Add Docker containerization, VPN STUN/ICE support, and DNS whitelist tools
- Dockerfile: Containerized Asterisk PBX with Ubuntu 24.04 base, all dependencies pre-installed, health checks, and volume persistence - docker-compose.yml: Asterisk service with host networking (required for RTP port range) + optional self-hosted coturn STUN server via --profile stun - docker/entrypoint.sh: Auto-generates configs, certs, and starts Asterisk in foreground with web admin in background - scripts/vpn-diagnostics.sh: Detects VPN interfaces, checks PJSIP transport config, tests STUN reachability, analyzes NAT type, and provides STUN/TURN recommendations for third-party VPNs - scripts/dns-whitelist.sh: Documents all domains needed per network mode (LAN/VPN vs FQDN), per component (server, Sipnetic, Linphone), with --check mode to test DNS resolution and reachability - easy-asterisk script: Added VPN STUN/ICE menu (option 12 in Server Settings) with self-hosted coturn, Google STUN, or custom STUN server options. LAN/VPN devices now get ice_support=yes when VPN ICE is enabled. Web admin Python code also respects VPN_ICE_ENABLED config. Self-hosted coturn in STUN-only mode eliminates all external DNS dependencies - everything operates by IP address, ideal for DNS-filtered environments. https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
This commit is contained in:
Claude
@@ -0,0 +1,5 @@
|
|||||||
|
.git
|
||||||
|
.gitignore
|
||||||
|
.env
|
||||||
|
*.md
|
||||||
|
LICENSE
|
||||||
@@ -0,0 +1,57 @@
|
|||||||
|
# ================================================================
|
||||||
|
# Easy Asterisk - Environment Configuration
|
||||||
|
#
|
||||||
|
# Copy this file to .env and modify as needed:
|
||||||
|
# cp .env.example .env
|
||||||
|
#
|
||||||
|
# Then start with:
|
||||||
|
# docker compose up -d # Asterisk only
|
||||||
|
# docker compose --profile stun up -d # Asterisk + STUN server
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
# ── Network Mode ─────────────────────────────────────────────
|
||||||
|
# Leave DOMAIN_NAME empty for LAN/VPN mode (recommended for VPN setups)
|
||||||
|
# Set to your FQDN for internet calling mode (requires TLS certs)
|
||||||
|
DOMAIN_NAME=
|
||||||
|
ENABLE_TLS=n
|
||||||
|
|
||||||
|
# Primary network CIDR (auto-detected if empty)
|
||||||
|
# Example: 192.168.1.0/24
|
||||||
|
LOCAL_CIDR=
|
||||||
|
|
||||||
|
# ── VPN / VLAN Subnets ──────────────────────────────────────
|
||||||
|
# Set HAS_VLANS=y and list your VPN/VLAN subnets (space-separated)
|
||||||
|
# This tells Asterisk to treat these as local networks
|
||||||
|
#
|
||||||
|
# Examples:
|
||||||
|
# WireGuard: 10.8.0.0/24
|
||||||
|
# OpenVPN: 10.10.0.0/24
|
||||||
|
# Tailscale: 100.64.0.0/10
|
||||||
|
# Third-party: Check your VPN client for the assigned subnet
|
||||||
|
HAS_VLANS=n
|
||||||
|
VLAN_SUBNETS=
|
||||||
|
|
||||||
|
# ── STUN Server ──────────────────────────────────────────────
|
||||||
|
# For self-hosted coturn (recommended for DNS-filtered networks):
|
||||||
|
# 1. Start with: docker compose --profile stun up -d
|
||||||
|
# 2. Set STUN_SERVER to your server's VPN IP:3478
|
||||||
|
# Example: STUN_SERVER=10.8.0.1:3478
|
||||||
|
#
|
||||||
|
# For Google STUN (requires DNS access to stun.l.google.com):
|
||||||
|
# STUN_SERVER=stun.l.google.com:19302
|
||||||
|
#
|
||||||
|
# Leave empty if VPN provides direct routing (no NAT between endpoints)
|
||||||
|
STUN_SERVER=
|
||||||
|
VPN_ICE_ENABLED=n
|
||||||
|
CUSTOM_STUN_SERVER=
|
||||||
|
|
||||||
|
# ── RTP Port Range ───────────────────────────────────────────
|
||||||
|
# Default: 10000-20000 (10,000 ports)
|
||||||
|
# For constrained environments, reduce to e.g. 10000-10100
|
||||||
|
RTP_START=10000
|
||||||
|
RTP_END=20000
|
||||||
|
|
||||||
|
# ── Web Admin ────────────────────────────────────────────────
|
||||||
|
WEB_ADMIN_PORT=8080
|
||||||
|
# Set to true if using a reverse proxy with its own auth
|
||||||
|
WEB_ADMIN_AUTH_DISABLED=false
|
||||||
+86
@@ -0,0 +1,86 @@
|
|||||||
|
# ================================================================
|
||||||
|
# Easy Asterisk - Docker Container
|
||||||
|
# Asterisk PBX with web admin and optional STUN support
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# docker compose up -d # Asterisk only
|
||||||
|
# docker compose --profile stun up -d # Asterisk + self-hosted STUN
|
||||||
|
# docker exec -it easy-asterisk easy-asterisk # Interactive management
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
FROM ubuntu:24.04
|
||||||
|
|
||||||
|
ENV DEBIAN_FRONTEND=noninteractive
|
||||||
|
ENV LANG=C.UTF-8
|
||||||
|
|
||||||
|
# Install Asterisk and dependencies (matches install_asterisk_packages)
|
||||||
|
RUN echo "exit 101" > /usr/sbin/policy-rc.d && chmod +x /usr/sbin/policy-rc.d && \
|
||||||
|
apt-get update && \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
asterisk \
|
||||||
|
asterisk-core-sounds-en-gsm \
|
||||||
|
asterisk-modules \
|
||||||
|
openssl \
|
||||||
|
curl \
|
||||||
|
tcpdump \
|
||||||
|
sngrep \
|
||||||
|
python3 \
|
||||||
|
iproute2 \
|
||||||
|
net-tools \
|
||||||
|
dnsutils \
|
||||||
|
iputils-ping \
|
||||||
|
procps \
|
||||||
|
&& rm -rf /var/lib/apt/lists/* \
|
||||||
|
&& rm -f /usr/sbin/policy-rc.d \
|
||||||
|
&& ldconfig \
|
||||||
|
&& update-ca-certificates 2>/dev/null || true
|
||||||
|
|
||||||
|
# Create required directories
|
||||||
|
RUN mkdir -p \
|
||||||
|
/etc/easy-asterisk \
|
||||||
|
/etc/asterisk/certs \
|
||||||
|
/var/lib/asterisk/static-http \
|
||||||
|
/var/log/asterisk \
|
||||||
|
/var/spool/asterisk \
|
||||||
|
/var/run/asterisk \
|
||||||
|
&& chown -R asterisk:asterisk \
|
||||||
|
/etc/asterisk \
|
||||||
|
/var/lib/asterisk \
|
||||||
|
/var/log/asterisk \
|
||||||
|
/var/spool/asterisk \
|
||||||
|
/var/run/asterisk
|
||||||
|
|
||||||
|
# Copy the main management script
|
||||||
|
COPY easy-asterisk-v0.10.0.sh /usr/local/bin/easy-asterisk
|
||||||
|
RUN chmod +x /usr/local/bin/easy-asterisk
|
||||||
|
|
||||||
|
# Copy diagnostic and utility scripts
|
||||||
|
COPY scripts/vpn-diagnostics.sh /usr/local/bin/vpn-diagnostics
|
||||||
|
COPY scripts/dns-whitelist.sh /usr/local/bin/dns-whitelist
|
||||||
|
RUN chmod +x /usr/local/bin/vpn-diagnostics /usr/local/bin/dns-whitelist
|
||||||
|
|
||||||
|
# Copy entrypoint
|
||||||
|
COPY docker/entrypoint.sh /entrypoint.sh
|
||||||
|
RUN chmod +x /entrypoint.sh
|
||||||
|
|
||||||
|
# SIP signaling
|
||||||
|
EXPOSE 5060/udp
|
||||||
|
EXPOSE 5060/tcp
|
||||||
|
EXPOSE 5061/tcp
|
||||||
|
|
||||||
|
# Web admin + provisioning
|
||||||
|
EXPOSE 8080/tcp
|
||||||
|
EXPOSE 8088/tcp
|
||||||
|
EXPOSE 8089/tcp
|
||||||
|
|
||||||
|
# RTP media range (use --network host in production for full range)
|
||||||
|
# Docker port-mapping 10000 ports is impractical; host networking recommended
|
||||||
|
EXPOSE 10000-10100/udp
|
||||||
|
|
||||||
|
# Persistent data
|
||||||
|
VOLUME ["/etc/asterisk", "/etc/easy-asterisk", "/var/log/asterisk"]
|
||||||
|
|
||||||
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
||||||
|
CMD asterisk -rx "core show version" >/dev/null 2>&1 || exit 1
|
||||||
|
|
||||||
|
ENTRYPOINT ["/entrypoint.sh"]
|
||||||
@@ -0,0 +1,110 @@
|
|||||||
|
# ================================================================
|
||||||
|
# Easy Asterisk - Docker Compose
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# docker compose up -d # Asterisk only
|
||||||
|
# docker compose --profile stun up -d # Asterisk + self-hosted STUN
|
||||||
|
# docker exec -it easy-asterisk easy-asterisk # Interactive management
|
||||||
|
# docker exec -it easy-asterisk vpn-diagnostics # VPN diagnostics
|
||||||
|
# docker exec -it easy-asterisk dns-whitelist # DNS whitelist check
|
||||||
|
#
|
||||||
|
# For third-party VPNs with DNS filtering:
|
||||||
|
# Use --profile stun to run a self-hosted STUN server
|
||||||
|
# This eliminates all external DNS dependencies
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
services:
|
||||||
|
|
||||||
|
# ── Asterisk PBX ───────────────────────────────────────────
|
||||||
|
asterisk:
|
||||||
|
build: .
