 120000)
1007
1008
1009# ----- rr params -----
1010# add value to ;lr param to cope with most of the UAs
1011modparam("rr", "enable_full_lr", 1)
1012
1013#!ifdef WITH_ACC
1014# ----- acc params -----
1015/* what special events should be accounted ? */
1016modparam("acc", "early_media", 0)
1017modparam("acc", "report_ack", 0)
1018modparam("acc", "report_cancels", 0)
1019/* by default ww do not adjust the direct of the sequential requests.
1020 if you enable this parameter, be sure the enable "append_fromtag"
1021 in "rr" module */
1022modparam("acc", "detect_direction", 0)
1023/* account triggers (flags) */
1024modparam("acc", "log_flag", FLT_ACC)
1025modparam("acc", "log_missed_flag", FLT_ACCMISSED)
1026modparam("acc", "log_extra",
1027 "src_user=$fU;src_domain=$fd;src_ip=$si;"
1028 "dst_ouser=$tU;dst_user=$rU;dst_domain=$rd")
1029modparam("acc", "failed_transaction_flag", FLT_ACCFAILED)
1030#!endif
1031
1032
1033#!ifdef WITH_NAT
1034# ----- rtpproxy params -----
1035modparam("rtpproxy", "rtpproxy_sock", "udp:127.0.0.1:7722")
1036
1037# ----- nathelper params -----
1038modparam("nathelper", "natping_interval", 30)
1039modparam("nathelper", "ping_nated_only", 1)
1040modparam("nathelper", "sipping_bflag", FLB_NATSIPPING)
1041modparam("nathelper", "sipping_from", "sip:pinger@kamailio.org")
1042
1043# params needed for NAT traversal in other modules
1044modparam("nathelper|registrar", "received_avp", "$avp(RECEIVED)")
1045modparam("usrloc", "nat_bflag", FLB_NATB)
1046#!endif
1047
1048
1049#!ifdef WITH_TLS
1050# ----- tls params -----
1051modparam("tls", "config", "/etc/kamailio/tls.cfg")
1052#!endif
1053
1054#!ifdef WITH_ANTIFLOOD
1055# ----- pike params -----
1056modparam("pike", "sampling_time_unit", 2)
1057modparam("pike", "reqs_density_per_unit", 200)
1058modparam("pike", "remove_latency", 4)
1059
1060# ----- htable params -----
1061# ip ban htable with autoexpire after 5 minutes
1062modparam("htable", "htable", "ipban=>size=8;autoexpire=300;")
1063#!endif
1064
1065#!ifdef WITH_DEBUG
1066# ----- debugger params -----
1067modparam("debugger", "cfgtrace", 1)
1068#!endif
1069
1070#!ifdef WITH_DISPATCH
1071modparam("dispatcher", "list_file", "/etc/kamailio/dispatcher.list")
1072modparam("dispatcher", "flags", 2)
1073modparam("dispatcher", "dst_avp", "$avp(AVP_DST)")
1074modparam("dispatcher", "grp_avp", "$avp(AVP_GRP)")
1075modparam("dispatcher", "cnt_avp", "$avp(AVP_CNT)")
1076modparam("dispatcher", "ds_ping_interval", 30)
1077modparam("dispatcher", "ds_probing_mode", 1)
1078modparam("dispatcher", "hash_pvar", "hash the $fU@$ci")
1079#!ifdef WITH_FREESWITCH_HA_CONFERENCES
1080modparam("dispatcher", "use_default", 1)
1081#!endif
1082#!endif
1083
1084####### Routing Logic ########
1085
1086
1087# Main SIP request routing logic
1088# - processing of any incoming SIP request starts with this route
1089# - note: this is the same as route { ... }
1090request_route {
1091
1092 # per request initial checks
1093 route(REQINIT);
1094
1095 # NAT detection
1096 route(NATDETECT);
1097
1098 # CANCEL processing
1099 if (is_method("CANCEL"))
1100 {
1101 if (t_check_trans()) {
1102 route(RELAY);
1103 }
1104 exit;
1105 }
1106
1107 # handle requests within SIP dialogs
1108 route(WITHINDLG);
1109
1110 t_check_trans();
1111
1112 # record routing for dialog forming requests (in case they are routed)
1113 # - remove preloaded route headers
1114 remove_hf("Route");
1115 if (is_method("INVITE|SUBSCRIBE"))
1116 record_route();
1117
1118 # account only INVITEs
1119 if (is_method("INVITE"))
1120 {
1121 setflag(FLT_ACC); # do accounting
1122 }
1123
1124 # user location service
1125 route(LOCATION);
1126
1127}
1128
1129
1130route[RELAY] {
1131
1132 # enable additional event routes for forwarded requests
1133 # - serial forking, RTP relaying handling, a.s.o.
