Registration fails when using a remote sip client

I can use PBX from local LAN. I can also receive SIP calls thru the net.
Instead, i’ve got problem when trying to register the sip client and i’m not onto the PBX LAN.

I get:

NOTICE: chan_sip.c:7708 handle_request: Registration from ‘sip:gallo-shphone@172.16.0.4’ failed for ‘HOME_PUBLIC_IP’

This is the PBX location:

OFFICE LAN <== 192.0.1.0/24 ==> PBX <== 172.16.0.4 ==> Firewall <==> 80.0.0.1 <== Internet ==> 62.0.0.1 <===> DSL Router <== Home ==> 10.0.0.0/24

Firewall is portforwarding UDP port 5060, 10000-12000 to the DMZ PBX IP. From home i can call sip:100@FW_PUBLIC_IP directly… but he give me that error if i try to register it instead

As client i use SjPhone + STUN and using a dinamyc DSL router with NAT but without any firewall.

Thi si my sip.conf, i’ve attacched sip debug logs also:

[general]
language=it
context=voip-inbound
port=5060
bindaddr=172.16.0.4
tos=lowdelay
canreinvite=no
videosupport=no

; Works
disallow=gsm
allow=alaw
allow=ulaw
dtmfmode=inband

nat=yes
srvlookup=no
externip = FIREWALLIP
localnet=192.168.1.0/255.255.255.0

[agallo]
context=interni
type=friend
username=agallo
secret=agallo
callerid=“Antonio Gallo” <201>
regexten=201
host=dynamic
canreinvite=no
qualify=yes
nat=yes

Sip read:
REGISTER sip:172.16.0.4 SIP/2.0
Via: SIP/2.0/UDP 62.0.0.1:49917;rport;branch=z9hG4bK0a0000030000001043bac9d40000586a00000001
Content-Length: 0
Contact: sip:agallo@10.0.0.3:5060
Call-ID: A3C2696D-69AC-4F29-96F1-0DE6DAAAED20@10.0.0.3
CSeq: 1 REGISTER
From: sip:agallo@172.16.0.4;tag=1654265612299
Max-Forwards: 70
To: sip:agallo@172.16.0.4
User-Agent: SJphone/1.60.289a (SJ Labs)

10 headers, 0 lines
Urgent handler

Sip read:
REGISTER sip:172.16.0.4 SIP/2.0
Via: SIP/2.0/UDP 62.0.0.1:49917;rport;branch=z9hG4bK0a0000030000001043bac9d4000023f500000004
Content-Length: 0
Contact: sip:agallo@10.0.0.3:5060
Call-ID: A3C2696D-69AC-4F29-96F1-0DE6DAAAED20@10.0.0.3
CSeq: 2 REGISTER
From: sip:agallo@172.16.0.4;tag=165427961757
Max-Forwards: 70
To: sip:agallo@172.16.0.4
User-Agent: SJphone/1.60.289a (SJ Labs)
Authorization: Digest username=“agallo”,realm=“asterisk”,nonce=“153ea438”,uri=“sip:172.16.0.4”,response=“9fc986f534bc3ac8ed8901df02cfa94e”

SIP/2.0 100 Trying
Via: SIP/2.0/UDP 62.0.0.1:49917;branch=z9hG4bK0a0000030000001043bac9d4000023f500000004;received=62.0.0.1;rport=5060
From: sip:agallo@172.16.0.4;tag=165427961757
To: sip:agallo@172.16.0.4;tag=as580bd78f
Call-ID: A3C2696D-69AC-4F29-96F1-0DE6DAAAED20@10.0.0.1
CSeq: 2 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER
Contact: sip:agallo@85.0.0.1
Content-Length: 0

to 62.0.0.1:5060
Transmitting (NAT):
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 62.0.0.1:49917;branch=z9hG4bK0a0000030000001043bac9d4000023f500000004;received=62.0.0.1;rport=5060
From: sip:agallo@172.16.0.4;tag=165427961757
To: sip:agallo@172.16.0.4;tag=as580bd78f
Call-ID: A3C2696D-69AC-4F29-96F1-0DE6DAAAED20@10.0.0.1
CSeq: 2 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER
Contact: sip:agallo@85.0.0.1
Content-Length: 0

EOF