|
||||||
|
container_name: easy-asterisk
|
||||||
|
# Host networking required for:
|
||||||
|
# - RTP media ports (10000-20000 UDP) - too many to map individually
|
||||||
|
# - VPN interface access (tun/tap/wg devices)
|
||||||
|
# - Proper NAT detection and SIP Contact headers
|
||||||
|
network_mode: host
|
||||||
|
volumes:
|
||||||
|
- asterisk-config:/etc/asterisk
|
||||||
|
- easy-asterisk-config:/etc/easy-asterisk
|
||||||
|
- asterisk-logs:/var/log/asterisk
|
||||||
|
- asterisk-spool:/var/spool/asterisk
|
||||||
|
- asterisk-lib:/var/lib/asterisk
|
||||||
|
environment:
|
||||||
|
# ── Network Mode ──
|
||||||
|
# Leave DOMAIN_NAME empty for LAN/VPN mode (recommended)
|
||||||
|
- DOMAIN_NAME=${DOMAIN_NAME:-}
|
||||||
|
- ENABLE_TLS=${ENABLE_TLS:-n}
|
||||||
|
- LOCAL_CIDR=${LOCAL_CIDR:-}
|
||||||
|
|
||||||
|
# ── VPN Configuration ──
|
||||||
|
# Add your VPN subnet(s) here, space-separated
|
||||||
|
# Example: 10.8.0.0/24 or 100.64.0.0/10 (Tailscale)
|
||||||
|
- HAS_VLANS=${HAS_VLANS:-n}
|
||||||
|
- VLAN_SUBNETS=${VLAN_SUBNETS:-}
|
||||||
|
|
||||||
|
# ── STUN Server ──
|
||||||
|
# For self-hosted coturn: use your server's VPN/LAN IP + port 3478
|
||||||
|
# Example: STUN_SERVER=10.8.0.1:3478
|
||||||
|
# Leave empty to disable STUN (fine if VPN provides direct routing)
|
||||||
|
- STUN_SERVER=${STUN_SERVER:-}
|
||||||
|
- VPN_ICE_ENABLED=${VPN_ICE_ENABLED:-n}
|
||||||
|
- CUSTOM_STUN_SERVER=${CUSTOM_STUN_SERVER:-}
|
||||||
|
|
||||||
|
# ── RTP Port Range ──
|
||||||
|
# Reduce range for constrained environments
|
||||||
|
- RTP_START=${RTP_START:-10000}
|
||||||
|
- RTP_END=${RTP_END:-20000}
|
||||||
|
|
||||||
|
# ── Web Admin ──
|
||||||
|
- WEB_ADMIN_PORT=${WEB_ADMIN_PORT:-8080}
|
||||||
|
- WEB_ADMIN_AUTH_DISABLED=${WEB_ADMIN_AUTH_DISABLED:-false}
|
||||||
|
restart: unless-stopped
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "asterisk", "-rx", "core show version"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 3
|
||||||
|
|
||||||
|
# ── Self-Hosted STUN Server (coturn) ───────────────────────
|
||||||
|
# Activate with: docker compose --profile stun up -d
|
||||||
|
#
|
||||||
|
# Why self-hosted STUN?
|
||||||
|
# - No external DNS dependencies (critical for DNS-filtered networks)
|
||||||
|
# - STUN reached by IP address, not hostname
|
||||||
|
# - Faster response than public STUN servers
|
||||||
|
# - Works entirely within your VPN network
|
||||||
|
#
|
||||||
|
# After starting, set STUN_SERVER to your server's IP:3478
|
||||||
|
# in the .env file and restart the asterisk container.
|
||||||
|
coturn:
|
||||||
|
image: coturn/coturn:latest
|
||||||
|
container_name: easy-asterisk-stun
|
||||||
|
network_mode: host
|
||||||
|
command: >
|
||||||
|
-n
|
||||||
|
--no-auth
|
||||||
|
--no-tls
|
||||||
|
--no-dtls
|
||||||
|
--stun-only
|
||||||
|
--listening-port=3478
|
||||||
|
--fingerprint
|
||||||
|
--no-cli
|
||||||
|
--no-multicast-peers
|
||||||
|
--no-loopback-peers
|
||||||
|
--log-file=stdout
|
||||||
|
restart: unless-stopped
|
||||||
|
profiles:
|
||||||
|
- stun
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "ss -uln | grep -q ':3478'"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 3
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
asterisk-config:
|
||||||
|
easy-asterisk-config:
|
||||||
|
asterisk-logs:
|
||||||
|
asterisk-spool:
|
||||||
|
asterisk-lib:
|
||||||
@@ -0,0 +1,209 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# ================================================================
|
||||||
|
# Easy Asterisk Docker Entrypoint
|
||||||
|
#
|
||||||
|
# Starts Asterisk + Web Admin, applies environment configuration
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Colors for output
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
log_info() { echo -e "${GREEN}[entrypoint]${NC} $1"; }
|
||||||
|
log_warn() { echo -e "${YELLOW}[entrypoint]${NC} $1"; }
|
||||||
|
|
||||||
|
# ── 1. Generate self-signed certs if missing ──────────────────
|
||||||
|
if [[ ! -f /etc/asterisk/certs/server.crt ]]; then
|
||||||
|
log_info "Generating self-signed TLS certificate..."
|
||||||
|
mkdir -p /etc/asterisk/certs
|
||||||
|
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
|
||||||
|
-keyout /etc/asterisk/certs/server.key \
|
||||||
|
-out /etc/asterisk/certs/server.crt \
|
||||||
|
-subj "/CN=asterisk-local" 2>/dev/null
|
||||||
|
chown asterisk:asterisk /etc/asterisk/certs/server.*
|
||||||
|
chmod 644 /etc/asterisk/certs/server.crt
|
||||||
|
chmod 600 /etc/asterisk/certs/server.key
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 2. Apply environment-based configuration ──────────────────
|
||||||
|
CONFIG_DIR="/etc/easy-asterisk"
|
||||||
|
CONFIG_FILE="${CONFIG_DIR}/config"
|
||||||
|
mkdir -p "$CONFIG_DIR"
|
||||||
|
|
||||||
|
# If no config exists, create from environment variables
|
||||||
|
if [[ ! -f "$CONFIG_FILE" ]]; then
|
||||||
|
log_info "Creating initial configuration from environment..."
