[jitsi-dev] Bug report: ICE failed through restricted NAT

#1

Hello,

I recently started to use jitsi, the chat works just fine. But calling
doesnt work. If someone calls me while connected through my student
residential NAT, the calling window pops up saying "ICE failed". If I
try to call someone it doesn't even start the call stating: "Call ended
by remote side. Reason: incompatible-parameters. Error: null".

Using my Android as Hotspot, everything works perfectly, so it's not a
problem with my XMPP server or Program settings. Must be restrictions

I think this is a bug for two reasons:

1. If Jitsi wants to compete with Skype it should just work, anywhere.
2. The Error message is useless.

Any possibilities to make it work ?!

Cheers, Rouven

···

from my NAT, and I can't change anything here!

#2

sorry, I forgot:

Operating System: Ubuntu Gnome 13.04
Version: 2.2.4603.9615

logs are attached.

Rouven

2013-10-10@11.45.30-logs.zip (193 KB)

···

On 10.10.2013 11:42, Rouven Volkmann wrote:

Hello,

I recently started to use jitsi, the chat works just fine. But calling
doesnt work. If someone calls me while connected through my student
residential NAT, the calling window pops up saying "ICE failed". If I
try to call someone it doesn't even start the call stating: "Call ended
by remote side. Reason: incompatible-parameters. Error: null".

Using my Android as Hotspot, everything works perfectly, so it's not a
problem with my XMPP server or Program settings. Must be restrictions
from my NAT, and I can't change anything here!

I think this is a bug for two reasons:

1. If Jitsi wants to compete with Skype it should just work, anywhere.
2. The Error message is useless.

Any possibilities to make it work ?!

Cheers, Rouven

_______________________________________________
dev mailing list
dev@jitsi.org
Unsubscribe instructions and other list options:
http://lists.jitsi.org/mailman/listinfo/dev

#3

I do have the same problem with my call partner, depending on location.
Jitsi sort of works from one place, but we get the ice-problem from the
other. My place is also behind a rather restrictive firewall, and
there's nothing I can do about it. So far this has ruined most attempts
of making voice/video calls using jitsi or linphone. In the rare cases
when it worked, a jitsi bug showed up after a few minutes and gone was
the audio, forcing both call partners to delete .jitsi in order to
make another call possible. This has gotten really frustrating.
I hope the jitsi devs will at some point go the remaining 90% and not
only implement feature after feature but also make sure that they work
reliably.

Philipp

···

On Thu, 10 Oct 2013 11:42:28 +0200 Rouven Volkmann <mail@rouven-volkmann.de> wrote:

Hello,

I recently started to use jitsi, the chat works just fine. But calling
doesnt work. If someone calls me while connected through my student
residential NAT, the calling window pops up saying "ICE failed". If I
try to call someone it doesn't even start the call stating: "Call
ended by remote side. Reason: incompatible-parameters. Error: null".

Using my Android as Hotspot, everything works perfectly, so it's not a
problem with my XMPP server or Program settings. Must be restrictions
from my NAT, and I can't change anything here!

I think this is a bug for two reasons:

1. If Jitsi wants to compete with Skype it should just work, anywhere.
2. The Error message is useless.

Any possibilities to make it work ?!

Cheers, Rouven

#4

Hi,

Although I certainly agree on the error message being utterly useless to an end user the issue is not fixable on the client side: if Jitsi is behind a NAT then there cannot be a direct connection between the two clients.

However, this issue IS fixable: the "ICE" that failed is actually (in layman's terms: I'm not a dev but I'm following this as well) a name for two technologies that are used to work around this issue:

- STUN, which is a method where the two clients basically ask a third party "what port should I use" and the third party sorts it out for them. This fixes most people's NAT related issues but some dodgy firewalls and things will essentially tell the STUN server the wrong thing, so ICE then tries

- TURN, which is a method where the third party basically forwards ALL the traffic between the two parties. This introduces lag as you'd expect and keeps your server busier, but as a last resort it works and usually the percentage using this method is quite low.

So while I am "+1ing" your request for a sensible error message (and I would particularly like to see that error message tell you what aspects of ICE it tried and failed), to solve your problem you need to configure your XMPP or SIP server to support TURN and STUN. Things like Skype would do all this in the background, but of course with Jitsi we are responsible for our own systems!

