Rtpengine Dtls Handshake Problem Webrtc Calls

[Mehmet Hikmet DEMİRCİ]

Hello,

I'm using RTPengine version 13.

For an inbound WebRTC call, the 200 OK SDP I'm receiving announces a public IP address, as shown below. However, I've observed that when the RTPengine server sends its "hello" (or RTP probe) in response to the client's "hello" message, it's going to a private IP address.

Could you please explain why this might be happening?


v=0
o=- 444265521739756823 2 IN IP4 127.0.0.1
s=-
t=0 0
a=msid-semantic:  WMS 39c919c3-0abe-4bb9-a545-18daeba7f24e
m=audio 29114 RTP/SAVPF 8 0
c=IN IP4 PUBLIC_IP
a=rtcp:28994 IN IP4 PUBLIC_IP
a=candidate:2152873219 1 udp 2122260223 10.200.140.66 57769 typ host generation 0 network-id 1
a=candidate:2832873419 1 udp 2122194687 192.168.1.111 57770 typ host generation 0 network-id 2
a=candidate:2152873219 2 udp 2122260222 10.200.140.66 57771 typ host generation 0 network-id 1
a=candidate:2832873419 2 udp 2122194686 192.168.1.111 57772 typ host generation 0 network-id 2
a=candidate:1762943105 1 udp 1685987071 PUBLIC_IP 29114 typ srflx raddr 192.168.1.111 rport 57770 generation 0 network-id 2
a=candidate:1762943105 2 udp 1685987070 PUBLIC_IP 28994 typ srflx raddr 192.168.1.111 rport 57772 generation 0 network-id 2
a=ice-ufrag:Ckun
a=ice-pwd:Gd85DNaaFBE7JayHcrSQKVH2
a=ice-options:trickle
a=fingerprint:sha-256 36:84:DF:7F:A5:53:D4:DD:8A:17:8E:D4:97:6A:F4:56:3A:DB:7D:65:6B:0E:31:36:30:D8:66:D2:73:BC:57:7E
a=setup:active
a=mid:0
a=sendrecv
a=msid:39c919c3-0abe-4bb9-a545-18daeba7f24e ffe7e308-b511-4b4c-bc99-da56de454e39
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=ssrc:1860754883 cname:z6N6ksrcK3OQRMwm

Here's how my rtpengine_manage is configured to handle the SDP body sent to the client:

 rtpengine_manage("internal external trust-address replace-origin replace-session-connection endpoint-learning=delayed ICE=force RTP/SAVPF SDES-off");

[Richard Fuchs]

On 24/07/2025 08.37, Mehmet Hikmet DEMİRCİ wrote:
> I'm using RTPengine version 13.

You'll have to be a bit more specific than that.

> For an inbound WebRTC call, the 200 OK SDP I'm receiving announces a
> public IP address, as shown below. However, I've observed that when
> the RTPengine server sends its "hello" (or RTP probe) in response to
> the client's "hello" message, it's going to a private IP address.

When ICE in is use, the address from the `c=` line generally is ignored
and instead one of the addresses from the ICE candidates is used. In
your example the address with the highest priority is 10.200.140.66.

Typically the ICE handshake would have established a working ICE
candidate pair before the DTLS handshake begins, or at least find one
soon after, and so the DTLS response would be sent to whichever ICE
candidate was found to be working.

ICE handshake event can be seen in the log, or you can look at a
Wireshark capture.

Cheers

[Mehmet Hikmet DEMİRCİ]

Thanks for the quick reply, I'll give that a try.