[Users] BYE from call recipient not passing the firewall

Hi, I am experiencing the following: openser 1.1 and asterisk are on public IP addresses, with openser acting as a sip proxy in front of asterisk. sip clients A and B live behind the same firewall. Let A be a TCP UAC. Let B be a UAC using TCP or UDP. If A calls B and B hangs up, A never sees the BYE packet, and never hangs up. If A calls B and A hangs up, the BYE packet is transmitted just fine, and B hangs up as it should. tcpdump at the sip proxy shows that when B hangs up, the SIP hangup dialog is as expected between B<->openser<->asterisk Then, asterisk sends a BYE through openser which is addressed to A, but A never responds. To be more exact, A never responds because the BYE message is not passing through the firewall. Perhaps someone has seen such a problem? I have included a collection of facts below about the situation. If there are others I can provide you with, let me know. If A and B are both TCP, then clients A and B each have exactly one tcp stream between themselves and openser. I.e. tcpdump shows precisely 2 each of syn and syn/ack packets. The source and destination ports of the final BYE packet are the same as the destination and source ports of the original INVITE packet. Furthermore, the time between phone registration and the sending of the last BYE packet is on the order of 20 seconds, and the behavior is consistent, so it is unlikely that the TCP stream timed out. The following four packets were cut and pasted from tcpdump. Would more information be helpful? The following packets represent: 1. invite from asterisk to openser 2. invite from openser to client B 3. bye from asterisk to openser 4. bye from openser to client B Recall that INVITE(tcp.src, tcp.dst) == BYE (tcp.dst,tcp.src). INVITE sip:9043067733@joinuneta.com:5065 SIP/2.0\r\n From: "Mark Price2" <sip:9043060000@66.129.95.24>;tag=as50a4e684\r\n To: <sip:9043067733@joinuneta.com:5065>\r\n Contact: <sip:9043060000@66.129.95.24>\r\n Call-ID: 6e9c8160194ea4eb59afa0da0c22633d(a)66.129.95.24\r\n CSeq: 102 INVITE\r\n INVITE sip:9043067733@66.177.61.238:17522;transport=TLS;rinstance=58c12cb6506504ae SIP/2.0\r\n From: "Mark Price2" <sip:9043060000@66.129.95.24>;tag=as50a4e684\r\n To: <sip:9043067733@joinuneta.com:5065>\r\n Contact: <sip:9043060000@66.129.95.24>\r\n Call-ID: 6e9c8160194ea4eb59afa0da0c22633d(a)66.129.95.24\r\n CSeq: 102 INVITE\r\n BYE sip:9043060000@66.177.61.238:17559 SIP/2.0\r\n From: "9043067733 (Softphone)"<sip:9043067733@joinuneta.com To: "Mark Price"<sip:9043060000@joinuneta.com>;tag=3c60f44e\r\n Contact: <sip:9043067733@66.129.95.24>\r\n Call-ID: ZDFkMjBlMWJlOGZlZWE4NmZlMzQ2NWE0OWNiOGYzYzU.\r\n CSeq: 102 BYE\r\n BYE sip:9043060000@66.177.61.238:17559 SIP/2.0\r\n From: "9043067733 (Softphone)"<sip:9043067733@joinuneta.com To: "Mark Price"<sip:9043060000@joinuneta.com>;tag=3c60f44e\r\n Contact: <sip:9043067733@66.129.95.24>\r\n Call-ID: ZDFkMjBlMWJlOGZlZWE4NmZlMzQ2NWE0OWNiOGYzYzU.\r\n Thanks, Mark Price