|
||||||
|
cat > "$CONFIG_FILE" << EOF
|
||||||
|
# Easy Asterisk Configuration (Docker)
|
||||||
|
KIOSK_USER=""
|
||||||
|
KIOSK_UID=""
|
||||||
|
KIOSK_EXTENSION=""
|
||||||
|
KIOSK_NAME=""
|
||||||
|
SIP_PASSWORD=""
|
||||||
|
ASTERISK_HOST="${ASTERISK_HOST:-}"
|
||||||
|
DOMAIN_NAME="${DOMAIN_NAME:-}"
|
||||||
|
ENABLE_TLS="${ENABLE_TLS:-n}"
|
||||||
|
HAS_VLANS="${HAS_VLANS:-n}"
|
||||||
|
VLAN_SUBNETS="${VLAN_SUBNETS:-}"
|
||||||
|
CERT_PATH=""
|
||||||
|
KEY_PATH=""
|
||||||
|
INSTALLED_SERVER="y"
|
||||||
|
INSTALLED_CLIENT="n"
|
||||||
|
CURRENT_PUBLIC_IP=""
|
||||||
|
PTT_DEVICE=""
|
||||||
|
PTT_KEYCODE=""
|
||||||
|
LOCAL_CIDR="${LOCAL_CIDR:-}"
|
||||||
|
WEB_ADMIN_PORT="${WEB_ADMIN_PORT:-8080}"
|
||||||
|
WEB_ADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}"
|
||||||
|
VPN_ICE_ENABLED="${VPN_ICE_ENABLED:-n}"
|
||||||
|
CUSTOM_STUN_SERVER="${CUSTOM_STUN_SERVER:-}"
|
||||||
|
EOF
|
||||||
|
chmod 644 "$CONFIG_FILE"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 3. Configure STUN if self-hosted coturn is available ──────
|
||||||
|
if [[ -n "$STUN_SERVER" ]]; then
|
||||||
|
log_info "Using STUN server: ${STUN_SERVER}"
|
||||||
|
source "$CONFIG_FILE" 2>/dev/null || true
|
||||||
|
|
||||||
|
# Update rtp.conf with custom STUN
|
||||||
|
cat > /etc/asterisk/rtp.conf << EOF
|
||||||
|
[general]
|
||||||
|
rtpstart=${RTP_START:-10000}
|
||||||
|
rtpend=${RTP_END:-20000}
|
||||||
|
strictrtp=yes
|
||||||
|
icesupport=yes
|
||||||
|
stunaddr=${STUN_SERVER}
|
||||||
|
EOF
|
||||||
|
chown asterisk:asterisk /etc/asterisk/rtp.conf
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 4. Generate default Asterisk configs if missing ───────────
|
||||||
|
if [[ ! -f /etc/asterisk/pjsip.conf ]] || [[ ! -s /etc/asterisk/pjsip.conf ]]; then
|
||||||
|
log_info "Generating default PJSIP configuration..."
|
||||||
|
local_ip=$(hostname -I | awk '{print $1}')
|
||||||
|
raw_cidr=$(ip -o -f inet addr show | awk '/scope global/ {print $4}' | head -1)
|
||||||
|
default_cidr="$raw_cidr"
|
||||||
|
if [[ "$raw_cidr" =~ \.([0-9]+)/24$ ]]; then default_cidr="${raw_cidr%.*}.0/24"; fi
|
||||||
|
|
||||||
|
nat_settings=""
|
||||||
|
source "$CONFIG_FILE" 2>/dev/null || true
|
||||||
|
if [[ "$HAS_VLANS" == "y" && -n "$VLAN_SUBNETS" ]]; then
|
||||||
|
nat_settings="local_net=${default_cidr}"
|
||||||
|
for subnet in $VLAN_SUBNETS; do
|
||||||
|
nat_settings="${nat_settings}
|
||||||
|
local_net=${subnet}"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
cat > /etc/asterisk/pjsip.conf << EOF
|
||||||
|
; Easy Asterisk (Docker)
|
||||||
|
[global]
|
||||||
|
type=global
|
||||||
|
user_agent=EasyAsterisk
|
||||||
|
|
||||||
|
[transport-udp]
|
||||||
|
type=transport
|
||||||
|
protocol=udp
|
||||||
|
bind=0.0.0.0:5060
|
||||||
|
; Server IP: ${local_ip}
|
||||||
|
${nat_settings}
|
||||||
|
|
||||||
|
[transport-tcp]
|
||||||
|
type=transport
|
||||||
|
protocol=tcp
|
||||||
|
bind=0.0.0.0:5060
|
||||||
|
; Server IP: ${local_ip}
|
||||||
|
${nat_settings}
|
||||||
|
|
||||||
|
[transport-tls]
|
||||||
|
type=transport
|
||||||
|
protocol=tls
|
||||||
|
bind=0.0.0.0:5061
|
||||||
|
; Server IP: ${local_ip}
|
||||||
|
cert_file=/etc/asterisk/certs/server.crt
|
||||||
|
priv_key_file=/etc/asterisk/certs/server.key
|
||||||
|
ca_list_file=/etc/ssl/certs/ca-certificates.crt
|
||||||
|
method=tlsv1_2
|
||||||
|
${nat_settings}
|
||||||
|
|
||||||
|
EOF
|
||||||
|
chown asterisk:asterisk /etc/asterisk/pjsip.conf
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -f /etc/asterisk/extensions.conf ]] || [[ ! -s /etc/asterisk/extensions.conf ]]; then
|
||||||
|
log_info "Generating default dialplan..."
|
||||||
|
cat > /etc/asterisk/extensions.conf << EOF
|
||||||
|
[general]
|
||||||
|
static=yes
|
||||||
|
writeprotect=no
|
||||||
|
[default]
|
||||||
|
exten => _X.,1,Hangup()
|
||||||
|
[intercom]
|
||||||
|
EOF
|
||||||
|
chown asterisk:asterisk /etc/asterisk/extensions.conf
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -f /etc/asterisk/rtp.conf ]]; then
|
||||||
|
log_info "Generating default RTP configuration..."
|
||||||
|
cat > /etc/asterisk/rtp.conf << EOF
|
||||||
|
[general]
|
||||||
|
rtpstart=${RTP_START:-10000}
|
||||||
|
rtpend=${RTP_END:-20000}
|
||||||
|
strictrtp=yes
|
||||||
|
# icesupport disabled - LAN only mode
|
||||||
|
EOF
|
||||||
|
chown asterisk:asterisk /etc/asterisk/rtp.conf
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Generate other required configs
|
||||||
|
for conf in asterisk.conf logger.conf modules.conf; do
|
||||||
|
if [[ ! -f "/etc/asterisk/$conf" ]]; then
|
||||||
|
log_info "Generating /etc/asterisk/$conf..."
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ ! -f /etc/asterisk/asterisk.conf ]]; then
|
||||||
|
cat > /etc/asterisk/asterisk.conf << EOF
|
||||||
|
[directories]
|
||||||
|
[options]
|
||||||
|
runuser = asterisk
|
||||||
|
rungroup = asterisk
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -f /etc/asterisk/logger.conf ]]; then
|
||||||
|
cat > /etc/asterisk/logger.conf << EOF
|
||||||
|
[general]
|
||||||
|
[logfiles]
|
||||||
|
console => notice,warning,error
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 5. Fix permissions ───────────────────────────────────────
|
||||||
|
chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/log/asterisk /var/spool/asterisk /var/run/asterisk 2>/dev/null || true
|
||||||
|
|
||||||
|
# ── 6. Start Web Admin in background (if script exists) ──────
|
||||||
|
WEB_ADMIN_SCRIPT="/usr/local/bin/easy-asterisk-webadmin"
|
||||||
|
if [[ -f "$WEB_ADMIN_SCRIPT" ]]; then
|
||||||
|
source "$CONFIG_FILE" 2>/dev/null || true
|
||||||
|
log_info "Starting Web Admin on port ${WEB_ADMIN_PORT:-8080}..."
|
||||||
|
WEBADMIN_PORT="${WEB_ADMIN_PORT:-8080}" \
|
||||||
|
WEBADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}" \
|
||||||
|
python3 "$WEB_ADMIN_SCRIPT" &
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 7. Start Asterisk in foreground ──────────────────────────
|
||||||
|
log_info "Starting Asterisk PBX..."
