Strange Asterisk and NAT issue

Hello to everyone,
I have a strange issue with my home Asterisk server (Linux based).
My home network has a public IP address (let’s call it PPP.PPP.PPP.PPP) associated to the router and an internal (10.X.X.X) based network.
Asterisk is installed on my Linux server which has internal IP (10.0.0.1), I also have two Windows PCs on the internal network with IP 10.0.0.2 and 10.0.0.3. The router is configured to forward all traffic coming from outside (TCP&UDP) to my server (10.0.0.1). This is how I configured Asterisk:

[size=150]sip.conf[/size]

[quote][general]
context=default
allowguest=no
udpbindaddr=0.0.0.0:6060
tcpenable=yes
tcpbindaddr=0.0.0.0:6060
transport=tcp,udp
qualify=yes
disallow=all
allow=alaw
allow=gsm
language=it
externip=PPP.PPP.PPP.PPP
localnet=10.0.0.0/255.0.0.0
nat=force_rport,comedia
directmedia=no
alwaysauthreject=yes
register => 12345:johndoe@sip.myvoipprovider.it/myvoipprovider

[myvoipprovider]
type=peer
host=sip.myvoipprovider.it
context=incoming
secret=johndoe
defaultuser=12345
fromuser=12345
fromdomain=sip.myvoipprovider.it
insecure=port,invite

[6000]
type=friend
host=dynamic
context=full
callerid=UserMain <6000>
secret=PasswordMain

[6001]
type=friend
host=dynamic
context=full
callerid=User1 <6001>
secret=Password1
rtptimeout=60
rtpholdtimeout=300

[6002]
type=friend
host=dynamic
context=full
callerid=User2 <6002>
secret=Password2
rtptimeout=60
rtpholdtimeout=300

[6003]
type=friend
host=dynamic
context=full
callerid=User3 <6003>
secret=Password3
rtptimeout=60
rtpholdtimeout=300

[6004]
type=friend
host=dynamic
context=guest
callerid=UserGuest <6010>
secret=PasswordGuest
rtptimeout=60
rtpholdtimeout=300[/quote]

[size=150]extensions.conf[/size]

[quote]; Contexts
[full]
include => applications
include => internal
include => external

[guest]
include => applications
include => internal
include => forbidden

; Incoming calls
[incoming]
exten => cheapnet,1,Dial(SIP/6000&SIP/6001&SIP/6002&SIP/6003,60)
exten => cheapnet,n,Hangup()

; Outgoing calls
[internal]
exten => _6XXX,1,Dial(SIP/${EXTEN},60)
exten => _6XXX,n,Hangup()

[external]
exten => _[+0-9]!,1,Dial(SIP/${EXTEN}@myvoipprovider)
exten => _[+0-9]!,n,Hangup()

[forbidden]
exten => _[+0-9]!,1,Macro(playback,privacy-incorrect)
exten => _[+0-9]!,n,Hangup()

; Applications
[applications]
exten => 7000,1,Macro(playback,demo-echotest)
exten => 7000,n,Echo()
exten => 7000,n,Macro(playback,demo-echodone)
exten => 7000,n,Hangup()

; Macros
[macro-playback]
exten => s,1,Wait(1)
exten => s,n,Playback(${ARG1})
exten => s,n,Wait(1)[/quote]

Here is the strange issue:
If I connect with a SIP client from one of my PCs on the internal network everything works fine. I can place internal calls (600X), use the Echo test (7000) or place an outbound call.

If I connect to my server from a PC or mobile phone on the public Internet I can call an internal number (600X) or place an outbound call without issues. If I try to use the Echo test the call is answered and a channel created… but I can not hear anything… and if I hang the call on the client the channel remains open until the “rtptimeout” is reached… if I don’t set “rtptimeout” the channel stays open forever (or until I kill it using the console). Looks like after answering the call every communication from the client and to the client is lost. This doesn’t happen if place a “standard” call to another internal client or the outbound VOIP provider.

Can anyone explain this strange behaviour ?

Thanks in advance.

After some testing I found the issue is limited to TCP connections. If I use UDP on my clients everything works perfectly. Unfortunately I need TCP on my mobile phone or I’ll drain battery too fast. Is there anything which prevents SIP to work with TCP when both server and client are behind NAT ?