Kamailio + RTPEngine - Media Addresses based on direction?

[Slavik Bialik]

Hi,

I don't know if this question should go to Kamailio or here, but hopefully you'll be able to assist. 

I have a Kamailio instance that is going to be connected to multiple RTPEngine instances by setting this:

modparam("rtpengine", "rtpengine_sock", "udp:x.x.x.x:22222 udp:y.y.y.y:22222")

Up until now, we had our RTPEngine installed on the Kamilio server itself, therefore the traffic went to only one service of RTPEngine but I want to change this and externalize RTPEngine so I might have multiple of them.

Also:

1. I have only one interface on Kamailio. This interface serves both traffic from the outside (WAN clients) and from the inside PBX. 
2. I have only one interface on RTPEngine, where I am configuring it like that:
   interface=ens5!52.20.222.52
   With a public IP, which is my public IP that is associated with this server.

So inside the NAT_MANAGE route in Kamailio config I had something like this:

        if (isbflagset(FLB_RTPWS)) {
                if ($proto =~ "ws") { # web --> SIP
                        $xavp(r=>$T_branch_idx) = $xavp(r=>$T_branch_idx) + " rtcp-mux-demux generate-mid DTLS=off ICE=remove RTP/AVP media-address={{PRIVATE_IP}}";
                } else { # SIP --> web
                        $xavp(r=>$T_branch_idx) = $xavp(r=>$T_branch_idx) + " rtcp-mux-offer generate-mid DTLS=active SDES-off ICE=force RTP/SAVPF media-address={{PUBLIC_IP}}";
                }
        } else {
                if ($proto =~ "ws") { # web --> web
                        $xavp(r=>$T_branch_idx) = $xavp(r=>$T_branch_idx) + " generate-mid DTLS=actpass SDES-off ICE=force media-address={{PUBLIC_IP}}";
                }
        }

But now when I can have multiple instances of RTPEngine managed by single Kamailio, how can I reduce the usage of media-address and so that the RTPEngine will be able to allocate the IP address within the SDP based on a direction? Means that if it'll send the SDP to the PBX in the internal LAN it'll present it the private IP of RTPEngine, while when the traffic goes to our clients over the WAN it'll present them the public IP address?

Thanks!

[Richard Fuchs]

Using `media-address` is not the recommended way of doing this. Instead you should be using multiple named interfaces together with the `direction=` options.

In your config you would list your interface twice, once with and once without NAT address:

interface = priv/ens5;pub/ens5!52.20.222.52

And then in your offer flags, you would give two `direction=` options, the first one indicating where the offer is originating from, and the second one where it is going to. So for an offer originating from the private network and going to the public internet:

direction=priv direction=pub

This can be included in the answer too, but is optional.

Cheers

[Slavik Bialik]

Thanks Richard!

It is working for me. :)

I thought that I had to have an actual 2 different interfaces to make it work, but actually it can be done with one "physical" interface but aliasing it as 2 - sort of.

[Jose Figueroa]

Hello,

I'm trying to do something similar and I have only 1-way audio at the moment. I have two questions: 

1. What does the ens5 means in interface=priv/ens5  the linux interface name? 

2. I have in 1 kamailio with 2 interfaces: 

ens34: public IP XX.XX.XX.10

ens33: private IP 192.168.30.145

Now I have RTP server 1 with 1 single interface:

private IP: 10.1.130.110

-- config --

interface=priv/10.1.130.110!192.168.30.145;pubc/10.1.130.110!XX.XX.XX.10 # corresponding with public IP from kamailio 

In the kamailio i have:

 rtpengine_offer = "replace-origin direction=pub direction=priv trust-address ICE=remove RTP/AVP"

rtpengine_answer ="replace-origin direction=priv direction=pub trust-address ICE=remove RTP/AVP"

What would be the proper config setup here? The idea is to have multiple Rtpengines

Thanks in advance

[Richard Fuchs]

On 11/02/2026 18.07, Jose Figueroa wrote:
> I'm trying to do something similar and I have only 1-way audio at the
> moment. I have two questions:
> 1. What does the ens5 means in interface=priv/ens5  the linux
> interface name?

No, it's the other way around. The primary config value for an interface
is an address, but you can also use a Linux interface name (in which
case all addresses present on that interface will be used).

The second value (after the first slash) is an internal "logical"
interface name. You use this to identify the interface when
communicating with rtpengine, e.g. from Kamailio. A "logical" interface
can be made up from multiple real interfaces or addresses, mostly useful
in multi-homed scenarios when ICE is in use.

> 2. I have in 1 kamailio with 2 interfaces:
> ens34: public IP XX.XX.XX.10
> ens33: private IP 192.168.30.145
>
> Now I have RTP server 1 with 1 single interface:
> private IP: 10.1.130.110
> -- config --
> interface=priv/10.1.130.110!192.168.30.145;pubc/10.1.130.110!XX.XX.XX.10
> # corresponding with public IP from kamailio

The `interface` config given to rtpengine is only about which local
interfaces it may use for RTP. The interfaces used by Kamailio are
irrelevant. If you need RTP flowing to/from the public internet, then
rtpengine must have an interface configured that is able to do that.

>  rtpengine_offer = "replace-origin direction=pub direction=priv
> trust-address ICE=remove RTP/AVP"
> rtpengine_answer ="replace-origin direction=priv direction=pub
> trust-address ICE=remove RTP/AVP"
>
> What would be the proper config setup here?

In the rtpengine config, probably something like `interface =
55.66.77.88/pub ; 10.3.4.5/priv`

Both addresses must be bound on the rtpengine host. Alternatively the
public address could be behind 1-to-1 NAT, in which case you'd use the
"advertised address" syntax instead of the public address directly.

> The idea is to have multiple Rtpengines

Now this has very little to do with the rtpengine interface config, and
has more to do with the configuration of the rtpengine "sets" in Kamailio.

As for interface config, probably each rtpengine instance would use
different local addresses, but use the same logical interface names.

Cheers