1134 if (is_method("INVITE|BYE|SUBSCRIBE|UPDATE")) {
1135 if(!t_is_set("branch_route")) t_on_branch("MANAGE_BRANCH");
1136 }
1137 if (is_method("INVITE|SUBSCRIBE|UPDATE")) {
1138 if(!t_is_set("onreply_route")) t_on_reply("MANAGE_REPLY");
1139 }
1140 if (is_method("INVITE")) {
1141 if(!t_is_set("failure_route")) t_on_failure("MANAGE_FAILURE");
1142 }
1143
1144 if (!t_relay()) {
1145 sl_reply_error();
1146 }
1147 exit;
1148}
1149
1150# Per SIP request initial checks
1151route[REQINIT] {
1152#!ifdef WITH_ANTIFLOOD
1153 # flood dection from same IP and traffic ban for a while
1154 # be sure you exclude checking trusted peers, such as pstn gateways
1155 # - local host excluded (e.g., loop to self)
1156 if(src_ip!=myself)
1157 {
1158 if($sht(ipban=>$si)!=$null)
1159 {
1160 # ip is already blocked
1161 xdbg("request from blocked IP - $rm from $fu (IP:$si:$sp)\n");
1162 exit;
1163 }
1164 if (!pike_check_req())
1165 {
1166 xlog("L_ALERT","ALERT: pike blocking $rm from $fu (IP:$si:$sp)\n");
1167 $sht(ipban=>$si) = 1;
1168 exit;
1169 }
1170 }
1171#!endif
1172
1173 if (!mf_process_maxfwd_header("10")) {
1174 sl_send_reply("483","Too Many Hops");
1175 exit;
1176 }
1177
1178 if(!sanity_check("1511", "7"))
1179 {
1180 xlog("Malformed SIP message from $si:$sp\n");
1181 exit;
1182 }
1183}
1184
1185# Handle requests within SIP dialogs
1186route[WITHINDLG] {
1187 if (has_totag()) {
1188 # sequential request withing a dialog should
1189 # take the path determined by record-routing
1190 if (loose_route()) {
1191 route(DLGURI);
1192 if (is_method("BYE")) {
1193 setflag(FLT_ACC); # do accounting ...
1194 setflag(FLT_ACCFAILED); # ... even if the transaction fails
1195 }
1196 else if ( is_method("ACK") ) {
1197 # ACK is forwarded statelessy
1198 route(NATMANAGE);
1199 }
1200 else if ( is_method("NOTIFY") ) {
1201 # Add Record-Route for in-dialog NOTIFY as per RFC 6665.
1202 record_route();
1203 }
1204 route(RELAY);
1205 } else {
1206 if ( is_method("ACK") ) {
1207 if ( t_check_trans() ) {
1208 # no loose-route, but stateful ACK;
1209 # must be an ACK after a 487
1210 # or e.g. 404 from upstream server
1211 route(RELAY);
1212 exit;
1213 } else {
1214 # ACK without matching transaction ... ignore and discard
1215 exit;
1216 }
1217 }
1218 sl_send_reply("404","Not here");
1219 }
1220 exit;
1221 }
1222}
1223
1224# USER location service
1225route[LOCATION] {
1226
1227#!ifdef WITH_FREESWITCH_HA
1228 if(!route(FROM_FREESWITCH_HA)) {
1229 route(TO_FREESWITCH_HA);
1230 exit;
1231 }
1232#!endif
1233
1234 if (!lookup("location")) {
1235 $var(rc) = $rc;
1236 t_newtran();
1237 switch ($var(rc)) {
1238 case -1:
1239 case -3:
1240 send_reply("404", "Not Found");
1241 exit;
1242 case -2:
1243 send_reply("405", "Method Not Allowed");
1244 exit;
1245 }
1246 }
1247
1248
1249 # when routing via usrloc, log the missed calls also
1250 if (is_method("INVITE"))
1251 {
1252 setflag(FLT_ACCMISSED);
1253 }
1254 route(RELAY);
1255 exit;
1256}
1257
1258# Caller NAT detection route
1259route[NATDETECT] {
1260#!ifdef WITH_NAT
1261 force_rport();
1262 if (nat_uac_test("19")) {
1263 if (is_method("REGISTER")) {
1264 fix_nated_register();
1265 } else {
1266 add_contact_alias();
1267 }
1268 setflag(FLT_NATS);
1269 }
1270#!endif
1271 return;
1272}
1273
1274# RTPProxy control
1275route[NATMANAGE] {
1276#!ifdef WITH_NAT
1277 if (is_request()) {
1278 if(has_totag()) {
1279 if(check_route_param("nat=yes")) {
1280 setbflag(FLB_NATB);
1281 }
1282 }
1283 }
1284 if (!(isflagset(FLT_NATS) || isbflagset(FLB_NATB)))
1285 return;
1286
1287
1288
1289#!ifdef WITH_FREESWITCH_HA
1290 $avp(SAMENAT) = 0 ;
1291 if(reg_fetch_contacts("location", "$tu", "callee"))
