Problem with NAT from outside SIP phones

Hi, I have the following environment :

Asterisk 15 (ethernet interface with public address -190.64.204.60) ---- FW (provider) ------------- INTERNET ---- SOHO Routers --NAT/FW----LAN Softphone (type A)
INTERNET ---- Mobile---- Softpone (type B)

Asterisk 15.6, on Centos 7, behind a firewall (VPS provider), with sip ports tcp/udp 5560 already opened, and no NAT.
I have two type of SIP devices:
Type A) connected to a LAN network behind a router/firewall, with nat/upnp enabled
Type B) connected through the mobile network, also nat enabled by the mobile provider.
Both types of endpoints registered ok, the call is established but there is no audio / video.
I tested it with asterisk and softphones in the sameb LAN network and did work!
I want to bypass asterisk, for the media communication,so the media go between the caller and callee directly.
This is my sip.conf:

[general]
context=internal
allowguest=no
udpbindaddr=190.64.204.60
bindport=5560
srvlookup=no
directrtpsetup=yes

[anacelia]
type=friend
host=dynamic
dtmfmode=auto
secret=xxxxxx
videosupport=yes
disallow=all
allow=ulaw
allow=h264
nat=yes
qualify=yes
direct_media=yes
rewrite_contact=yes
rtp_symmetric=yes

[portero]
type=friend
host=dynamic
dtmfmode=auto
secret=xxxxxx
videosupport=yes
nat=yes
qualify=yes
direct_media=yes
rtp_symmetric=yes
rewrite_contact=yes
disallow=all
allow=ulaw
allow=h264

And this is the asterisk sip log:

Name/username Host Dyn Forcerport Comedia ACL Port Status Description
anacelia/anacelia 179.28.196.220 D Yes Yes 16522 OK (478 ms)
portero/portero 167.61.58.160 D Yes Yes 5560 OK (8 ms)
2 sip peers [Monitored: 2 online, 0 offline Unmonitored: 0 online, 0 offline]

== Using SIP VIDEO CoS mark 6
== Using SIP RTP CoS mark 5
> 0x7f4a48025c70 – Strict RTP learning after remote address set to: 10.72.228.101:7076
> 0x7f4a4801ff50 – Strict RTP learning after remote address set to: 10.72.228.101:9078
– Executing [portero@internal:1] Answer(“SIP/anacelia-0000003f”, “”) in new stack
– Executing [portero@internal:2] Dial(“SIP/anacelia-0000003f”, “SIP/portero,60”) in new stack
== Using SIP VIDEO CoS mark 6
== Using SIP RTP CoS mark 5
– Called SIP/portero
– SIP/portero-00000040 is ringing
> 0x7f4a48025c70 – Strict RTP learning after remote address set to: 10.72.228.101:7076
> 0x7f4a4801ff50 – Strict RTP learning after remote address set to: 10.72.228.101:9078
> 0x7f4a28022d80 – Strict RTP learning after remote address set to: 167.61.58.160:4008
> 0x7f4a280263e0 – Strict RTP learning after remote address set to: 167.61.58.160:4010
– SIP/portero-00000040 answered SIP/anacelia-0000003f
– Channel SIP/portero-00000040 joined ‘simple_bridge’ basic-bridge <6d7d348a-45e3-4002-8f98-d58a10269761>
– Channel SIP/anacelia-0000003f joined ‘simple_bridge’ basic-bridge <6d7d348a-45e3-4002-8f98-d58a10269761>
> Bridge 6d7d348a-45e3-4002-8f98-d58a10269761: switching from simple_bridge technology to native_rtp
> Remotely bridged ‘SIP/anacelia-0000003f’ and ‘SIP/portero-00000040’ - media will flow directly between them
> 0x7f4a48025c70 – Strict RTP learning after remote address set to: 10.72.228.101:7076
> 0x7f4a4801ff50 – Strict RTP learning after remote address set to: 10.72.228.101:9078
– Channel SIP/anacelia-0000003f left ‘native_rtp’ basic-bridge <6d7d348a-45e3-4002-8f98-d58a10269761>
– Channel SIP/portero-00000040 left ‘native_rtp’ basic-bridge <6d7d348a-45e3-4002-8f98-d58a10269761>
== Spawn extension (internal, portero, 2) exited non-zero on ‘SIP/anacelia-0000003f’

The remote address 10.72.228.101 is the mobile natted address, and It seems the problem, it must be the public, but I don’t know how to resolve it.
Thanks a lot for your help!.
Regards, Ana

You don’t have any of the primary NAT configuration options set, the ones that allow Asterisk to work out its external address.

Are you sure the peers are capable of routing directly to each other?

One of the peers appears to have a private address, in which case it is never going to be reachable directly from the other.

Yes, this peer that appeared with the network 10.72.228.101 is the mobile with a public address 179.28.196.220,

Name/username Host Dyn Forcerport Comedia ACL Port Status Description

anacelia/anacelia 179.28.196.220 D Yes Yes 15012 OK (320 ms)

portero/portero 167.61.58.160 D Yes Yes 5560 OK (9 ms)

This is the tcpdump from asterisk server:

`MINVITE sip:portero@190.64.204.60 SIP/2.0

Via: SIP/2.0/UDP 10.72.228.101:5560;branch=z9hG4bK.~6ndFC8aY;rport