Nat Problems Kamailio

Fernando Lopes via sr-users <[email protected]>
Newsgroups gmane.comp.voip.ser
Message-ID <[email protected]> 
Hello Everyone,
I'm having some trouble getting my SIP setup to work properly.

📞 My Call Flow:
SIP Client initiates a call
The call reaches my router, which forwards it to
Kamailio + RTPengine running on 192.168.1.75:5060, which then forwards it to
A Kubernetes machine at 192.168.1.190:32210, where Asterisk is running

🔧 Network Setup:
Router has the following ports forwarded:
UDP 5060
UDP 10000–20000 (for RTP)
STUN is enabled on the SIP client

✅ What Works:
When I’m connected through a VPN (i.e., inside the local network), everything works fine — both incoming and outgoing audio.

❌ The Problem:
When calling from outside the network, signaling works and the call connects, but I can’t receive or send any audio.

Here is a little of my config of kamailio
modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:2223")
modparam("rtpengine", "setid_avp", "$avp(setid)")
listen=udp:192.168.1.75:5060 advertise 62.2x.xxx.xxx:5060
listen=tcp:192.168.1.75:5060 advertise 62.2x.xxx.xxx:5060
listen=udp:127.0.0.1:5060
#Nat Helper
modparam("nathelper", "force_socket", "192.168.1.75:5060")
modparam("nathelper", "natping_interval", 10)
modparam("nathelper", "ping_nated_only", 0)
modparam("nathelper", "nat_addr_mode", 1)

request_route{
...
        route(init);
...
        if(is_method("INVITE|ACK|BYE|CANCEL|OPTIONS|INFO|UPDATE|PRACK"))\{
                route(handle_sip);
                exit;
        }
}
route[init]{
...
        if (nat_uac_test("19")){
                setflag(FLT_NAT);
                fix_nated_contact();
                force_rport();
        }
}
route[handle_sip]{
        if ($rm == "INVITE"){
                if (isflagset(FLT_NAT)){
                        route(natmanage);
                }

                if (!ds_select_dst("1", "4")){
                        sl_send_reply("500", "No destination");
                        exit;
                }

                $ru = "sip:" + $rU + "@" + $rd;  # Keeps sip:100@domain
                $du = "sip:192.168.1.190:32210";  # Matches your dispatcher list

                route(relay);
        }

        if ($rm == "BYE" || $rm == "CANCEL"){
                if (isflagset(FLT_NAT)){
                        rtpengine_delete();
                }

                route(relay);
        }

        if ($rm == "ACK"){
                if (isflagset(FLT_NAT)){
                        route(natmanage);
                }

                route(relay);
        }
        route(relay);
}
route[natmanage]{
        if (is_request()){
                if (has_body("application/sdp")){
                        rtpengine_offer("replace-origin replace-session-connection ICE=remove");
                }
                force_rport();
                fix_nated_contact();
        }else{
                rtpengine_answer("replace-origin replace-session-connection ICE=remove");
        }
}
rtpengine.conf

[rtpengine]
table = 0
interface = internal/192.168.1.75
listen-ng = 127.0.0.1:2223
log-level = 7

timeout = 60
silent-timeout = 3600
tos = 184

port-min = 10000
port-max = 40000

And here are some logs when I call from outside

2025/04/13 15:58:33.407265 2.8x.xx.xxx:59396 -> 192.168.1.75:5060
INVITE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.116:59396;rport;branch=z9hG4bKPj92490d6b6d0c4cd88dac9f0043b1642e
Max-Forwards: 70
From: "6001" <sip:[email protected]:5060>;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: <sip:[email protected]:5060>
Contact: "6001" <sip:[email protected]:59396;ob>;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8963 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Content-Type: application/sdp
Content-Length:   537

v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.116
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 4032 RTP/AVP 8 0 101
c=IN IP4 192.168.1.116
b=TIAS:64000
a=rtcp:4017 IN IP4 192.168.1.116
a=sendrecv
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ssrc:1567952351 cname:73284f1717045a81
a=ice-ufrag:37e51dc0
a=ice-pwd:49f7442b5078148140877b44
a=candidate:Hc0a80174 1 UDP 2130706431 192.168.1.116 4032 typ host
a=candidate:Hc0a80174 2 UDP 2130706430 192.168.1.116 4017 typ host

