The second one is for nat. For internal calls, there is
no nat issue.
For
external calls, the router can be sit on both
inside and outside on the
network. You can avoid the nat issue on SIP messages.
NAT issues can be solved using the ip_conntrack_sip kernel module which
is included in OpenWRT (it's not compiled by default, but a friend of
mine built a new kernel and it works fine (no STUN or rtpproxy needed
any more)
This sip ALG has some problems. It is work ok with one phone behind NAT, but
not multiple phones. SIP is very complicated; probably part of reason why
there is no SIP conntrack module available in POM yet.