NAT problem with SIP client behind locked NAT

Hello.
I have a SIP client on a device which is mostly behind a NAT whichever I do not have control over.

Then I have a NAT in front of the asterisk server.

The red NAT whichever I cannot access for configuration, does ONLY allow outgoing requests, and theres no way to open incoming ports in that NAT.

The green NAT have port 5060 TCP & UDP forwarded to inside.

The sip.conf entry for that device is:

[mobile]
type=friend
username=mobile
nat=yes
qualify=yes
secret= Note the password does not contain spaces, I just dont want to show it here
host=dynamic
context=mobile
deny=0.0.0.0/0.0.0.0
permit=46.194.0.0/255.255.0.0

And the log is as following:

== Using SIP RTP CoS mark 5
– Executing [9@mobile:1] Goto(“SIP/mobile-00000000”, “mobile,s,1”) in new stack
– Goto (mobile,s,1)
– Executing [s@mobile:1] Answer(“SIP/mobile-00000000”, “”) in new stack
– Executing [s@mobile:2] Set(“SIP/mobile-00000000”, “queueid=1751894”) in new stack
– Executing [s@mobile:3] Set(“SIP/mobile-00000000”, “check=admin:none:none”) in new stack
– Executing [s@mobile:4] Goto(“SIP/mobile-00000000”, “admin,s,1”) in new stack
– Goto (admin,s,1)
– Executing [s@admin:1] Read(“SIP/mobile-00000000”, “phonenum,“vm-enter-num-to-call&then-press-pound””) in new stack
– <SIP/mobile-00000000> Playing ‘vm-enter-num-to-call.gsm’ (language ‘se’)
– <SIP/mobile-00000000> Playing ‘then-press-pound.gsm’ (language ‘se’)
– User entered nothing.
– Executing [s@admin:2] Set(“SIP/mobile-00000000”, “check=dialadmin::none”) in new stack
– Executing [s@admin:3] Goto(“SIP/mobile-00000000”, “dialadmin,s,1”) in new stack
– Goto (dialadmin,s,1)
– Executing [s@dialadmin:1] Monitor(“SIP/mobile-00000000”, “wav,”/var/secure_files/voip/recordings/outgoing/–20110904023236-5745–mobile",m") in new stack
– Executing [s@dialadmin:2] Dial(“SIP/mobile-00000000”, ““SIP/@telavox””) in new stack
Agent policy for SIP/mobile-00000000 is ‘never’. CC not possible
== Using SIP RTP CoS mark 5
– Called @telavox
– Got SIP response 603 “Declined” back from 80.83.208.40:5060
– SIP/telavox-00000001 is busy
== Everyone is busy/congested at this time (1:1/0/0)
Timeout, but no rule ‘t’ in context ‘dialadmin’
– Executing [h@dialadmin:1] Set(“SIP/mobile-00000000”, “hangupvar=none:none:none”) in new stack
Retransmission timeout reached on transmission 2cwRYQ6iTgrQ19Y30cEbaFl5JN-DISaE for seqno 17954 (Critical Response) – See wiki.asterisk.org/wiki/display/ … nsmissions
Packet timed out after 46527ms with no response
Peer ‘mobile’ is now Lagged. (3093ms / 2000ms)
Peer ‘mobile’ is now Reachable. (842ms / 2000ms)
> Saved useragent “CSipSimple r944 / GT-I9100-10” for peer mobile
Peer ‘mobile’ is now Lagged. (2885ms / 2000ms)
Peer ‘mobile’ is now Reachable. (95ms / 2000ms)
Peer ‘mobile’ is now Lagged. (3044ms / 2000ms)
Peer ‘mobile’ is now Reachable. (815ms / 2000ms)
Peer ‘mobile’ is now UNREACHABLE! Last qualify: 815
Peer ‘mobile’ is now Reachable. (897ms / 2000ms)
Peer ‘mobile’ is now Lagged. (2587ms / 2000ms)
Peer ‘mobile’ is now Reachable. (832ms / 2000ms)
Peer ‘mobile’ is now Lagged. (2771ms / 2000ms)
Peer ‘mobile’ is now Reachable. (839ms / 2000ms)
Peer ‘mobile’ is now Lagged. (2823ms / 2000ms)
Peer ‘mobile’ is now Reachable. (815ms / 2000ms)

The client registers sucessfully, but I don’t hear anything, even when these lines execute:
– <SIP/mobile-00000000> Playing ‘vm-enter-num-to-call.gsm’ (language ‘se’)
– <SIP/mobile-00000000> Playing ‘then-press-pound.gsm’ (language ‘se’)

The client supports ICE and STUN. Guess I need to set up a STUN server inside the green NAT (on the same box as asterisk) and then configure STUN inside SIP client on device “mobile”? Then how should I configure asterisk to talk to STUN server, and which ports should I forward in the green NAT?