To any devs reading this, please correct any mistakes I may have made, I'm new to Jitsi but the above is based on my understanding of what's going on.

sorry, I forgot:

Operating System: Ubuntu Gnome 13.04
Version: 2.2.4603.9615

logs are attached.

Rouven

···

On 10/10/13 10:46, Rouven Volkmann wrote:

On 10.10.2013 11:42, Rouven Volkmann wrote:

Hello,

I recently started to use jitsi, the chat works just fine. But calling
doesnt work. If someone calls me while connected through my student
residential NAT, the calling window pops up saying "ICE failed". If I
try to call someone it doesn't even start the call stating: "Call ended
by remote side. Reason: incompatible-parameters. Error: null".

Using my Android as Hotspot, everything works perfectly, so it's not a
problem with my XMPP server or Program settings. Must be restrictions
from my NAT, and I can't change anything here!

I think this is a bug for two reasons:

1. If Jitsi wants to compete with Skype it should just work, anywhere.
2. The Error message is useless.

Any possibilities to make it work ?!

Cheers, Rouven

_______________________________________________
dev mailing list
dev@jitsi.org<mailto:dev@jitsi.org>
Unsubscribe instructions and other list options:
http://lists.jitsi.org/mailman/listinfo/dev

--
Toby Pinder | Telemetry Software Engineer

Switchboard +44 (0)845 077 9077
Office Phone: + 44 191 419 7135
Mobile Phone: + 44 (0)7821 036 600

E. toby.pinder@smithelectric.com<mailto:ross.cooney@smithelectric.com>
W. www.smithelectric.com<http://www.smithelectric.com/>

[cid:part4.05080000.04040608@smithelectric.com]

This email and any attachments thereto may contain private, confidential, and privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.

#5

Hi Philip,

As I stressed to Rouven this is a usability issue and not a "feature" issue. Jitsi works fine with direct connections on a standard server, but it needs your servers to have extra components like STUN and TURN for firewalled connections to work. Yes the error message is useless (especially to an end user) but the fact that it cannot connect is due to your XMPP/SIP server not being set up with these extra components. I would desperately support more user feedback on the ICE process being given to the end user though: we're currently trying to set this up in our company using OpenFire as a server and the only way we can "debug" is by pulling the logs from the calling client.

As for your disconnection issue, I don't know what would cause that. I'm just a user of Jitsi at the moment.

Hope this helps,

Toby Pinder | Telemetry Software Engineer

E. toby.pinder@smithelectric.com<mailto:ross.cooney@smithelectric.com>
W. www.smithelectric.com<http://www.smithelectric.com/>

[cid:part3.09090807.02040306@smithelectric.com]

This email and any attachments thereto may contain private, confidential, and privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.

Hello,

I recently started to use jitsi, the chat works just fine. But calling
doesnt work. If someone calls me while connected through my student
residential NAT, the calling window pops up saying "ICE failed". If I
try to call someone it doesn't even start the call stating: "Call
ended by remote side. Reason: incompatible-parameters. Error: null".

Using my Android as Hotspot, everything works perfectly, so it's not a
problem with my XMPP server or Program settings. Must be restrictions
from my NAT, and I can't change anything here!

I think this is a bug for two reasons:

1. If Jitsi wants to compete with Skype it should just work, anywhere.
2. The Error message is useless.

Any possibilities to make it work ?!

Cheers, Rouven

I do have the same problem with my call partner, depending on location.
Jitsi sort of works from one place, but we get the ice-problem from the
other. My place is also behind a rather restrictive firewall, and
there's nothing I can do about it. So far this has ruined most attempts
of making voice/video calls using jitsi or linphone. In the rare cases
when it worked, a jitsi bug showed up after a few minutes and gone was
the audio, forcing both call partners to delete .jitsi in order to
make another call possible. This has gotten really frustrating.
I hope the jitsi devs will at some point go the remaining 90% and not
only implement feature after feature but also make sure that they work
reliably.