1292 {
1293 $var(i) = 0;
1294 while($var(i) < $(ulc(callee=>count)))
1295 {
1296 $avp(YOURNAT)=$(ulc(callee=>received)[$var(i)]);
1297
1298 avp_subst("$avp(YOURNAT)", "/(.*):(.*)/\1/");
1299
1300 if(reg_fetch_contacts("location", "$fu", "caller"))
1301 {
1302 $var(n) = 0;
1303 while($var(n) < $(ulc(caller=>count)))
1304 {
1305 $avp(MYNAT)=$(ulc(caller=>received)[$var(n)]);
1306
1307 avp_subst("$avp(MYNAT)", "/(.*):(.*)/\1/");
1308
1309 if( avp_check("$avp(MYNAT)","eq/$avp(YOURNAT)/i") ){
1310 $avp(SAMENAT) = 1 ;
1311 # xlog("TRUE |$avp(MYNAT)| |$avp(YOURNAT)|\n");
1312 } else {
1313 $avp(SAMENAT) = 0 ;
1314 # xlog("FALSE |$avp(MYNAT)| |$avp(YOURNAT)|\n");
1315 break;
1316 }
1317 $var(n) = $var(n) + 1;
1318 }
1319 if( $avp(SAMENAT) == 0 ) {
1320 break;
1321 }
1322 }
1323
1324 $var(i) = $var(i) + 1;
1325 }
1326 }
1327
1328 if( $avp(SAMENAT) == 0 ){
1329 # xlog("YES PROXY \n");
1330 rtpproxy_manage ("crw", "MY_PUBLIC_IP_ADDRESS");
1331 } # else {
1332 # xlog("NOT PROXY \n");
1333 #}
1334#!endif
1335
1336 if (is_request()) {
1337 if (!has_totag()) {
1338 if(t_is_branch_route()) {
1339 add_rr_param(";nat=yes");
1340 }
1341 }
1342 }
1343 if (is_reply()) {
1344 if(isbflagset(FLB_NATB)) {
1345 add_contact_alias();
1346 }
1347 }
1348#!endif
1349 return;
1350}
1351
1352# URI update for dialog requests
1353route[DLGURI] {
1354#!ifdef WITH_NAT
1355 if(!isdsturiset()) {
1356 handle_ruri_alias();
1357 }
1358#!endif
1359 return;
1360}
1361
1362# manage outgoing branches
1363branch_route[MANAGE_BRANCH] {
1364 xdbg("new branch [$T_branch_idx] to $ru\n");
1365 route(NATMANAGE);
1366}
1367
1368# manage incoming replies
1369onreply_route[MANAGE_REPLY] {
1370 xdbg("incoming reply\n");
1371 if(status=~"[12][0-9][0-9]")
1372 route(NATMANAGE);
1373}
1374
1375# manage failure routing cases
1376failure_route[MANAGE_FAILURE] {
1377 route(NATMANAGE);
1378
1379 if (t_is_canceled()) {
1380 exit;
1381 }
1382
1383#!ifdef WITH_BLOCK3XX
1384 # block call redirect based on 3xx replies.
1385 if (t_check_status("3[0-9][0-9]")) {
1386 t_reply("404","Not found");
1387 exit;
1388 }
1389#!endif
1390
1391}
1392
1393#!ifdef WITH_FREESWITCH_HA
1394# Test if coming from FreeSWITCH
1395route[FROM_FREESWITCH_HA] {
1396 if(ds_is_from_list()) {
1397 return 1;
1398 }
1399 return -1;
1400}
1401
1402# Send to FreeSWITCH
1403route[TO_FREESWITCH_HA] {
1404 route(DISPATCH);
1405 route(RELAY);
1406 exit;
1407}
1408
1409#!endif
1410
1411#!ifdef WITH_DISPATCH
1412# Dispatch requests
1413route[DISPATCH] {
1414#!ifdef WITH_FREESWITCH_HA_CONFERENCES
1415# CONFERENCES:
1416# hash on callid (0) dispatching on FreeSWITCH boxes in group "2"
1417# last box will be used only if previous boxes are all down
1418# eg: failover
1419# so, let's have only two machines in this group "2"
1420# first one will get all the conferences traffic, second one is failover
1421# you can put one of the active machines of group "1" as last in this ("2") group
1422 if($rU=~"^3[0-9][0-9][0-9]$")
1423 {
1424 if(!ds_select_dst("2", "0"))
1425 {
1426 send_reply("403", "No destination");
1427 exit;
1428 }
1429 t_on_failure("RTF_DISPATCH");
1430 return;
1431 }
1432# EVERYTHING ELSE (eg: NOT CONFERENCES):
1433#!endif
1434
1435# hash on callid (0) dispatching on FreeSWITCH boxes in group "1"
1436# if WITH_FREESWITCH_HA_CONFERENCES is active then
1437# last box will be used only if previous boxes are all down
1438# you can have the first machine of group "2" as last in this group
1439 if(!ds_select_dst("1", "0"))
1440 {
1441 send_reply("403", "No destination");
1442 exit;
1443 }
1444 t_on_failure("RTF_DISPATCH");
1445 return;
1446}
1447
