Skip to main content
Public security bureaus, procuratorates, courts, government agencies, and similar organizations separate their internal network from the public internet with a cross-domain solution (CDS), which controls what may pass between security domains. The CDS only allows specific business protocols and doesn’t let ordinary TCP / UDP pass through directly, so the audio and video platform’s APIs, signaling, and media streams can’t get across. On site, the CDS usually already has an RTSP video service channel open. Our solution takes advantage of this: a tunnel gateway sits on each side of the CDS and wraps the platform’s traffic in standard RTSP sessions to cross it, restoring it on the other side. Users on the public internet and on the internal network can then talk to each other in the same meeting.

​
Deployment architecture

​
How it works

  • APIs and signaling (TCP): for each connection a public-internet user opens, the outer gateway opens an RTSP session carried over RTSP over TCP, for reliable, ordered delivery
  • Audio and video (UDP): when the outer gateway receives a user’s first media packet, it opens an RTSP session carried over RTP over UDP, for real-time delivery
  • Once a session is established, traffic flows both ways, and the platform’s responses return the same way

​
Highlights

​
Prerequisites

​
Usage notes

Users on the public internet must explicitly use the “public internet” line. After passing through the gateways, the platform sees the gateway as the source address instead of the user, so it can’t tell the internal network from the public internet by IP. Your business system must keep users coming through the public-internet entry on the public-internet line (for example, by access domain); otherwise they enter meetings with no video.
  • Content auditing: data passes through encrypted end to end, and the CDS sees only the RTSP / RTP wrapping, not the business content. If the customer requires the CDS to audit content, discuss it in advance
  • Source IP: in platform logs, public-internet users’ source addresses appear as the gateway address
  • Capacity planning: each public-internet user takes about 2 media sessions and 3–4 API connections; we recommend a load test before large-scale rollout
  • Implementation: CDS traversal is implemented per project and requires us, the customer, and the CDS vendor to agree on ports and policies; contact us