Connection request timeout

I have installed Asterisk 11.11
Server is behind NAT and ports are forwarded correctly. If in sip.conf I DON’T show externip and nat, then asterisk successfully connects to the sip provider. But my clients with sip phones which are behind nat in other network can’t hear any sound. According to the wireshark dunp they send RTP packets to the internal IP of SIP sserver, i.e. SIP server does not receive them.

IF I do show externip and nat in the sip.conf my clients can here each other while making internal calls. But I cannot connect to sip provider with error connection request timeout error.

According to the tcpdump in first case in packet header in VIA field of REGISTER packet it gives its internal IP (which is correct because sip phone which I set for testing also shows internal IP in VIA field). In the second case in VIA field of REGISTER packet in shows the real static IP of NAT server. And thus, in my opinion, NAT server does not know where to send the packets that come back.

Has anyone else met the same problem? Or any hint which direction should I google?

----------------------------------------- NAT SUPPORT ------------------------
; WARNING: SIP operation behind a NAT is tricky and you really need
; to read and understand well the following section.
; When Asterisk is behind a NAT device, the “local” address (and port) that
; a socket is bound to has different values when seen from the inside or
; from the outside of the NATted network. Unfortunately this address must
; be communicated to the outside (e.g. in SIP and SDP messages), and in
; order to determine the correct value Asterisk needs to know:
; + whether it is talking to someone “inside” or “outside” of the NATted network.
; This is configured by assigning the “localnet” parameter with a list
; of network addresses that are considered “inside” of the NATted network.
; Multiple entries are allowed, e.g. a reasonable set is the following:
; localnet= ; RFC 1918 addresses
; localnet= ; Also RFC1918
; localnet= ; Another RFC1918 with CIDR notation
; localnet= ; Zero conf local network

; + the “externally visible” address and port number to be used when talking
; to a host outside the NAT. This information is derived by one of the
; following (mutually exclusive) config file parameters:
; a. “externaddr = hostname[:port]” specifies a static address[:port] to
; be used in SIP and SDP messages.
; The hostname is looked up only once, when [re]loading sip.conf .
; If a port number is not present, use the port specified in the “udpbindaddr”
; (which is not guaranteed to work correctly, because a NAT box might remap the
; port number as well as the address).
; This approach can be useful if you have a NAT device where you can
; configure the mapping statically. Examples:
; externaddr = ; use this address.
; externaddr = ; use this address and port.
; externaddr = ; Public address of my nat box.

read the … onf.sample