[SR-Users] How ICE works with private IPs as candidates?

Hello! I have next topology: ISP->Kamailio + Rtpengine->WebRTC Sometimes I receive from Browser side SDP like below with private IPs in ICE candidates. - Please explain why it happens? - How ICE finds a pair? I think Rtpengine obtains packet from Browser and somehow matches with peer (as it can't reach Browser via private IP) U KAMAILIO_IP:34150 -> RTPENGINE_IP:22222 0_16586_545 d3:sdp962:v=0. o=- 3981552194926701250 2 IN IP4 127.0.0.1. s=-. t=0 0. a=msid-semantic: WMS 5efe361e-087d-47de-98f6-9b51427d3764. m=audio 50589 RTP/SAVPF 8 0. c=IN IP4 192.168.2.205. a=rtcp:9 IN IP4 0.0.0.0. a=candidate:710145796 1 udp 2122255103 <(212)%20225-5103> 2001::9d38:6abd:3c21:28f:3f57:fd32 50588 typ host generation 0 network-id 1 network-cost 50. a=candidate:2355154215 1 udp 2122194687 <(212)%20219-4687> 192.168.2.205 50589 typ host generation 0 network-id 2. a=ice-ufrag:sPAh. a=ice-pwd:RjXqOz8rpwjhKPU3BzXkJd1d. a=fingerprint:sha-256 04:AF:D4:6C:07:C2:DD:18:48:E0: BC:46:15:15:00:5F:C9:AD:CF:8D:F3:94:55:5A:54:0C:37:B3:E6:44:63:EC. a=setup:active. a=mid:audio. a=sendrecv. a=rtcp-mux. a=rtpmap:8 PCMA/8000. a=rtpmap:0 PCMU/8000. a=ssrc:3055599516 <(305)%20559-9516> cname:n0Cdw7SNbYDIba8s. a=ssrc:3055599516 <(305)%20559-9516> msid:5efe361e-087d-47de-98f6-9b51427d3764 41750b25-d640-4bad-8953-55f4e2684c49. a=ssrc:3055599516 <(305)%20559-9516> mslabel:5efe361e-087d-47de- 98f6-9b51427d3764. a=ssrc:3055599516 <(305)%20559-9516> label:41750b25-d640-4bad-8953- 55f4e2684c49. 3:ICE6:remove5:flagsl13:trust-address14:media-handover8: SDES-offe7:replacel6:origin18:session-connectione18: transport-protocol7:RTP/AVP8:rtcp-muxl5:offer6:accepte7: call-id37:domain.com_29465313:received-froml3:IP412:10.23. 255.93e8:from-tag13:QQcg5eFv08S9K6:to-tag10:nsebpmf7ia7:command6:answere