|
||||||
|
echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
||||||
|
echo -e "${CYAN} Easy Asterisk (Docker)${NC}"
|
||||||
|
echo -e "${CYAN} Management: docker exec -it easy-asterisk easy-asterisk${NC}"
|
||||||
|
echo -e "${CYAN} Diagnostics: docker exec -it easy-asterisk vpn-diagnostics${NC}"
|
||||||
|
echo -e "${CYAN} DNS Check: docker exec -it easy-asterisk dns-whitelist${NC}"
|
||||||
|
echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
||||||
|
|
||||||
|
exec asterisk -f -U asterisk -G asterisk
|
||||||
+236
-3
@@ -20,6 +20,13 @@
|
|||||||
# - HTTP Basic authentication with SHA256 password hashing
|
# - HTTP Basic authentication with SHA256 password hashing
|
||||||
# - Access at http://server:8080/clients
|
# - Access at http://server:8080/clients
|
||||||
# - ADDED: VPN subnet auto-detection (Tailscale, WireGuard, OpenVPN)
|
# - ADDED: VPN subnet auto-detection (Tailscale, WireGuard, OpenVPN)
|
||||||
|
# - ADDED: VPN STUN/ICE configuration for third-party VPNs
|
||||||
|
# - Self-hosted coturn STUN (no external DNS dependencies)
|
||||||
|
# - Custom STUN server support
|
||||||
|
# - Per-device ICE for LAN/VPN mode endpoints
|
||||||
|
# - ADDED: Docker container support (Dockerfile + docker-compose)
|
||||||
|
# - ADDED: VPN diagnostics tool (vpn-diagnostics)
|
||||||
|
# - ADDED: DNS whitelist checker for filtered networks (dns-whitelist)
|
||||||
# - IMPROVED: Device deletion uses awk for reliable multi-section removal
|
# - IMPROVED: Device deletion uses awk for reliable multi-section removal
|
||||||
# - IMPROVED: Device renaming uses awk to handle all edge cases
|
# - IMPROVED: Device renaming uses awk to handle all edge cases
|
||||||
#
|
#
|
||||||
@@ -167,6 +174,8 @@ load_config() {
|
|||||||
VLAN_SUBNETS="${VLAN_SUBNETS:-}"
|
VLAN_SUBNETS="${VLAN_SUBNETS:-}"
|
||||||
WEB_ADMIN_PORT="${WEB_ADMIN_PORT:-8080}"
|
WEB_ADMIN_PORT="${WEB_ADMIN_PORT:-8080}"
|
||||||
WEB_ADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}"
|
WEB_ADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}"
|
||||||
|
VPN_ICE_ENABLED="${VPN_ICE_ENABLED:-n}"
|
||||||
|
CUSTOM_STUN_SERVER="${CUSTOM_STUN_SERVER:-}"
|
||||||
return 0
|
return 0
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -204,6 +213,8 @@ PTT_KEYCODE="$PTT_KEYCODE"
|
|||||||
LOCAL_CIDR="$LOCAL_CIDR"
|
LOCAL_CIDR="$LOCAL_CIDR"
|
||||||
WEB_ADMIN_PORT="$WEB_ADMIN_PORT"
|
WEB_ADMIN_PORT="$WEB_ADMIN_PORT"
|
||||||
WEB_ADMIN_AUTH_DISABLED="$WEB_ADMIN_AUTH_DISABLED"
|
WEB_ADMIN_AUTH_DISABLED="$WEB_ADMIN_AUTH_DISABLED"
|
||||||
|
VPN_ICE_ENABLED="$VPN_ICE_ENABLED"
|
||||||
|
CUSTOM_STUN_SERVER="$CUSTOM_STUN_SERVER"
|
||||||
EOF
|
EOF
|
||||||
chmod 644 "$CONFIG_FILE"
|
chmod 644 "$CONFIG_FILE"
|
||||||
|
|
||||||
@@ -635,6 +646,10 @@ add_device_menu() {
|
|||||||
display_port="5060"
|
display_port="5060"
|
||||||
display_transport="UDP"
|
display_transport="UDP"
|
||||||
display_encryption="None"
|
display_encryption="None"
|
||||||
|
# Enable ICE for VPN devices if VPN ICE mode is active
|
||||||
|
if [[ "$VPN_ICE_ENABLED" == "y" ]]; then
|
||||||
|
ice_block="ice_support=yes"
|
||||||
|
fi
|
||||||
elif [[ "$conn_choice" == "2" ]]; then
|
elif [[ "$conn_choice" == "2" ]]; then
|
||||||
if [[ "$ENABLE_TLS" != "y" || -z "$DOMAIN_NAME" ]]; then
|
if [[ "$ENABLE_TLS" != "y" || -z "$DOMAIN_NAME" ]]; then
|
||||||
print_error "FQDN access not configured. Run 'Setup Internet Access' first."
|
print_error "FQDN access not configured. Run 'Setup Internet Access' first."
|
||||||
@@ -2837,12 +2852,20 @@ transport=config,pjsip.conf,criteria=type=transport
|
|||||||
EOF
|
EOF
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# ICE and STUN only for FQDN/internet calling
|
# ICE and STUN configuration
|
||||||
|
# Enabled for: FQDN/internet mode OR VPN with ICE enabled
|
||||||
load_config
|
load_config
|
||||||
local ice_stun_config=""
|
local ice_stun_config=""
|
||||||
if [[ -n "$DOMAIN_NAME" ]]; then
|
if [[ -n "$DOMAIN_NAME" ]]; then
|
||||||
|
# FQDN mode: always enable ICE
|
||||||
|
local stun_addr="${CUSTOM_STUN_SERVER:-stun.l.google.com:19302}"
|
||||||
ice_stun_config="icesupport=yes
|
ice_stun_config="icesupport=yes
|
||||||
stunaddr=stun.l.google.com:19302"
|
stunaddr=${stun_addr}"
|
||||||
|
elif [[ "$VPN_ICE_ENABLED" == "y" ]]; then
|
||||||
|
# VPN mode with ICE: use custom or self-hosted STUN
|
||||||
|
local stun_addr="${CUSTOM_STUN_SERVER:-stun.l.google.com:19302}"
|
||||||
|
ice_stun_config="icesupport=yes
|
||||||
|
stunaddr=${stun_addr}"
|
||||||
else
|
else
|
||||||
ice_stun_config="# icesupport disabled - LAN only mode"
|
ice_stun_config="# icesupport disabled - LAN only mode"
|
||||||
fi
|
fi
|
||||||
@@ -4363,6 +4386,14 @@ def add_device(name, category, extension, conn_type='lan', auto_answer=None):
|
|||||||
password = generate_password()
|
password = generate_password()
|
||||||
|
|
||||||
# Determine transport and encryption
|
# Determine transport and encryption
|
||||||
|
# Check if VPN ICE mode is enabled (for third-party VPNs)
|
||||||
|
vpn_ice = 'n'
|
||||||
|
if os.path.exists(CONFIG_FILE):
|
||||||
|
with open(CONFIG_FILE, 'r') as cf:
|
||||||
|
for cline in cf:
|
||||||
|
if cline.startswith('VPN_ICE_ENABLED='):
|
||||||
|
vpn_ice = cline.strip().split('=', 1)[1].strip('"')
|
||||||
|
|
||||||
if conn_type == 'fqdn':
|
if conn_type == 'fqdn':
|
||||||
transport = 'transport=transport-tls'
|
transport = 'transport=transport-tls'
|
||||||
encryption = 'media_encryption=sdes'
|
encryption = 'media_encryption=sdes'
|
||||||
@@ -4370,7 +4401,7 @@ def add_device(name, category, extension, conn_type='lan', auto_answer=None):
|
|||||||
else:
|
else:
|
||||||
transport = 'transport=transport-udp'
|
transport = 'transport=transport-udp'
|
||||||
encryption = 'media_encryption=no'
|
encryption = 'media_encryption=no'
|
||||||
ice = ''
|
ice = 'ice_support=yes' if vpn_ice == 'y' else ''
|
||||||
|
|
||||||
aa_tag = ''
|
aa_tag = ''
|
||||||
if auto_answer == 'yes':
|
if auto_answer == 'yes':
|
||||||
@@ -5939,6 +5970,206 @@ web_admin_menu() {
|
|||||||
esac
|
esac
|
||||||
}
|
}
|
||||||
|
|
||||||
|
configure_vpn_stun_ice() {
|
||||||
|
load_config
|
||||||
|
clear
|
||||||
|
print_header "VPN STUN/ICE Configuration"
|
||||||
|
|
||||||
|
echo " This configures ICE (Interactive Connectivity Establishment) and"
|
||||||
|
echo " STUN (Session Traversal Utilities for NAT) for third-party VPNs."
|
||||||
|
echo ""
|
||||||
|
echo " ─────────────────────────────────────────────────────────────"
|
||||||
|
echo " When do you need this?"
|
||||||
|
echo ""
|
||||||
|
echo " • Your VPN does NAT between endpoints (audio fails or is one-way)"
|
||||||
|
echo " • Caller and receiver are on different VPN segments"
|
||||||
|
echo " • Direct VPN routing doesn't work for UDP/RTP traffic"
|
||||||
|
echo ""
|
||||||
|
echo " When do you NOT need this?"
|
||||||
|
echo ""
|
||||||
|
echo " • VPN gives both sides IPs on the same subnet (direct routing)"
|
||||||
|
echo " • Audio works fine without STUN"
|
||||||
|
echo " ─────────────────────────────────────────────────────────────"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
local current_stun="${CUSTOM_STUN_SERVER:-Not configured}"
|
||||||
|
local current_ice="${VPN_ICE_ENABLED:-n}"
|
||||||
|
echo -e " Current Status:"
|
||||||
|
echo -e " VPN ICE: $([[ "$current_ice" == "y" ]] && echo "${GREEN}Enabled${NC}" || echo "${YELLOW}Disabled${NC}")"
|
||||||
|
echo -e " STUN Server: ${CYAN}${current_stun}${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo " 1) Enable VPN ICE + self-hosted STUN (recommended for DNS filtering)"
|
||||||
|
echo " 2) Enable VPN ICE + Google STUN (requires DNS access)"
|
||||||
|
echo " 3) Enable VPN ICE + custom STUN server"
|
||||||
|
echo " 4) Disable VPN ICE (standard LAN mode)"
|
||||||
|
echo " 5) Test current STUN server"
|
||||||
|
echo " 6) Run VPN diagnostics"
|
||||||
|
echo " 7) Check DNS whitelist"
|
||||||
|
echo " 0) Back"
|
||||||
|
echo ""
|
||||||
|
read -p " Select: " stun_choice
|
||||||
|
|
||||||
|
case $stun_choice in
|
||||||
|
1)
|
||||||
|
# Self-hosted STUN via coturn
|
||||||
|
local server_ip=$(hostname -I | awk '{print $1}')
|
||||||
|
echo ""
|
||||||
|
echo " Self-hosted STUN uses coturn on this server (port 3478)."
|
||||||
|
echo " No external DNS dependencies - everything by IP."