Philipp

···

On 10/10/13 17:21, Philipp Überbacher wrote:
On Thu, 10 Oct 2013 11:42:28 +0200 Rouven Volkmann <mail@rouven-volkmann.de><mailto:mail@rouven-volkmann.de> wrote:

_______________________________________________
dev mailing list
dev@jitsi.org<mailto:dev@jitsi.org>
Unsubscribe instructions and other list options:
http://lists.jitsi.org/mailman/listinfo/dev

--

#6

Thanks Toby,
I was not aware that the XMPP server has to support this, and I
couldn't find any information regarding STUN/TURN on the homepage of the
public server we are using (only that it uses ejabberd). The most
informative public server overview I found so far doesn't list anything
STUN/TURN realted either
(http://www.jaim.at/server/server_by_gateway_xmpp.html). I'd appreciate
it if you could tell me a public server that can do this.

It's possible to explicitly set a STUN server in linphone, however, I
could not find any such option in jitsi, so I assumed it was somehow
handled automagically. We haven't tried SIP through jitsi yet, but
given that the public SIP-server we tried so far (linphone.org)
suggests to use stunserver.org I assume that it doesn't support it
directly. Since it's apparently not possible to set such servers
manually in jitsi I guess we're out of luck with SIP through
jitsi as well. At least I've found the ICE-settings for XMPP now, but
there are none for SIP.

I do see the usability issue as well, it requires a rather technically
inclined person to make any sense of a message that just says 'ICE
failed'. "I don't want icecream, I want to make a call!"

Thanks Toby,
regards Philipp

···

On Thu, 10 Oct 2013 12:13:21 -0500 Toby Pinder <Toby.Pinder@smithelectric.com> wrote:

Hi Philip,

As I stressed to Rouven this is a usability issue and not a "feature"
issue. Jitsi works fine with direct connections on a standard server,
but it needs your servers to have extra components like STUN and TURN
for firewalled connections to work. Yes the error message is useless
(especially to an end user) but the fact that it cannot connect is
due to your XMPP/SIP server not being set up with these extra
components. I would desperately support more user feedback on the ICE
process being given to the end user though: we're currently trying to
set this up in our company using OpenFire as a server and the only
way we can "debug" is by pulling the logs from the calling client.

As for your disconnection issue, I don't know what would cause that.
I'm just a user of Jitsi at the moment.

Hope this helps,

Toby Pinder | Telemetry Software Engineer

#7

Hey Philipp,

I'd appreciate
it if you could tell me a public server that can do this.

You can try http://jit.si

It's possible to explicitly set a STUN server in linphone, however, I
could not find any such option in jitsi,

STUN server, TURN servers and Jingle Relay Nodes are set through the account configuration.

so I assumed it was somehow
handled automagically.

It is, if properly configured on the domain that you are connecting to (which is the case with jit.si).

We haven't tried SIP through jitsi yet, but
given that the public SIP-server we tried so far (linphone.org)
suggests to use stunserver.org I assume that it doesn't support it
directly.

We only support ICE, STUN, TURN and Jingle Relay nodes through XMPP. SIP support is on the way but we currently rely on hosted NAT traversal.

Since it's apparently not possible to set such servers
manually in jitsi I guess we're out of luck with SIP through
jitsi as well.

Very few SIP deployments expect you to support ICE (contrary to XMPP). You can try ippi.com or sip2sip.info, both of which will do this for you.

At least I've found the ICE-settings for XMPP now, but
there are none for SIP.

Yup, already explained.

I do see the usability issue as well, it requires a rather technically
inclined person to make any sense of a message that just says 'ICE
failed'. "I don't want icecream, I want to make a call!"

That's true ... still ... stating "impossible to establish a connection with the other party through any of the routes we tried" isn't going to be much more helpful.

Emil

···

On 10.10.13, 20:07, Philipp Überbacher wrote:

Thanks Toby,
regards Philipp

_______________________________________________
dev mailing list
dev@jitsi.org
Unsubscribe instructions and other list options:
http://lists.jitsi.org/mailman/listinfo/dev

--
https://jitsi.org

#8

Thanks Emil,
I will try those servers once I can convince my partner to give this
another go.

Regards,
Philipp

···

On Thu, 10 Oct 2013 21:30:49 +0200 Emil Ivov <emcho@jitsi.org> wrote:

Hey Philipp,

On 10.10.13, 20:07, Philipp Überbacher wrote:
> I'd appreciate
> it if you could tell me a public server that can do this.