2025/04/13 15:58:33.412683 192.168.1.75:5060 -> 192.168.1.190:32210
INVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 62.2x.2xx.xxx:5060;branch=z9hG4bK6362.26a75297a4ccf4984dd1f68644c2148f.0
Via: SIP/2.0/UDP 192.168.1.116:59396;received=2.8x.xx.xxx;rport=59396;branch=z9hG4bKPj92490d6b6d0c4cd88dac9f0043b1642e
Max-Forwards: 69
From: "6001" <sip:[email protected]:5060>;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: <sip:[email protected]:5060>
Contact: "6001" <sip:[email protected]:59396;ob>;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8963 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Content-Type: application/sdp
Content-Length:   322

v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.75
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 12156 RTP/AVP 8 0 101
c=IN IP4 192.168.1.75
b=TIAS:64000
a=ssrc:1567952351 cname:73284f1717045a81
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv
a=rtcp:12157

2025/04/13 15:58:33.428169 2.8x.xx.xxx:59396 -> 192.168.1.75:5060
INVITE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.116:59396;rport;branch=z9hG4bKPj14c6f24b814e4d158014cc80b1fa5f8f
Max-Forwards: 70
From: "6001" <sip:[email protected]:5060>;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: <sip:[email protected]:5060>
Contact: "6001" <sip:[email protected]:59396;ob>;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8964 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Authorization: Digest username="6005", realm="asterisk", nonce="1744559913/dab8894e3f31e038d7a969a6349a11c2", uri="sip:[email protected]", response="2ce500d6a1583f05f6344bdf1f712fc7", algorithm=MD5, cnonce="808fc766135d40589dd68032bcaab5c6", opaque="2232aa9c42080f12", qop=auth, nc=00000001
Content-Type: application/sdp
Content-Length:   537

v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.116
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 4032 RTP/AVP 8 0 101
c=IN IP4 192.168.1.116
b=TIAS:64000
a=rtcp:4017 IN IP4 192.168.1.116
a=sendrecv
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ssrc:1567952351 cname:73284f1717045a81
a=ice-ufrag:37e51dc0
a=ice-pwd:49f7442b5078148140877b44
a=candidate:Hc0a80174 1 UDP 2130706431 192.168.1.116 4032 typ host
a=candidate:Hc0a80174 2 UDP 2130706430 192.168.1.116 4017 typ host

2025/04/13 15:58:33.430593 192.168.1.75:5060 -> 2.8x.xx.xxx:59396
SIP/2.0 100 trying -- your call is important to us
Via: SIP/2.0/UDP 192.168.1.116:59396;rport=59396;branch=z9hG4bKPj14c6f24b814e4d158014cc80b1fa5f8f;received=2.8x.xx.xxx
From: "6001" <sip:[email protected]:5060>;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: <sip:[email protected]:5060>
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8964 INVITE
Server: kamailio (5.7.4 (x86_64/linux))
Content-Length: 0


2025/04/13 15:58:33.461894 192.168.1.75:5060 -> 192.168.1.190:32210
INVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 62.2x.2xx.xxx:5060;branch=z9hG4bK3362.72f5db87deeeccee7fea924753af3da0.0
Via: SIP/2.0/UDP 192.168.1.116:59396;received=2.8x.xx.xxx;rport=59396;branch=z9hG4bKPj14c6f24b814e4d158014cc80b1fa5f8f
Max-Forwards: 69
From: "6001" <sip:[email protected]:5060>;tag=0397d2bdc3ef47f5b6e498126a360b0f
To: <sip:[email protected]:5060>
Contact: "6001" <sip:[email protected]:59396;ob>;+sip.ice
Call-ID: 83a804569c3f489088607c729485cdbd
CSeq: 8964 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: MicroSIP/3.21.5
Authorization: Digest username="6005", realm="asterisk", nonce="1744559913/dab8894e3f31e038d7a969a6349a11c2", uri="sip:[email protected]", response="2ce500d6a1583f05f6344bdf1f712fc7", algorithm=MD5, cnonce="808fc766135d40589dd68032bcaab5c6", opaque="2232aa9c42080f12", qop=auth, nc=00000001
Content-Type: application/sdp
Content-Length:   322

v=0
o=- 3953552313 3953552313 IN IP4 192.168.1.75
s=pjmedia
b=AS:84
t=0 0
a=X-nat:0
m=audio 12156 RTP/AVP 8 0 101
c=IN IP4 192.168.1.75
b=TIAS:64000
a=ssrc:1567952351 cname:73284f1717045a81
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv
a=rtcp:12157

Please Help me, Thank you.
__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions -- [email protected]
To unsubscribe send an email to [email protected]
Important: keep the mailing list in the recipients, do not reply only to the sender!
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.