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Detect VPN IPs for suggestion
|
||||||
|
local vpn_ip=""
|
||||||
|
while IFS= read -r line; do
|
||||||
|
local iface=$(echo "$line" | awk '{print $2}' | tr -d ':')
|
||||||
|
local ip_addr=$(echo "$line" | awk '{print $4}' | cut -d'/' -f1)
|
||||||
|
if [[ "$iface" =~ ^(tun|tap|wg|tailscale|utun|ppp|nordlynx) ]]; then
|
||||||
|
vpn_ip="$ip_addr"
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done < <(ip -o -f inet addr show scope global 2>/dev/null)
|
||||||
|
|
||||||
|
local suggested_ip="${vpn_ip:-$server_ip}"
|
||||||
|
read -p " STUN server IP [${suggested_ip}]: " stun_ip
|
||||||
|
stun_ip="${stun_ip:-$suggested_ip}"
|
||||||
|
|
||||||
|
read -p " STUN port [3478]: " stun_port
|
||||||
|
stun_port="${stun_port:-3478}"
|
||||||
|
|
||||||
|
VPN_ICE_ENABLED="y"
|
||||||
|
CUSTOM_STUN_SERVER="${stun_ip}:${stun_port}"
|
||||||
|
save_config
|
||||||
|
repair_core_configs
|
||||||
|
generate_pjsip_conf
|
||||||
|
asterisk -rx "core reload" >/dev/null 2>&1 || true
|
||||||
|
|
||||||
|
print_success "VPN ICE enabled with self-hosted STUN: ${CUSTOM_STUN_SERVER}"
|
||||||
|
echo ""
|
||||||
|
echo " Make sure coturn is running on port ${stun_port}:"
|
||||||
|
echo " Docker: docker compose --profile stun up -d"
|
||||||
|
echo " Manual: apt install coturn && systemctl start coturn"
|
||||||
|
echo ""
|
||||||
|
echo " Configure Sipnetic STUN server: ${CUSTOM_STUN_SERVER}"
|
||||||
|
;;
|
||||||
|
2)
|
||||||
|
# Google STUN
|
||||||
|
echo ""
|
||||||
|
echo -e " ${YELLOW}Requires DNS access to: stun.l.google.com${NC}"
|
||||||
|
echo " Add this domain to your DNS whitelist on all networks"
|
||||||
|
echo " (server, caller, and receiver)."
|
||||||
|
echo ""
|
||||||
|
read -p " Continue? [y/N]: " confirm
|
||||||
|
if [[ "$confirm" =~ ^[Yy]$ ]]; then
|
||||||
|
VPN_ICE_ENABLED="y"
|
||||||
|
CUSTOM_STUN_SERVER="stun.l.google.com:19302"
|
||||||
|
save_config
|
||||||
|
repair_core_configs
|
||||||
|
generate_pjsip_conf
|
||||||
|
asterisk -rx "core reload" >/dev/null 2>&1 || true
|
||||||
|
print_success "VPN ICE enabled with Google STUN"
|
||||||
|
echo ""
|
||||||
|
echo " DNS whitelist required: stun.l.google.com (UDP 19302)"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
3)
|
||||||
|
# Custom STUN
|
||||||
|
echo ""
|
||||||
|
read -p " STUN server address (host:port): " custom_stun
|
||||||
|
if [[ -n "$custom_stun" ]]; then
|
||||||
|
VPN_ICE_ENABLED="y"
|
||||||
|
CUSTOM_STUN_SERVER="$custom_stun"
|
||||||
|
save_config
|
||||||
|
repair_core_configs
|
||||||
|
generate_pjsip_conf
|
||||||
|
asterisk -rx "core reload" >/dev/null 2>&1 || true
|
||||||
|
print_success "VPN ICE enabled with custom STUN: ${custom_stun}"
|
||||||
|
else
|
||||||
|
print_error "No STUN server specified"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
4)
|
||||||
|
# Disable
|
||||||
|
VPN_ICE_ENABLED="n"
|
||||||
|
CUSTOM_STUN_SERVER=""
|
||||||
|
save_config
|
||||||
|
repair_core_configs
|
||||||
|
generate_pjsip_conf
|
||||||
|
asterisk -rx "core reload" >/dev/null 2>&1 || true
|
||||||
|
print_success "VPN ICE disabled (standard LAN mode)"
|
||||||
|
;;
|
||||||
|
5)
|
||||||
|
# Test STUN
|
||||||
|
echo ""
|
||||||
|
if [[ -n "$CUSTOM_STUN_SERVER" ]]; then
|
||||||
|
local stun_host=$(echo "$CUSTOM_STUN_SERVER" | cut -d: -f1)
|
||||||
|
local stun_port=$(echo "$CUSTOM_STUN_SERVER" | cut -d: -f2)
|
||||||
|
stun_port="${stun_port:-3478}"
|
||||||
|
|
||||||
|
echo " Testing STUN server: ${CUSTOM_STUN_SERVER}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# DNS test
|
||||||
|
if [[ "$stun_host" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
||||||
|
print_success "STUN server is an IP address (no DNS needed)"
|
||||||
|
else
|
||||||
|
if nslookup "$stun_host" >/dev/null 2>&1; then
|
||||||
|
print_success "DNS resolves: ${stun_host}"
|
||||||
|
else
|
||||||
|
print_error "DNS BLOCKED: ${stun_host}"
|
||||||
|
echo " Add to DNS whitelist or use IP address instead"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Connectivity test
|
||||||
|
if ping -c 2 -W 3 "$stun_host" >/dev/null 2>&1; then
|
||||||
|
print_success "STUN host reachable: ${stun_host}"
|
||||||
|
else
|
||||||
|
print_warn "STUN host not pingable (may still work if ICMP blocked)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Port test via Asterisk
|
||||||
|
if command -v asterisk &>/dev/null; then
|
||||||
|
local rtp_check=$(asterisk -rx "rtp show settings" 2>/dev/null | grep -i "stun\|ice" || echo "")
|
||||||
|
if [[ -n "$rtp_check" ]]; then
|
||||||
|
echo ""
|
||||||
|
echo " Asterisk RTP settings:"
|
||||||
|
echo "$rtp_check" | while IFS= read -r line; do
|
||||||
|
echo " $line"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
print_warn "No STUN server configured"
|
||||||
|
echo " Configure one using options 1-3 above"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
6)
|
||||||
|
# VPN diagnostics
|
||||||
|
if command -v vpn-diagnostics &>/dev/null; then
|
||||||
|
vpn-diagnostics
|
||||||
|
elif [[ -f /usr/local/bin/vpn-diagnostics ]]; then
|
||||||
|
bash /usr/local/bin/vpn-diagnostics
|
||||||
|
else
|
||||||
|
print_error "vpn-diagnostics not found"
|
||||||
|
echo " Install: copy scripts/vpn-diagnostics.sh to /usr/local/bin/vpn-diagnostics"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
7)
|
||||||
|
# DNS whitelist
|
||||||
|
if command -v dns-whitelist &>/dev/null; then
|
||||||
|
dns-whitelist --check
|
||||||
|
elif [[ -f /usr/local/bin/dns-whitelist ]]; then
|
||||||
|
bash /usr/local/bin/dns-whitelist --check
|
||||||
|
else
|
||||||
|
print_error "dns-whitelist not found"
|
||||||
|
echo " Install: copy scripts/dns-whitelist.sh to /usr/local/bin/dns-whitelist"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
0) return ;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
submenu_server() {
|
submenu_server() {
|
||||||
clear
|
clear
|
||||||
print_header "Server Settings"
|
print_header "Server Settings"
|
||||||
@@ -5953,6 +6184,7 @@ submenu_server() {
|
|||||||
echo " 9) Configure VLAN/VPN Subnets"
|
echo " 9) Configure VLAN/VPN Subnets"
|
||||||
echo " 10) Provisioning Manager"
|
echo " 10) Provisioning Manager"
|
||||||
echo " 11) Web Admin (Client Management)"
|
echo " 11) Web Admin (Client Management)"
|
||||||
|
echo " 12) VPN STUN/ICE Configuration"
|
||||||
echo " 0) Back"
|
echo " 0) Back"
|
||||||
read -p " Select: " choice
|
read -p " Select: " choice
|
||||||
case $choice in
|
case $choice in
|
||||||
@@ -5967,6 +6199,7 @@ submenu_server() {
|
|||||||
9) configure_vlan_subnets ;;
|
9) configure_vlan_subnets ;;
|
||||||
10) provisioning_manager_menu ;;
|
10) provisioning_manager_menu ;;
|
||||||
11) web_admin_menu ;;
|
11) web_admin_menu ;;
|
||||||
|
12) configure_vpn_stun_ice ;;
|
||||||
0) return ;;
|
0) return ;;
|
||||||
esac
|
esac
|
||||||
[[ "$choice" != "0" ]] && read -p "Press Enter..."
