Hello Everyone,
I'm having some trouble getting my SIP setup to work properly.
📞 My Call Flow:
SIP Client initiates a call
The call reaches my router, which forwards it to
Kamailio + RTPengine running on 192.168.1.75:5060, which then forwards it to
A Kubernetes machine at 192.168.1.190:32210, where Asterisk is running
🔧 Network Setup:
Router has the following ports forwarded:
UDP 5060
UDP 10000–20000 (for RTP)
STUN is enabled on the SIP client
✅ What Works:
When I’m connected through a VPN (i.e., inside the local network), everything works fine — both incoming and outgoing audio.
❌ The Problem:
When calling from outside the network, signaling works and the call connects, but I can’t receive or send any audio.
Here is a little of my config of kamailio
modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:2223")
modparam("rtpengine", "setid_avp", "$avp(setid)")
listen=udp:192.168.1.75:5060 advertise 62.2x.xxx.xxx:5060
listen=tcp:192.168.1.75:5060 advertise 62.2x.xxx.xxx:5060
listen=udp:127.0.0.1:5060
#Nat Helper
modparam("nathelper", "force_socket", "192.168.1.75:5060")
modparam("nathelper", "natping_interval", 10)
modparam("nathelper", "ping_nated_only", 0)
modparam("nathelper", "nat_addr_mode", 1)
request_route{
...
route(init);
...
if(is_method("INVITE|ACK|BYE|CANCEL|OPTIONS|INFO|UPDATE|PRACK"))\{
route(handle_sip);
exit;
}
}
route[init]{
...
if (nat_uac_test("19")){
setflag(FLT_NAT);
fix_nated_contact();
force_rport();
}
}
route[handle_sip]{
if ($rm == "INVITE"){
if (isflagset(FLT_NAT)){
route(natmanage);
}
if (!ds_select_dst("1", "4")){
sl_send_reply("500", "No destination");
exit;
}
$ru = "sip:" + $rU + "@" + $rd; # Keeps sip:100@domain
$du = "sip:192.168.1.190:32210"; # Matches your dispatcher list
route(relay);
}
if ($rm == "BYE" || $rm == "CANCEL"){
if (isflagset(FLT_NAT)){
rtpengine_delete();
}
route(relay);
}
if ($rm == "ACK"){
if (isflagset(FLT_NAT)){
route(natmanage);
}
route(relay);
}
route(relay);
}
route[natmanage]{
if (is_request()){
if (has_body("application/sdp")){
rtpengine_offer("replace-origin replace-session-connection ICE=remove");
}
force_rport();
fix_nated_contact();
}else{
rtpengine_answer("replace-origin replace-session-connection ICE=remove");
}
}
rtpengine.conf
[rtpengine]
table = 0
interface = internal/192.168.1.75
listen-ng = 127.0.0.1:2223
log-level = 7
timeout = 60
silent-timeout = 3600
tos = 184
port-min = 10000
port-max = 40000
And here are some logs when I call from outside
2025/04/13 15:58:33.407265 2.8x.xx.xxx:59396 -> 192.168.1.75:5060
INVITE sip:100@192.168.1.75:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.116:59396;rport;branch=z9hG4bKPj92490d6b6d0c4cd88dac9f0043b1642e
Max-Forwards: 70
From: "6001" <sip:6005@192.168.1.75:5060>;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: <sip:100@192.168.1.75:5060>
Contact: "6001" <sip:6005@192.168.1.116:59396;ob>;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8963 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Content-Type: application/sdp
Content-Length: 537
v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.116
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 4032 RTP/AVP 8 0 101
c=IN IP4 192.168.1.116
b=TIAS:64000
a=rtcp:4017 IN IP4 192.168.1.116
a=sendrecv
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ssrc:1567952351 cname:73284f1717045a81
a=ice-ufrag:37e51dc0
a=ice-pwd:49f7442b5078148140877b44
a=candidate:Hc0a80174 1 UDP 2130706431 192.168.1.116 4032 typ host
a=candidate:Hc0a80174 2 UDP 2130706430 192.168.1.116 4017 typ host
2025/04/13 15:58:33.412683 192.168.1.75:5060 -> 192.168.1.190:32210
INVITE sip:100@192.168.1.75 SIP/2.0
Via: SIP/2.0/UDP 62.2x.2xx.xxx:5060;branch=z9hG4bK6362.26a75297a4ccf4984dd1f68644c2148f.0
Via: SIP/2.0/UDP 192.168.1.116:59396;received=2.8x.xx.xxx;rport=59396;branch=z9hG4bKPj92490d6b6d0c4cd88dac9f0043b1642e
