New subject: [EXTERNAL] Re: Nat Problems Kamailio

13 Apr 2025


      Hello Everyone,
I'm having some trouble getting my SIP setup to work properly.
📞 My Call Flow:
SIP Client initiates a call
The call reaches my router, which forwards it to
Kamailio + RTPengine running on 192.168.1.75:5060, which then forwards it to
A Kubernetes machine at 192.168.1.190:32210, where Asterisk is running
🔧 Network Setup:
Router has the following ports forwarded:
UDP 5060
UDP 10000–20000 (for RTP)
STUN is enabled on the SIP client
✅ What Works:
When I’m connected through a VPN (i.e., inside the local network), everything works fine — both incoming and outgoing audio.
❌ The Problem:
When calling from outside the network, signaling works and the call connects, but I can’t receive or send any audio.
Here is a little of my config of kamailio
modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:2223")
modparam("rtpengine", "setid_avp", "$avp(setid)")
listen=udp:192.168.1.75:5060 advertise 62.2x.xxx.xxx:5060
listen=tcp:192.168.1.75:5060 advertise 62.2x.xxx.xxx:5060
listen=udp:127.0.0.1:5060
#Nat Helper
modparam("nathelper", "force_socket", "192.168.1.75:5060")
modparam("nathelper", "natping_interval", 10)
modparam("nathelper", "ping_nated_only", 0)
modparam("nathelper", "nat_addr_mode", 1)
request_route{
...
        route(init);
...
        if(is_method("INVITE|ACK|BYE|CANCEL|OPTIONS|INFO|UPDATE|PRACK")){
                route(handle_sip);
                exit;
        }
}
route[init]{
...
        if (nat_uac_test("19")){
                setflag(FLT_NAT);
                fix_nated_contact();
                force_rport();
        }
}
route[handle_sip]{
        if ($rm == "INVITE"){
                if (isflagset(FLT_NAT)){
                        route(natmanage);
                }
if (!ds_select_dst("1", "4")){
                        sl_send_reply("500", "No destination");
                        exit;
                }
$ru = "sip:" + $rU + "@" + $rd;  # Keeps sip:100@domain
                $du = "sip:192.168.1.190:32210";  # Matches your dispatcher list
route(relay);
        }
if ($rm == "BYE" || $rm == "CANCEL"){
                if (isflagset(FLT_NAT)){
                        rtpengine_delete();
                }
route(relay);
        }
if ($rm == "ACK"){
                if (isflagset(FLT_NAT)){
                        route(natmanage);
                }
route(relay);
        }
        route(relay);
}
route[natmanage]{
        if (is_request()){
                if (has_body("application/sdp")){
                        rtpengine_offer("replace-origin replace-session-connection ICE=remove");
                }
                force_rport();
                fix_nated_contact();
        }else{
                rtpengine_answer("replace-origin replace-session-connection ICE=remove");
        }
}
rtpengine.conf
[rtpengine]
table = 0
interface = internal/192.168.1.75
listen-ng = 127.0.0.1:2223
log-level = 7
timeout = 60
silent-timeout = 3600
tos = 184
port-min = 10000
port-max = 40000
And here are some logs when I call from outside
2025/04/13 15:58:33.407265 2.8x.xx.xxx:59396 -> 192.168.1.75:5060
INVITE sip:100@192.168.1.75:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.116:59396;rport;branch=z9hG4bKPj92490d6b6d0c4cd88dac9f0043b1642e
Max-Forwards: 70
From: "6001" sip:6005@192.168.1.75:5060;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: sip:100@192.168.1.75:5060
Contact: "6001" sip:6005@192.168.1.116:59396;ob;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8963 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Content-Type: application/sdp
Content-Length:   537
v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.116
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 4032 RTP/AVP 8 0 101
c=IN IP4 192.168.1.116
b=TIAS:64000
a=rtcp:4017 IN IP4 192.168.1.116
a=sendrecv
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ssrc:1567952351 cname:73284f1717045a81
a=ice-ufrag:37e51dc0
a=ice-pwd:49f7442b5078148140877b44
a=candidate:Hc0a80174 1 UDP 2130706431 192.168.1.116 4032 typ host
