NAT and Firewall — Troubleshooting SIP Issues
NAT (Network Address Translation) is the main cause of SIP problems in office/enterprise environments. Here is how to diagnose and resolve them.
Symptoms of a NAT problem
- Calls ring but there is no audio (one-way audio or no audio)
- SIP registration succeeds but incoming calls do not work
- Audio works locally but not from the outside
- Calls drop after 30 seconds (re-INVITE problem)
Ports to open in your firewall
| Protocol | Port | Usage |
|---|---|---|
| UDP/TCP | 5060 | SIP signalling |
| TLS | 5061 | Encrypted SIP signalling |
| UDP | 10000 to 20000 | RTP streams (audio) |
Solution 1 — rport (RFC 3581)
The rport parameter forces the SIP server to reply on the port from which the request was sent (rather than the port advertised in the Via header). Enable it in your PBX/ATA:
Via: SIP/2.0/UDP 192.168.1.10:5060;rport
On Asterisk: nat=yes in sip.conf
On 3CX: enabled by default via the automatic NAT detector.
Solution 2 — STUN
The STUN protocol (RFC 5389) allows your device to discover its public IP:
stun_server = stun.l.google.com:19302
Limitation: STUN does not work with symmetric NAT (often used in enterprises).
Solution 3 — TURN (symmetric NAT)
TURN relays all RTP traffic through an intermediate server. It is a universal solution, but with some overhead:
turn_server = turn.webtic.online:3478 turn_username = <your_login> turn_password = <your_password>
Recommended configuration (Asterisk)
[general] externip = YOUR_PUBLIC_IP localnet = 192.168.0.0/255.255.0.0 nat = yes qualify = yes
SIP connectivity test
# Basic test nmap -sU -p 5060 sip.webtic.online # SIP registration test sipsak -s sip:sip.webtic.online -v
Support: If the problem persists after these configurations, contact our support team with a network pcap (tcpdump -i eth0 -w sip_capture.pcap port 5060).