Max-Forwards: 69
From: "6001" <sip:6005@192.168.1.75:5060>;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: <sip:100@192.168.1.75:5060>
Contact: "6001" <sip:6005@2.8x.xx.xxx:59396;ob>;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8963 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Content-Type: application/sdp
Content-Length: 322
v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.75
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 12156 RTP/AVP 8 0 101
c=IN IP4 192.168.1.75
b=TIAS:64000
a=ssrc:1567952351 cname:73284f1717045a81
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv
a=rtcp:12157
2025/04/13 15:58:33.428169 2.8x.xx.xxx:59396 -> 192.168.1.75:5060
INVITE sip:100@192.168.1.75:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.116:59396;rport;branch=z9hG4bKPj14c6f24b814e4d158014cc80b1fa5f8f
Max-Forwards: 70
From: "6001" <sip:6005@192.168.1.75:5060>;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: <sip:100@192.168.1.75:5060>
Contact: "6001" <sip:6005@192.168.1.116:59396;ob>;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8964 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Authorization: Digest username="6005", realm="asterisk", nonce="1744559913/dab8894e3f31e038d7a969a6349a11c2", uri="sip:100@62.2x.2xx.xxx", response="2ce500d6a1583f05f6344bdf1f712fc7", algorithm=MD5, cnonce="808fc766135d40589dd68032bcaab5c6", opaque="2232aa9c42080f12", qop=auth, nc=00000001
Content-Type: application/sdp
Content-Length: 537
v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.116
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 4032 RTP/AVP 8 0 101
c=IN IP4 192.168.1.116
b=TIAS:64000
a=rtcp:4017 IN IP4 192.168.1.116
a=sendrecv
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ssrc:1567952351 cname:73284f1717045a81
a=ice-ufrag:37e51dc0
a=ice-pwd:49f7442b5078148140877b44
a=candidate:Hc0a80174 1 UDP 2130706431 192.168.1.116 4032 typ host
a=candidate:Hc0a80174 2 UDP 2130706430 192.168.1.116 4017 typ host
2025/04/13 15:58:33.430593 192.168.1.75:5060 -> 2.8x.xx.xxx:59396
SIP/2.0 100 trying -- your call is important to us
Via: SIP/2.0/UDP 192.168.1.116:59396;rport=59396;branch=z9hG4bKPj14c6f24b814e4d158014cc80b1fa5f8f;received=2.8x.xx.xxx
From: "6001" <sip:6005@192.168.1.75:5060>;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: <sip:100@192.168.1.75:5060>
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8964 INVITE
Server: kamailio (5.7.4 (x86_64/linux))
Content-Length: 0
2025/04/13 15:58:33.461894 192.168.1.75:5060 -> 192.168.1.190:32210
INVITE sip:100@192.168.1.75 SIP/2.0
Via: SIP/2.0/UDP 62.2x.2xx.xxx:5060;branch=z9hG4bK3362.72f5db87deeeccee7fea924753af3da0.0
Via: SIP/2.0/UDP 192.168.1.116:59396;received=2.8x.xx.xxx;rport=59396;branch=z9hG4bKPj14c6f24b814e4d158014cc80b1fa5f8f
Max-Forwards: 69
From: "6001" <sip:6005@192.168.1.75:5060>;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: <sip:100@192.168.1.75:5060>
Contact: "6001" <sip:6005@2.8x.xx.xxx:59396;ob>;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8964 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Authorization: Digest username="6005", realm="asterisk", nonce="1744559913/dab8894e3f31e038d7a969a6349a11c2", uri="sip:100@62.2x.2xx.xxx", response="2ce500d6a1583f05f6344bdf1f712fc7", algorithm=MD5, cnonce="808fc766135d40589dd68032bcaab5c6", opaque="2232aa9c42080f12", qop=auth, nc=00000001
Content-Type: application/sdp
Content-Length: 322
v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.75
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 12156 RTP/AVP 8 0 101
c=IN IP4 192.168.1.75
b=TIAS:64000
a=ssrc:1567952351 cname:73284f1717045a81
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv
a=rtcp:12157
Please Help me, Thank you.