a=candidate:Hc0a80174 2 UDP 2130706430 192.168.1.116 4017 typ host
2025/04/13 15:58:33.412683 192.168.1.75:5060 -> 192.168.1.190:32210
INVITE sip:100@192.168.1.75 SIP/2.0
Via: SIP/2.0/UDP 62.2x.2xx.xxx:5060;branch=z9hG4bK6362.26a75297a4ccf4984dd1f68644c2148f.0
Via: SIP/2.0/UDP 192.168.1.116:59396;received=2.8x.xx.xxx;rport=59396;branch=z9hG4bKPj92490d6b6d0c4cd88dac9f0043b1642e
Max-Forwards: 69
From: "6001" sip:6005@192.168.1.75:5060;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: sip:100@192.168.1.75:5060
Contact: "6001" sip:6005@2.8x.xx.xxx:59396;ob;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8963 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Content-Type: application/sdp
Content-Length:   322
v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.75
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 12156 RTP/AVP 8 0 101
c=IN IP4 192.168.1.75
b=TIAS:64000
a=ssrc:1567952351 cname:73284f1717045a81
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv
a=rtcp:12157
2025/04/13 15:58:33.428169 2.8x.xx.xxx:59396 -> 192.168.1.75:5060
INVITE sip:100@192.168.1.75:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.116:59396;rport;branch=z9hG4bKPj14c6f24b814e4d158014cc80b1fa5f8f
Max-Forwards: 70
From: "6001" sip:6005@192.168.1.75:5060;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: sip:100@192.168.1.75:5060
Contact: "6001" sip:6005@192.168.1.116:59396;ob;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8964 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Authorization: Digest username="6005", realm="asterisk", nonce="1744559913/dab8894e3f31e038d7a969a6349a11c2", uri="sip:100@62.2x.2xx.xxx", response="2ce500d6a1583f05f6344bdf1f712fc7", algorithm=MD5, cnonce="808fc766135d40589dd68032bcaab5c6", opaque="2232aa9c42080f12", qop=auth, nc=00000001
Content-Type: application/sdp
Content-Length:   537
v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.116
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 4032 RTP/AVP 8 0 101
c=IN IP4 192.168.1.116
b=TIAS:64000
a=rtcp:4017 IN IP4 192.168.1.116
a=sendrecv
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ssrc:1567952351 cname:73284f1717045a81
a=ice-ufrag:37e51dc0
a=ice-pwd:49f7442b5078148140877b44
a=candidate:Hc0a80174 1 UDP 2130706431 192.168.1.116 4032 typ host
a=candidate:Hc0a80174 2 UDP 2130706430 192.168.1.116 4017 typ host
2025/04/13 15:58:33.430593 192.168.1.75:5060 -> 2.8x.xx.xxx:59396
SIP/2.0 100 trying -- your call is important to us
Via: SIP/2.0/UDP 192.168.1.116:59396;rport=59396;branch=z9hG4bKPj14c6f24b814e4d158014cc80b1fa5f8f;received=2.8x.xx.xxx
From: "6001" sip:6005@192.168.1.75:5060;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: sip:100@192.168.1.75:5060
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8964 INVITE
Server: kamailio (5.7.4 (x86_64/linux))
Content-Length: 0
2025/04/13 15:58:33.461894 192.168.1.75:5060 -> 192.168.1.190:32210
INVITE sip:100@192.168.1.75 SIP/2.0
Via: SIP/2.0/UDP 62.2x.2xx.xxx:5060;branch=z9hG4bK3362.72f5db87deeeccee7fea924753af3da0.0
Via: SIP/2.0/UDP 192.168.1.116:59396;received=2.8x.xx.xxx;rport=59396;branch=z9hG4bKPj14c6f24b814e4d158014cc80b1fa5f8f
Max-Forwards: 69
From: "6001" sip:6005@192.168.1.75:5060;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: sip:100@192.168.1.75:5060
Contact: "6001" sip:6005@2.8x.xx.xxx:59396;ob;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8964 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Authorization: Digest username="6005", realm="asterisk", nonce="1744559913/dab8894e3f31e038d7a969a6349a11c2", uri="sip:100@62.2x.2xx.xxx", response="2ce500d6a1583f05f6344bdf1f712fc7", algorithm=MD5, cnonce="808fc766135d40589dd68032bcaab5c6", opaque="2232aa9c42080f12", qop=auth, nc=00000001
Content-Type: application/sdp
Content-Length:   322
v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.75
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 12156 RTP/AVP 8 0 101
c=IN IP4 192.168.1.75
b=TIAS:64000
a=ssrc:1567952351 cname:73284f1717045a81
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv
a=rtcp:12157
Please Help me, Thank you.