sip.example.com is an external IP address, and DNS resolves it as such.
However, if Asterisk hangs up the call, it sends the BYE request to the external address of sip.example.com, meaning that Kamailio in turn attempts to route the 200 OK to the Asterisk Servers External IP (which is blocked by the firewall).
I realize that this is probably because the RR header specifies that this is the route messages should take.
However, is there any way to make PJSIP do what chan_sip did, and always respond to the IP address it received the INVITE from?
I can make it work by overriding sip.example.com in the hosts file on the asterisk server, but that’s not a preferred solution if it can be configured better.
The SIP log would also be useful (pjsip set logger on) to better understand the signaling. Generally, though, we don’t have an option specifically for this as it goes against the SIP spec.
Having stared myself blind at trying to solve this with PJSIP configuration, I feel silly now.
It was easy to address this issue in Kamailio. Should anyone have this issue: the record_route_advertised_address method in the Kamailio RR module makes it easy to enter whatever you need in the Record-Route header.
My apologies, and thank you for the fast response none the less!