Turn on OPTIONS pings by default for everyone, move gateways into /etc/freeswitch/gateways and allow ACL inclusions in /etc/freeswitch/acl.conf.xml

autoload_configs/acl.conf.xml

@@ -8,6 +8,7 @@
             <node type="allow" cidr="184.106.172.9/32"/>        <!--sipproxy001-prod-ord.2600hz.com-->
             <node type="allow" cidr="204.232.212.190/32"/>      <!--sipproxy002-prod-dfw.2600hz.com-->
             <node type="allow" cidr="216.82.224.202/32"/>        <!-- bandwidth.com-->
+            <X-PRE-PROCESS cmd="include" data="/etc/freeswitch/carriers.xml"/>
         </list>
         <list name="authoritative" default="deny">
             <node type="allow" cidr="184.106.157.174/32"/>      <!--sipproxy001-aa-ord.2600hz.com-->

opensips/opensips.tmp

@@ -331,17 +331,6 @@ route
         exit;
     }
 
-    # currently we dont support subscribe in whistle so to keep the noise down
-    # just end the request here.  For options just end the request here as well.
-    if (is_method("OPTIONS"))
-    {
-        xlog("L_NOTICE", "$ci|end|unsupported method");
-
-        sl_send_reply("503", "Rawr!!");
-
-        exit;
-    }
-
     # if the source IP/port are in one of the server dispatch lists
     # then this request originated from one of our media servers, mark it
     # as such by setting flag 26
@@ -361,6 +350,27 @@ route
         xlog("L_INFO", "$ci|log|originated from external sources");
     }
 
+    # we must forward SIP OPTIONS pings from FreeSWITCH to registered devices to keep NAT
+    # pinholes open. Someday we need to move this somewhere more reliable but this will
+    # do for now.
+    if (is_method("OPTIONS"))
+    {
+        if (isflagset(26))
+        {
+            xlog("L_INFO", "$ci|log|forwarding OPTIONS ping to endpoint");
+
+            route(internal_to_external_relay);
+        } else {
+            # this request came from an external device to us. Reject it
+            xlog("L_NOTICE", "$ci|end|unsupported method");
+
+            sl_send_reply("503", "Rawr!!");
+
+        }
+
+        exit;
+    }
+
     # if the to header has a tag attached then it implies this request
     # has been processed by us before (IE: a media server has added
     # its tag on the to header in prior messages)

sip_profiles/internal.xml

@@ -117,7 +117,7 @@
 
             <!-- NAT -->
             <!--<param name="nat-options-ping" value="true"/>-->
-            <!--<param name="all-reg-options-ping" value="true"/>-->
+            <param name="all-reg-options-ping" value="true"/>
             <!--<param name="unregister-on-options-fail" value="true"/>-->
             <!--<param name="aggressive-nat-detection" value="true"/>-->
             <!--<param name="NDLB-force-rport" value="safe"/>-->
@@ -179,7 +179,7 @@
             <param name="log-auth-failures" value="true"/>
         </settings>
         <gateways>
-            <X-PRE-PROCESS cmd="include" data="gateways/*.xml"/>
+            <X-PRE-PROCESS cmd="include" data="/etc/freeswitch/gateways/*.xml"/>
         </gateways>
     </profile>
 </include>