- Shipped
- September 28, 2026 at 11:35 PM UTC
- Author
- Kamo
- Commit
- 1041497
FreePBX names its public address (pbx.k1.kluster.kamocrm.com) in the SDP and the Contact it gives livekit-sip, which is outside local_net, so RTP and in-dialog requests went through the router's hairpin NAT and arrived from k1m1's own public address, 47.181.8.84. The kamo-livekit-meet ACL refused those requests (FailedACL), and fail2ban banned 47.181.8.84 on 2026-09-28 at 22:59: from then on no RTP reached FreePBX from livekit-sip and every AI meeting leg ended at livekit-sip's media timeout (SP14 Task 31; the ban was lifted by hand). - kamo-livekit-meet: media_address=192.168.4.22, so RTP goes straight over the eno50 cable, as Jigasi's endpoint already does; and permit 47.181.8.84, whence its ACK and BYE come. - fail2ban: 47.181.8.84 and 47.181.8.87 (the nodes' own public addresses) join both allowlists.