freeSWITCH-403 forbidden sip/2.0 (Intermittent 403 Forbidden Errors with SIP WebRTC Client on FreeSWITCH)

[manikanta]

@Adrian Fretwell

Hi sir,
I'm currently running a FreeSWITCH server hosted on DigitalOcean and I've encountered an issue that I'm hoping someone can help me resolve.

Issue Description:
I am able to make calls to SIP softphones without any problems. However, when attempting to call a SIP WebRTC client using the "sip.js" package, I often receive a 403 Forbidden error. Interestingly, if I reload the webpage several times (usually 3-4 times), the client eventually gets a 200 OK status and registers successfully.

Setup Details:

• Server: FreeSWITCH hosted on DigitalOcean
• Client Library: sip.js
• Error: Intermittent 403 Forbidden when trying to call SIP WebRTC client

Steps to Reproduce:

1. Attempt to call a SIP WebRTC client using sip.js.
2. Observe that a 403 Forbidden error is received.
3. Reload the webpage multiple times (3-4 times).
4. Eventually, the client registers successfully with a 200 OK status.

Troubleshooting Steps Taken:

• Verified FreeSWITCH configuration for WebRTC support.
• Checked the network and firewall settings on the DigitalOcean droplet.
• Ensured that the sip.js configuration aligns with the FreeSWITCH settings.
• Examined FreeSWITCH logs for any obvious errors or misconfigurations.

Despite these efforts, the issue persists intermittently. I suspect it might be related to authentication or session management, but I haven't been able to pinpoint the exact cause.


Request for Assistance:

• Has anyone encountered a similar issue with intermittent 403 Forbidden errors when using sip.js with FreeSWITCH?
• Are there any specific logs or settings that I should review to diagnose the issue more effectively?
• Could this be related to WebSocket connection handling or NAT traversal issues?
• Any suggestions or best practices for ensuring stable WebRTC client registration with FreeSWITCH?

Thank you in advance for your help!

Best regards,
Manikanta.

 

[Adrian Fretwell]

Hi @manikanta ,
I'm sorry I do not know the answer. Are you absolutely sure it is WebRTC related? The 403, would suggest that FreeSWITCH received the response to the WWW-Authenticate OK, but either (username or password was incorrect) or FreeSWITCH was unable to retrieve the directory information in a timely manner (or not at all) and therefore responded with a 403.

 

[Jonathan Black]

Not related specifically to WebRTC, but running sngrep on the FreeSWITCH side might provide some insight into what's happening when it connects.

 

[manikanta]

@Jonathan Black
let me share the screenshots what i'm getting here. Please check this might give you some idea.

 

[Jonathan Black]

Well, maybe someone else can chime in here who is more of an expert, but it looks to me like there is some issue with sip.js properly performing the authentication every time, consistently. I would recommend that you run sngrep on your FreeSWITCH machine and compare the output there with what you are seeing in those logs/screenshots.

 

[Jonathan Black]

You might also compare different types of endpoints to see if the issue is specific to webRTC/sip.js. Try a reputable softphone or desk phone or maybe a different webRTC client.

 

[manikanta]

When coming to using Sipjs or Jssip (Webrtc sip clients), these connect to freeswitch via websocket. When I am trying to register these to freeswitch, it is giving infrequent 403 Forbidden error. When I reload the page and it tries to reconnect sometimes I get 200 OK response.

Sngrep is not able to show any issue. Since it is useful only when we try to make a call or showing any call information. Here I am trying to register a sip endpoint to my freeswitch. I am getting registering issues. But without doing anything and just reloading the page and trying to re-register, the endpoint gets connected sometimes and doesnt get connected sometimes.

 

[Jonathan Black]

In my experience, sngrep will also show registration attempts. But maybe there are different versions.
Sorry, I haven’t used WebRTC a lot, but have had to use various tools to troubleshoot registration problems from endpoints. Comparing the logging/PCAP from the endpoint to the output from sngrep has been the best method I’ve found to identify the issue. Your mileage may vary.