|
[[ "$choice" != "0" ]] && read -p "Press Enter..."
|
||||||
|
|||||||
@@ -0,0 +1,280 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# ================================================================
|
||||||
|
# DNS Whitelist Checker for Easy Asterisk
|
||||||
|
#
|
||||||
|
# Checks which domains need to be whitelisted when DNS filtering
|
||||||
|
# is active on the server, caller, or receiver networks.
|
||||||
|
#
|
||||||
|
# Usage: dns-whitelist [--check] [--sipnetic] [--linphone]
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
BOLD='\033[1m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
CONFIG_FILE="/etc/easy-asterisk/config"
|
||||||
|
CHECK_MODE=false
|
||||||
|
SHOW_SIPNETIC=false
|
||||||
|
SHOW_LINPHONE=false
|
||||||
|
SHOW_ALL=true
|
||||||
|
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
--check) CHECK_MODE=true; shift ;;
|
||||||
|
--sipnetic) SHOW_SIPNETIC=true; SHOW_ALL=false; shift ;;
|
||||||
|
--linphone) SHOW_LINPHONE=true; SHOW_ALL=false; shift ;;
|
||||||
|
--help|-h)
|
||||||
|
echo "Usage: dns-whitelist [OPTIONS]"
|
||||||
|
echo ""
|
||||||
|
echo "Options:"
|
||||||
|
echo " --check Test reachability of each domain"
|
||||||
|
echo " --sipnetic Show Sipnetic-specific domains"
|
||||||
|
echo " --linphone Show Linphone-specific domains"
|
||||||
|
echo " --help Show this help"
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
*) shift ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
print_header() {
|
||||||
|
echo ""
|
||||||
|
echo -e "${CYAN}╔══════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${CYAN} $1${NC}"
|
||||||
|
echo -e "${CYAN}╚══════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
echo ""
|
||||||
|
}
|
||||||
|
|
||||||
|
check_dns() {
|
||||||
|
local domain="$1"
|
||||||
|
local port="$2"
|
||||||
|
local proto="${3:-tcp}"
|
||||||
|
|
||||||
|
if $CHECK_MODE; then
|
||||||
|
# DNS resolution test
|
||||||
|
if nslookup "$domain" >/dev/null 2>&1; then
|
||||||
|
echo -e " ${GREEN}✓ DNS resolves${NC}"
|
||||||
|
else
|
||||||
|
echo -e " ${RED}✗ DNS BLOCKED - add to whitelist${NC}"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Connectivity test
|
||||||
|
if [[ "$proto" == "udp" ]]; then
|
||||||
|
# UDP - just check DNS resolution (can't reliably test UDP connectivity)
|
||||||
|
echo -e " ${CYAN}→ UDP port ${port} (cannot test remotely)${NC}"
|
||||||
|
else
|
||||||
|
if curl -s --connect-timeout 5 "https://${domain}" >/dev/null 2>&1 || \
|
||||||
|
curl -s --connect-timeout 5 "http://${domain}" >/dev/null 2>&1; then
|
||||||
|
echo -e " ${GREEN}✓ Reachable${NC}"
|
||||||
|
else
|
||||||
|
echo -e " ${YELLOW}! Connection failed (may be expected)${NC}"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Load config if available
|
||||||
|
source "$CONFIG_FILE" 2>/dev/null || true
|
||||||
|
|
||||||
|
print_header "DNS Whitelist for Easy Asterisk"
|
||||||
|
|
||||||
|
echo -e "${BOLD}Your Setup:${NC}"
|
||||||
|
if [[ -n "$DOMAIN_NAME" ]]; then
|
||||||
|
echo -e " Mode: FQDN/Internet (${DOMAIN_NAME})"
|
||||||
|
else
|
||||||
|
echo -e " Mode: LAN/VPN (no domain configured)"
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
# SECTION 1: ASTERISK SERVER DOMAINS
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
if $SHOW_ALL; then
|
||||||
|
echo -e "${BOLD}━━━ 1. ASTERISK SERVER (whitelist on server's DNS filter) ━━━${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for LAN/VPN mode:${NC}"
|
||||||
|
echo -e " ${GREEN}None${NC} - Asterisk needs no internet after installation"
|
||||||
|
echo -e " SIP operates over direct IP connections, no DNS involved"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for FQDN/Internet mode only:${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e " ${CYAN}ifconfig.me${NC} (HTTPS 443)"
|
||||||
|
echo -e " Purpose: Auto-detect public IP for NAT settings"
|
||||||
|
echo -e " When: Only during config regeneration"
|
||||||
|
check_dns "ifconfig.me" "443"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e " ${CYAN}icanhazip.com${NC} (HTTPS 443)"
|
||||||
|
echo -e " Purpose: Fallback public IP detection"
|
||||||
|
check_dns "icanhazip.com" "443"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required if ICE/STUN enabled:${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Check what STUN server is configured
|
||||||
|
stun_server=""
|
||||||
|
if [[ -f /etc/asterisk/rtp.conf ]]; then
|
||||||
|
stun_server=$(grep "^stunaddr=" /etc/asterisk/rtp.conf 2>/dev/null | cut -d= -f2)
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -n "$stun_server" ]]; then
|
||||||
|
stun_host=$(echo "$stun_server" | cut -d: -f1)
|
||||||
|
stun_port=$(echo "$stun_server" | cut -d: -f2)
|
||||||
|
stun_port="${stun_port:-3478}"
|
||||||
|
echo -e " ${CYAN}${stun_host}${NC} (UDP ${stun_port})"
|
||||||
|
echo -e " Purpose: STUN NAT discovery"
|
||||||
|
echo -e " ${YELLOW}Tip: Use self-hosted coturn to avoid this dependency${NC}"
|
||||||
|
check_dns "$stun_host" "$stun_port" "udp"
|
||||||
|
else
|
||||||
|
echo -e " ${GREEN}No external STUN server configured${NC}"
|
||||||
|
echo -e " To use self-hosted: docker compose --profile stun up -d"
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for package updates only:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}archive.ubuntu.com${NC} / ${CYAN}security.ubuntu.com${NC} (HTTPS 443)"
|
||||||
|
echo -e " Purpose: apt package updates"
|
||||||
|
echo -e " When: Only during install/update (not runtime)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for TLS certificates:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}acme-v02.api.letsencrypt.org${NC} (HTTPS 443)"
|
||||||
|
echo -e " Purpose: Let's Encrypt certificate issuance"
|
||||||
|
echo -e " When: Only if using Let's Encrypt / Certbot / Caddy"
|
||||||
|
if $CHECK_MODE; then
|
||||||
|
check_dns "acme-v02.api.letsencrypt.org" "443"
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
# SECTION 2: SIPNETIC (Mobile Client) DOMAINS
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
if $SHOW_ALL || $SHOW_SIPNETIC; then
|
||||||
|
echo -e "${BOLD}━━━ 2. SIPNETIC CLIENT (whitelist on caller/receiver DNS) ━━━${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for SIP calls:${NC}"
|
||||||
|
echo -e " ${GREEN}None${NC} - Configure Sipnetic with the server's IP address directly"
|
||||||
|
echo -e " SIP registration and calls use IP:port, not DNS"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Sipnetic app domains (for app functionality):${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}onesip.io${NC} / ${CYAN}api.onesip.io${NC}"
|
||||||
|
echo -e " Purpose: Sipnetic account/licensing (free tier works offline)"
|
||||||
|
echo -e " Required: Only for initial setup or account sync"
|
||||||
|
if $CHECK_MODE; then
|
||||||
|
check_dns "onesip.io" "443"
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e " ${CYAN}play.google.com${NC} / ${CYAN}apps.apple.com${NC}"
|
||||||
|
echo -e " Purpose: App updates"
|
||||||
|
echo -e " Required: Only for installing/updating the app"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}If STUN configured in Sipnetic:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " The STUN server domain configured in Sipnetic's settings"
|
||||||
|
echo -e " needs to resolve on the mobile device's network."