You can try http://jit.si

> It's possible to explicitly set a STUN server in linphone, however,
> I could not find any such option in jitsi,

STUN server, TURN servers and Jingle Relay Nodes are set through the
account configuration.

> so I assumed it was somehow
> handled automagically.

It is, if properly configured on the domain that you are connecting
to (which is the case with jit.si).

> We haven't tried SIP through jitsi yet, but
> given that the public SIP-server we tried so far (linphone.org)
> suggests to use stunserver.org I assume that it doesn't support it
> directly.

We only support ICE, STUN, TURN and Jingle Relay nodes through XMPP.
SIP support is on the way but we currently rely on hosted NAT
traversal.

> Since it's apparently not possible to set such servers
> manually in jitsi I guess we're out of luck with SIP through
> jitsi as well.

Very few SIP deployments expect you to support ICE (contrary to
XMPP). You can try ippi.com or sip2sip.info, both of which will do
this for you.

> At least I've found the ICE-settings for XMPP now, but
> there are none for SIP.

Yup, already explained.

> I do see the usability issue as well, it requires a rather
> technically inclined person to make any sense of a message that
> just says 'ICE failed'. "I don't want icecream, I want to make a
> call!"

That's true ... still ... stating "impossible to establish a
connection with the other party through any of the routes we tried"
isn't going to be much more helpful.

Emil

#9

We tried XMPP through jit.si today and ICE worked, thanks a lot. We had
some problems, but it generally worked well enough to be usable.

Due to some video trouble we had an audio-only session of 1h45m until I
stopped hearing my partner. My partner could still hear me however.
I actually had to reboot to make it work again, and we had another
audio session of 1h10m until I ended it on purpose.
We had some trouble with video this time. Often enough, when I enabled
video, audio stopped working and I saw lots of errors in the console.
We also had some problem where I could see my partner and my own
picture, but my partner could see nothing.

We're both using jitsi 2.2, my partner on linux mint debian edition with
PulseAudio and behind what might be a NAT, and me on Arch Linux with
PortAudio behind a firewall that doesn't allow any incoming
connections.
I can provide some of my logs from today if they are of use.

Thanks again for jitsi, jit.si and your help.

Regards,
Philipp

···

On Thu, 10 Oct 2013 23:09:32 +0200 Philipp Überbacher <murks@tuxfamily.org> wrote:

On Thu, 10 Oct 2013 21:30:49 +0200 > Emil Ivov <emcho@jitsi.org> wrote:

> Hey Philipp,
>
> On 10.10.13, 20:07, Philipp Überbacher wrote:
> > I'd appreciate
> > it if you could tell me a public server that can do this.
>
> You can try http://jit.si
>
> > It's possible to explicitly set a STUN server in linphone,
> > however, I could not find any such option in jitsi,
>
> STUN server, TURN servers and Jingle Relay Nodes are set through
> the account configuration.
>
> > so I assumed it was somehow
> > handled automagically.
>
> It is, if properly configured on the domain that you are connecting
> to (which is the case with jit.si).
>
> > We haven't tried SIP through jitsi yet, but
> > given that the public SIP-server we tried so far (linphone.org)
> > suggests to use stunserver.org I assume that it doesn't support it
> > directly.
>
> We only support ICE, STUN, TURN and Jingle Relay nodes through XMPP.
> SIP support is on the way but we currently rely on hosted NAT
> traversal.
>
> > Since it's apparently not possible to set such servers
> > manually in jitsi I guess we're out of luck with SIP through
> > jitsi as well.
>
> Very few SIP deployments expect you to support ICE (contrary to
> XMPP). You can try ippi.com or sip2sip.info, both of which will do
> this for you.
>
> > At least I've found the ICE-settings for XMPP now, but
> > there are none for SIP.
>
> Yup, already explained.
>
> > I do see the usability issue as well, it requires a rather
> > technically inclined person to make any sense of a message that
> > just says 'ICE failed'. "I don't want icecream, I want to make a
> > call!"
>
> That's true ... still ... stating "impossible to establish a
> connection with the other party through any of the routes we tried"
> isn't going to be much more helpful.
>
> Emil

Thanks Emil,
I will try those servers once I can convince my partner to give this
another go.

Regards,
Philipp