1448# Sample failure route
1449failure_route[RTF_DISPATCH] {
1450 if (t_is_canceled()) {
1451 exit;
1452 }
1453 # next DST - only for 500 or local timeout
1454 if (t_check_status("500")
1455 or (t_branch_timeout() and !t_branch_replied()))
1456 {
1457 if(ds_next_dst())
1458 {
1459 t_on_failure("RTF_DISPATCH");
1460 route(RELAY);
1461 exit;
1462 }
1463 }
1464}
1465#!endif
1466----------------------------------------------------------------------
1467
1468#####################################################################
1469
1470# http://blog.unicsolution.com/2015/01/kamailio-high-availability-with.html
1471
1472# https://blog.logentries.com/2014/12/keepalived-and-haproxy-in-aws-an-exploratory-guide/
1473
1474#####################################################################
1475
1476apt-get install sipsak
1477apt-get install keepalived
1478
1479vi /etc/keepalived/keepalived.conf
1480----------------------------------------------------------------------
1481vrrp_script check_sip {
1482 script "/etc/keepalived/checksip.sh"
1483 interval 5 # check every 5 seconds
1484 fall 2 # require 2 failures for KO
1485 rise 4 # require 4 successes for OK
1486}
1487
1488vrrp_instance KR_1 {
1489 state BACKUP
1490 interface eth0
1491 virtual_router_id 51
1492 unicast_src_ip 172.31.14.159 # My PRIVATE IP
1493 unicast_peer {
1494 172.31.2.48 # peer PRIVATE IP
1495 }
1496 nopreempt
1497 advert_int 1
1498 track_script {
1499 check_sip
1500 }
1501 notify_master "/etc/keepalived/master-backup.sh MASTER"
1502 notify_backup "/etc/keepalived/master-backup.sh BACKUP"
1503 notify_fault "/etc/keepalived/master-backup.sh FAULT"
1504}
1505
1506----------------------------------------------------------------------
1507
1508vi /etc/keepalived/checksip.sh
1509----------------------------------------------------------------------
1510#!/bin/bash
1511
1512# check on MY INTERNAL IP
1513
1514if ls /etc/keepalived/MASTER; then
1515 timeout 1 sipsak -s sip:s@172.31.14.159:5060
1516 exit
1517else
1518 exit 0
1519fi
1520
1521----------------------------------------------------------------------
1522
1523chmod +x /etc/keepalived/checksip.sh
1524
1525vi /etc/keepalived/master-backup.sh
1526----------------------------------------------------------------------
1527#!/bin/bash
1528
1529# EIP is the PUBLIC IP ADDRESS that will move
1530
1531EIP=52.28.144.113
1532INSTANCE_ID=`/usr/bin/curl -s http://169.254.169.254/latest/meta-data/instance-id`
1533
1534STATE=$1
1535NOW=$(date +"%D %T")
1536KEEPALIVED="/etc/keepalived"
1537
1538case $STATE in
1539 "MASTER") touch $KEEPALIVED/MASTER
1540 echo "$NOW Becoming MASTER" >> $KEEPALIVED/COUNTER
1541 aws ec2 disassociate-address --public-ip $EIP
1542 aws ec2 associate-address --public-ip $EIP --instance-id $INSTANCE_ID
1543 #/etc/init.d/kamailio start
1544 exit 0
1545 ;;
1546 "BACKUP") rm $KEEPALIVED/MASTER
1547 echo "$NOW Becoming BACKUP" >> $KEEPALIVED/COUNTER
1548 #/etc/init.d/kamailio stop || killall -9 kamailio
1549 exit 0
1550 ;;
1551 "FAULT") rm $KEEPALIVED/MASTER
1552 echo "$NOW Becoming FAULT" >> $KEEPALIVED/COUNTER
1553 #/etc/init.d/kamailio stop || killall -9 kamailio
1554 exit 0
1555 ;;
1556 *) echo "unknown state"
1557 echo "$NOW Becoming UNKOWN" >> $KEEPALIVED/COUNTER
1558 exit 1
1559 ;;
1560esac
1561
1562
1563----------------------------------------------------------------------
1564
1565chmod +x /etc/keepalived/master-backup.sh
1566
1567service keepalived restart
1568service keepalived status
1569
1570#####################################################################
1571
1572reboot
1573
1574#####################################################################