|
||||||
|
echo ""
|
||||||
|
echo -e " ${YELLOW}Recommendation: Use the Asterisk server's VPN IP as STUN${NC}"
|
||||||
|
echo -e " ${YELLOW}server (if running self-hosted coturn), avoiding DNS entirely.${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Sipnetic Configuration for DNS-Filtered Networks:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Server: ${CYAN}<server-vpn-ip>${NC} (not a hostname)"
|
||||||
|
echo -e " Port: ${CYAN}5060${NC} (UDP, LAN/VPN mode)"
|
||||||
|
echo -e " Transport: ${CYAN}UDP${NC}"
|
||||||
|
echo -e " STUN: ${CYAN}<server-vpn-ip>:3478${NC} (if self-hosted coturn)"
|
||||||
|
echo -e " or leave blank if VPN provides direct routing"
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
# SECTION 3: LINPHONE (Mobile Client) DOMAINS
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
if $SHOW_ALL || $SHOW_LINPHONE; then
|
||||||
|
echo -e "${BOLD}━━━ 3. LINPHONE CLIENT (whitelist on caller/receiver DNS) ━━━${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for SIP calls:${NC}"
|
||||||
|
echo -e " ${GREEN}None${NC} - Same as Sipnetic, configure with server IP directly"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Linphone app domains:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}linphone.org${NC} / ${CYAN}sip.linphone.org${NC}"
|
||||||
|
echo -e " Purpose: Default Linphone SIP proxy (NOT needed for Easy Asterisk)"
|
||||||
|
echo -e " Required: ${GREEN}No${NC} - We use our own Asterisk server"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}subscribe.linphone.org${NC}"
|
||||||
|
echo -e " Purpose: Push notifications (may be needed for background calls)"
|
||||||
|
echo -e " Required: Only if you need calls to ring when app is backgrounded"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}For remote provisioning:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " If using Easy Asterisk's HTTP provisioning:"
|
||||||
|
echo -e " The phone must reach ${CYAN}http://<server-ip>:8088/static/linphone.xml${NC}"
|
||||||
|
echo -e " This is an IP address, so no DNS whitelist needed."
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
# SECTION 4: SUMMARY
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
if $SHOW_ALL; then
|
||||||
|
print_header "Quick Reference - Minimum DNS Whitelist"
|
||||||
|
|
||||||
|
echo -e "${BOLD}For LAN/VPN mode (no internet calling):${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Server DNS filter: ${GREEN}No domains needed${NC}"
|
||||||
|
echo -e " Client DNS filter: ${GREEN}No domains needed${NC}"
|
||||||
|
echo -e " (Configure everything by IP address)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}For LAN/VPN + self-hosted STUN (coturn):${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Server DNS filter: ${GREEN}No domains needed${NC}"
|
||||||
|
echo -e " Client DNS filter: ${GREEN}No domains needed${NC}"
|
||||||
|
echo -e " (STUN server reached by VPN IP, not hostname)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}For LAN/VPN + Google STUN:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Server DNS filter: ${YELLOW}stun.l.google.com${NC}"
|
||||||
|
echo -e " Client DNS filter: ${YELLOW}stun.l.google.com${NC} (if also set in Sipnetic)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}For FQDN/Internet mode:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Server DNS filter: ${YELLOW}ifconfig.me, icanhazip.com, stun.l.google.com${NC}"
|
||||||
|
echo -e " ${YELLOW}acme-v02.api.letsencrypt.org${NC} (if using LE certs)"
|
||||||
|
echo -e " Client DNS filter: ${YELLOW}Your domain name (${DOMAIN_NAME:-yourdomain.com})${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
print_header "Recommendation for DNS-Filtered Environments"
|
||||||
|
|
||||||
|
echo -e " ${GREEN}Use LAN/VPN mode + self-hosted coturn (STUN-only)${NC}"
|
||||||
|
echo -e " ${GREEN}= Zero external DNS dependencies${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Setup: docker compose --profile stun up -d"
|
||||||
|
echo -e " Then configure STUN as your server's VPN IP:3478"
|
||||||
|
echo -e " No hostnames, no DNS, everything by IP."
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
@@ -0,0 +1,306 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# ================================================================
|
||||||
|
# VPN Diagnostics for Easy Asterisk
|
||||||
|
#
|
||||||
|
# Tests whether your third-party VPN setup needs STUN/TURN
|
||||||
|
# and validates connectivity between Asterisk and VPN clients.
|
||||||
|
#
|
||||||
|
# Usage: vpn-diagnostics [--auto] [--client-ip <ip>]
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
BOLD='\033[1m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
CONFIG_FILE="/etc/easy-asterisk/config"
|
||||||
|
RESULTS=()
|
||||||
|
WARNINGS=()
|
||||||
|
CLIENT_IP=""
|
||||||
|
AUTO_MODE=false
|
||||||
|
|
||||||
|
# Parse arguments
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
--auto) AUTO_MODE=true; shift ;;
|
||||||
|
--client-ip) CLIENT_IP="$2"; shift 2 ;;
|
||||||
|
--help|-h)
|
||||||
|
echo "Usage: vpn-diagnostics [OPTIONS]"
|
||||||
|
echo ""
|
||||||
|
echo "Options:"
|
||||||
|
echo " --auto Non-interactive mode"
|
||||||
|
echo " --client-ip <ip> Test connectivity to specific VPN client"
|
||||||
|
echo " --help Show this help"
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
*) shift ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
print_header() {
|
||||||
|
echo ""
|
||||||
|
echo -e "${CYAN}╔══════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${CYAN} $1${NC}"
|
||||||
|
echo -e "${CYAN}╚══════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
echo ""
|
||||||
|
}
|
||||||
|
|
||||||
|
pass() { echo -e " ${GREEN}✓${NC} $1"; RESULTS+=("PASS: $1"); }
|
||||||
|
fail() { echo -e " ${RED}✗${NC} $1"; RESULTS+=("FAIL: $1"); }
|
||||||
|
warn() { echo -e " ${YELLOW}!${NC} $1"; WARNINGS+=("$1"); }
|
||||||
|
info() { echo -e " ${CYAN}→${NC} $1"; }
|
||||||
|
|
||||||
|
# ── Test 1: Detect network interfaces ────────────────────────
|
||||||
|
print_header "VPN Diagnostics for Easy Asterisk"
|
||||||
|
|
||||||
|
echo -e "${BOLD}1. Network Interface Detection${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Detect primary LAN interface
|
||||||
|
primary_ip=$(hostname -I | awk '{print $1}')
|
||||||
|
info "Primary IP: ${primary_ip}"
|
||||||
|
|
||||||
|
# Detect VPN interfaces (tun, tap, wg, tailscale, utun, ppp)
|
||||||
|
vpn_found=false
|
||||||
|
vpn_ips=()
|
||||||
|
vpn_ifaces=()
|
||||||
|
|
||||||
|
while IFS= read -r line; do
|
||||||
|
iface=$(echo "$line" | awk '{print $2}' | tr -d ':')
|
||||||
|
ip_addr=$(echo "$line" | awk '{print $4}' | cut -d'/' -f1)
|
||||||
|
|
||||||
|
# Check for VPN interface patterns
|
||||||
|
if [[ "$iface" =~ ^(tun|tap|wg|tailscale|utun|ppp|nordlynx|proton|mullvad) ]] || \
|
||||||
|
[[ "$ip_addr" =~ ^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|100\.64\.|100\.96\.|100\.100\.) ]]; then
|
||||||
|
vpn_found=true
|
||||||
|
vpn_ips+=("$ip_addr")
|
||||||
|
vpn_ifaces+=("$iface")
|
||||||
|
pass "VPN interface detected: ${iface} (${ip_addr})"
|
||||||
|
fi
|
||||||
|
done < <(ip -o -f inet addr show scope global 2>/dev/null)
|
||||||
|
|
||||||
|
if ! $vpn_found; then
|
||||||
|
warn "No VPN interface detected on server"
|
||||||
|
info "If your VPN runs on the router (not this server), that's expected"
|
||||||
|
info "The VPN subnet should be added via VLAN/VPN subnet configuration"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 2: Check Asterisk PJSIP transport configuration ─────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}2. Asterisk Transport Configuration${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [[ -f /etc/asterisk/pjsip.conf ]]; then
|
||||||
|
# Check local_net entries
|
||||||
|
local_nets=$(grep "^local_net=" /etc/asterisk/pjsip.conf 2>/dev/null | sort -u)
|
||||||
|
if [[ -n "$local_nets" ]]; then
|
||||||
|
while IFS= read -r net; do
|
||||||
|
info "Transport local_net: ${net#local_net=}"
|
||||||
|
done <<< "$local_nets"
|
||||||
|
|
||||||
|
# Check if VPN subnets are included
|
||||||
|
for vpn_ip in "${vpn_ips[@]}"; do
|
||||||
|
vpn_subnet=$(echo "$vpn_ip" | sed 's/\.[0-9]*$/.0\/24/')
|
||||||
|
if echo "$local_nets" | grep -q "$vpn_subnet"; then
