Making your SIP Phone work with your Fedora Router

I've finally gotten myself a SIP hardware phone after testdriving several softphones and finding each lacking. Even ekiga (formerly known as gnomemeeting) doesn't really satisfy:
Nearly no debugging output, meaning I have to whip up ethereal all the time, and many crashes when shutting down the app are not really strong points.

Anyway, I chose a Snom 360 SIP-phone after finding out, that the device is running an embedded Linux. Unfortunately, the company is turning from completely open firmware versions to gpl source and lots and lots of binary-only userspace daemons. However, there is a project trying to write a replacement firmware for the Snom 360.

After connecting the phone the the local network and seting up some external sip providers, one quickly notices the problems NAT is posing for SIP. When not configuring a STUN Server and a RTP Proxy the signalling of your call succeeds, but you will not be able to hear anything.
Bummer.

Luckily there exists a nat-helper module for iptables, allowing your router to track and modify the SIP packets and thus letting the audio packets through the nat and the firewall.
Unfortunately this module is not yet included in the main kernel but only available in the Netfilter Patch-O-Matic.

However, with the help of the new kmodhelper building external modules for your Fedora kernel is no big deal anymore. Simply download sip-conntrack-nat-kmod-0-1.20060717svn.2.6.17_1.2157_FC5.src.rpm and rebuild the module for your kernel version:

[andreas@bofh ~]$ rpmbuild --rebuild sip-conntrack-nat-kmod-0-1.20060717svn.2.6.17_1.2157_FC5.src.rpm \
        --target=$(uname -m) --define "kversion $(uname -r)"
Installing sip-conntrack-nat-kmod-0-1.20060717svn.2.6.17_1.2157_FC5.src.rpm
Building target platforms: i686
Building for target i686
...
Wrote: /home/andreas/fedora/redhat/RPMS/i686/kmod-sip-conntrack-nat-0-1.20060717svn
       2.6.17_1.2157_FC5.i686.rpm
Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.23234
+ umask 022
+ cd /home/andreas/fedora/redhat/BUILD
+ cd smixer
+ rm -rf /var/tmp/smixer-1.0.4-1-root-andreas
+ exit 0
[andreas@bofh ~]$

All that is left to do is edit /etc/sysconfig/iptables-config to load your newly installed module.

# Load additional iptables modules (nat helpers)
#   Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES="ip_nat_sip ip_nat_ftp ip_nat_h323 ip_nat_irc"
...