Directmedia deny / permit

Hi all,

I don’t understand well the policy behind the directmedia setup.
I have a asterisk pbx in to the network 192.168.50.0 and in the same network I have 2 extension
I use this pbx for manage 2 remote phone that are in 2 other network connected in VPN to the local network.
First net is 192.168.1.0 and second is 192.168.3.0

Now I can configure the directmedia=no and force all the media stream to usa the pbx but i f I try to permit only the network 192.168.1.0 to directmedia all the communication became direct.

SIP.CONF
[general]
context=unauthenticate
allowguest=no
srvlookup=yes
externalip=XXX.XXX.XXX.XXX
localnet=192.168.50.0/24
udpbindaddr=0.0.0.0
udpbindport=5060
tcpenable=no
callcounter=yes

;directmedia=no
directmediadeny=0.0.0.0/0
directmediapermit=192.168.1.0/24

disallow=all
allow=g722
allow=ulaw
allow=alaw
allow=gsm

[interni](!)
type = friend
context = interni
host = dynamic
qualify = yes
dtmfmode = rfc2833
callgroup=1
pickupgroup=1

[digium-d40](interni)
secret = xxxxxxxxxx
callerid = Office <100>
mailbox = 100@default

[casa-softphone](interni)
secret = xxxxxxxxxxx
callerid = Andrea Cordless <104>
mailbox = 104@default

The peer casa-softphone are in the network 192.168.3.0 but with this configuration it use the direct media whit phone that are in the 192.168.50.0

What I’m not understanding?

I need to permit the directmedia from 192.168.50.0 to 192.168.1.0 and not from all to all like now