|
||||||
|
pass "VPN subnet ${vpn_subnet} included in transport"
|
||||||
|
else
|
||||||
|
fail "VPN subnet ${vpn_subnet} NOT in transport local_net"
|
||||||
|
warn "Add via: Server Settings → Configure VLAN/VPN Subnets"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
else
|
||||||
|
warn "No local_net entries found in transport (basic LAN mode)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check transport types
|
||||||
|
if grep -q "transport=transport-udp" /etc/asterisk/pjsip.conf; then
|
||||||
|
pass "UDP transport configured for LAN/VPN devices"
|
||||||
|
fi
|
||||||
|
if grep -q "transport=transport-tls" /etc/asterisk/pjsip.conf; then
|
||||||
|
pass "TLS transport configured for FQDN devices"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
fail "pjsip.conf not found"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 3: Check RTP and ICE/STUN configuration ─────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}3. RTP / ICE / STUN Configuration${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [[ -f /etc/asterisk/rtp.conf ]]; then
|
||||||
|
rtp_start=$(grep "^rtpstart=" /etc/asterisk/rtp.conf | cut -d= -f2)
|
||||||
|
rtp_end=$(grep "^rtpend=" /etc/asterisk/rtp.conf | cut -d= -f2)
|
||||||
|
info "RTP port range: ${rtp_start:-10000}-${rtp_end:-20000}"
|
||||||
|
|
||||||
|
if grep -q "^icesupport=yes" /etc/asterisk/rtp.conf; then
|
||||||
|
pass "ICE support enabled"
|
||||||
|
stun_addr=$(grep "^stunaddr=" /etc/asterisk/rtp.conf | cut -d= -f2)
|
||||||
|
if [[ -n "$stun_addr" ]]; then
|
||||||
|
info "STUN server: ${stun_addr}"
|
||||||
|
|
||||||
|
# Test STUN server reachability
|
||||||
|
stun_host=$(echo "$stun_addr" | cut -d: -f1)
|
||||||
|
stun_port=$(echo "$stun_addr" | cut -d: -f2)
|
||||||
|
stun_port="${stun_port:-3478}"
|
||||||
|
|
||||||
|
if command -v nslookup &>/dev/null && nslookup "$stun_host" >/dev/null 2>&1; then
|
||||||
|
pass "STUN server DNS resolves: ${stun_host}"
|
||||||
|
else
|
||||||
|
fail "Cannot resolve STUN server: ${stun_host}"
|
||||||
|
warn "Add ${stun_host} to DNS whitelist"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
info "ICE support disabled (standard for LAN/VPN mode)"
|
||||||
|
warn "If audio fails over VPN, enable ICE via: Server Settings → VPN STUN/ICE"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
warn "rtp.conf not found"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 4: Check endpoint ICE settings ───────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}4. Per-Device ICE Configuration${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [[ -f /etc/asterisk/pjsip.conf ]]; then
|
||||||
|
device_count=$(grep -c "^; === Device:" /etc/asterisk/pjsip.conf 2>/dev/null || echo 0)
|
||||||
|
ice_device_count=$(grep -c "^ice_support=yes" /etc/asterisk/pjsip.conf 2>/dev/null || echo 0)
|
||||||
|
info "Total devices: ${device_count}"
|
||||||
|
info "Devices with ICE: ${ice_device_count}"
|
||||||
|
|
||||||
|
if [[ "$device_count" -gt 0 && "$ice_device_count" -eq 0 ]]; then
|
||||||
|
warn "No devices have ICE enabled"
|
||||||
|
info "For third-party VPNs with NAT, enable ICE via VPN STUN/ICE menu"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 5: VPN client connectivity ──────────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}5. VPN Client Connectivity${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [[ -z "$CLIENT_IP" ]] && ! $AUTO_MODE; then
|
||||||
|
echo " Enter a VPN client IP to test connectivity (or press Enter to skip):"
|
||||||
|
read -p " Client VPN IP: " CLIENT_IP
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -n "$CLIENT_IP" ]]; then
|
||||||
|
# Ping test
|
||||||
|
if ping -c 2 -W 3 "$CLIENT_IP" >/dev/null 2>&1; then
|
||||||
|
pass "Ping to ${CLIENT_IP} succeeded"
|
||||||
|
else
|
||||||
|
fail "Ping to ${CLIENT_IP} failed"
|
||||||
|
warn "VPN routing issue - client may not be reachable"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# SIP port test (UDP 5060)
|
||||||
|
if command -v nc &>/dev/null; then
|
||||||
|
if nc -z -u -w 3 "$CLIENT_IP" 5060 2>/dev/null; then
|
||||||
|
pass "UDP 5060 reachable on ${CLIENT_IP}"
|
||||||
|
else
|
||||||
|
info "UDP 5060 probe inconclusive (normal for filtered VPNs)"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
info "Skipping client connectivity test (no IP provided)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 6: NAT type detection ───────────────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}6. NAT Type Analysis${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Check if server is behind NAT
|
||||||
|
if [[ -n "$primary_ip" ]]; then
|
||||||
|
public_ip=$(curl -s -4 --connect-timeout 5 ifconfig.me 2>/dev/null || echo "")
|
||||||
|
if [[ -n "$public_ip" ]]; then
|
||||||
|
if [[ "$primary_ip" == "$public_ip" ]]; then
|
||||||
|
pass "Server has public IP (no NAT)"
|
||||||
|
else
|
||||||
|
info "Server behind NAT: ${primary_ip} → ${public_ip}"
|
||||||
|
info "This is normal for VPN setups where traffic stays on VPN"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
info "Cannot detect public IP (DNS filtering or no internet)"
|
||||||
|
info "Not needed for LAN/VPN mode"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 7: Asterisk registration status ─────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}7. Asterisk Registration Status${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if command -v asterisk &>/dev/null; then
|
||||||
|
reg_output=$(asterisk -rx "pjsip show endpoints" 2>/dev/null || echo "")
|
||||||
|
if [[ -n "$reg_output" ]]; then
|
||||||
|
online_count=$(echo "$reg_output" | grep -c "Avail" 2>/dev/null || echo 0)
|
||||||
|
offline_count=$(echo "$reg_output" | grep -c "Unavail" 2>/dev/null || echo 0)
|
||||||
|
info "Endpoints online: ${online_count}"
|
||||||
|
info "Endpoints offline: ${offline_count}"
|
||||||
|
|
||||||
|
if [[ "$offline_count" -gt 0 ]]; then
|
||||||
|
warn "Some endpoints are offline - check VPN connectivity"
|
||||||
|
echo "$reg_output" | grep "Unavail" | while IFS= read -r line; do
|
||||||
|
info " Offline: $line"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
info "Asterisk not running or no endpoints configured"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
info "Asterisk CLI not available"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Summary ──────────────────────────────────────────────────
|
||||||
|
print_header "Diagnostic Summary"
|
||||||
|
|
||||||
|
fail_count=0
|
||||||
|
pass_count=0
|
||||||
|
for result in "${RESULTS[@]}"; do
|
||||||
|
if [[ "$result" == FAIL* ]]; then
|
||||||
|
((fail_count++))
|
||||||
|
elif [[ "$result" == PASS* ]]; then
|
||||||
|
((pass_count++))
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo -e " Passed: ${GREEN}${pass_count}${NC}"
|
||||||
|
echo -e " Failed: ${RED}${fail_count}${NC}"
|
||||||
|
echo -e " Warnings: ${YELLOW}${#WARNINGS[@]}${NC}"
|
||||||
|
|
||||||
|
if [[ ${#WARNINGS[@]} -gt 0 ]]; then
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}Recommendations:${NC}"
|
||||||
|
for w in "${WARNINGS[@]}"; do
|
||||||
|
echo -e " ${YELLOW}→${NC} $w"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── STUN Recommendation ─────────────────────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}Do you need STUN?${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if $vpn_found; then
|
||||||
|
echo -e " VPN detected on this server."
|
||||||
|
echo -e " ${GREEN}If your VPN provides direct routing (both sides get VPN IPs),${NC}"
|
||||||
|
echo -e " ${GREEN}STUN is likely NOT needed.${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${YELLOW}If audio works one-way or not at all, enable STUN:${NC}"
|
||||||
|
echo -e " 1. docker compose --profile stun up -d (self-hosted STUN)"
|
||||||
|
echo -e " 2. Or via easy-asterisk: Server Settings → VPN STUN/ICE"
|
||||||
|
else
|
||||||
|
echo -e " No VPN interface found on server."
|
||||||
|
echo -e " ${YELLOW}If VPN runs on router/firewall:${NC}"
|
||||||
|
echo -e " - Add VPN subnet via: Server Settings → VLAN/VPN Subnets"
|
||||||
|
echo -e " - If audio still fails, enable STUN for NAT traversal"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
Reference in New Issue
Block a user