# Problem with NAT from outside SIP phones **URL:** \ **Category:** Asterisk SIP\ **Created:** [September 18, 2018, 4:11pm UTC](https://community.asterisk.org/t/problem-with-nat-from-outside-sip-phones/76199 "2018-09-18T16:11:37Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![anacelia2018](https://avatars.discourse-cdn.com/v4/letter/a/b9e5f3/32.png) [@anacelia2018](https://community.asterisk.org/u/anacelia2018)\ **Post date:** [September 18, 2018, 4:11pm UTC](https://community.asterisk.org/t/problem-with-nat-from-outside-sip-phones/76199/1 "2018-09-18T16:11:37Z")
Hi, I have the following environment : Asterisk 15 (ethernet interface with public address -190.64.204.60) ---- FW (provider) ------------- INTERNET ---- SOHO Routers --NAT/FW----LAN Softphone (type A) INTERNET ---- Mobile---- Softpone (type B) Asterisk 15.6, on Centos 7, behind a firewall (VPS provider), with sip ports tcp/udp 5560 already opened, and no NAT. I have two type of SIP devices: Type A) connected to a LAN network behind a router/firewall, with nat/upnp enabled Type B) connected through the mobile network, also nat enabled by the mobile provider. Both types of endpoints registered ok, the call is established but there is no audio / video. I tested it with asterisk and softphones in the sameb LAN network and did work! I want to bypass asterisk, for the media communication,so the media go between the caller and callee directly. This is my sip.conf: [general] context=internal allowguest=no udpbindaddr=190.64.204.60 bindport=5560 srvlookup=no directrtpsetup=yes [anacelia] type=friend host=dynamic dtmfmode=auto secret=xxxxxx videosupport=yes disallow=all allow=ulaw allow=h264 nat=yes qualify=yes direct\_media=yes rewrite\_contact=yes rtp\_symmetric=yes [portero] type=friend host=dynamic dtmfmode=auto secret=xxxxxx videosupport=yes nat=yes qualify=yes direct\_media=yes rtp\_symmetric=yes rewrite\_contact=yes disallow=all allow=ulaw allow=h264 And this is the asterisk sip log: Name/username Host Dyn Forcerport Comedia ACL Port Status Description anacelia/anacelia 179.28.196.220 D Yes Yes 16522 OK (478 ms) portero/portero 167.61.58.160 D Yes Yes 5560 OK (8 ms) 2 sip peers [Monitored: 2 online, 0 offline Unmonitored: 0 online, 0 offline] == Using SIP VIDEO CoS mark 6 == Using SIP RTP CoS mark 5 \> 0x7f4a48025c70 – Strict RTP learning after remote address set to: 10.72.228.101:7076 \> 0x7f4a4801ff50 – Strict RTP learning after remote address set to: 10.72.228.101:9078 – Executing [portero@internal:1] Answer(“SIP/anacelia-0000003f”, “”) in new stack – Executing [portero@internal:2] Dial(“SIP/anacelia-0000003f”, “SIP/portero,60”) in new stack == Using SIP VIDEO CoS mark 6 == Using SIP RTP CoS mark 5 – Called SIP/portero – SIP/portero-00000040 is ringing \> 0x7f4a48025c70 – Strict RTP learning after remote address set to: 10.72.228.101:7076 \> 0x7f4a4801ff50 – Strict RTP learning after remote address set to: 10.72.228.101:9078 \> 0x7f4a28022d80 – Strict RTP learning after remote address set to: 167.61.58.160:4008 \> 0x7f4a280263e0 – Strict RTP learning after remote address set to: 167.61.58.160:4010 – SIP/portero-00000040 answered SIP/anacelia-0000003f – Channel SIP/portero-00000040 joined ‘simple\_bridge’ basic-bridge \<6d7d348a-45e3-4002-8f98-d58a10269761\> – Channel SIP/anacelia-0000003f joined ‘simple\_bridge’ basic-bridge \<6d7d348a-45e3-4002-8f98-d58a10269761\> \> Bridge 6d7d348a-45e3-4002-8f98-d58a10269761: switching from simple\_bridge technology to native\_rtp \> Remotely bridged ‘SIP/anacelia-0000003f’ and ‘SIP/portero-00000040’ - media will flow directly between them \> 0x7f4a48025c70 – Strict RTP learning after remote address set to: 10.72.228.101:7076 \> 0x7f4a4801ff50 – Strict RTP learning after remote address set to: 10.72.228.101:9078 – Channel SIP/anacelia-0000003f left ‘native\_rtp’ basic-bridge \<6d7d348a-45e3-4002-8f98-d58a10269761\> – Channel SIP/portero-00000040 left ‘native\_rtp’ basic-bridge \<6d7d348a-45e3-4002-8f98-d58a10269761\> == Spawn extension (internal, portero, 2) exited non-zero on ‘SIP/anacelia-0000003f’ The remote address 10.72.228.101 is the mobile natted address, and It seems the problem, it must be the public, but I don’t know how to resolve it. Thanks a lot for your help!. Regards, Ana ---
**Author:** ![david551](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@david551](https://community.asterisk.org/u/david551)\ **Post date:** [September 18, 2018, 4:26pm UTC](https://community.asterisk.org/t/problem-with-nat-from-outside-sip-phones/76199/2 "2018-09-18T16:26:38Z")
You don’t have any of the primary NAT configuration options set, the ones that allow Asterisk to work out its external address. Are you sure the peers are capable of routing directly to each other? One of the peers appears to have a private address, in which case it is never going to be reachable directly from the other. ---
**Author:** ![anacelia2018](https://avatars.discourse-cdn.com/v4/letter/a/b9e5f3/32.png) [@anacelia2018](https://community.asterisk.org/u/anacelia2018)\ **Post date:** [September 18, 2018, 5:09pm UTC](https://community.asterisk.org/t/problem-with-nat-from-outside-sip-phones/76199/3 "2018-09-18T17:09:40Z")
Yes, this peer that appeared with the network 10.72.228.101 is the mobile with a public address 179.28.196.220, Name/username Host Dyn Forcerport Comedia ACL Port Status Description anacelia/anacelia 179.28.196.220 D Yes Yes 15012 OK (320 ms) portero/portero 167.61.58.160 D Yes Yes 5560 OK (9 ms) This is the tcpdump from asterisk server: `MINVITE [sip:portero@190.64.204.60](mailto:sip:portero@190.64.204.60) SIP/2.0 Via: SIP/2.0/UDP 10.72.228.101:5560;branch=z9hG4bK.~6ndFC8aY;rport