Asterisk PJSIP NAT: map the advertised addresses

There are different NAT problems

A PBX behind NAT may advertise an address that a carrier cannot reach. A remote phone behind NAT may publish an unusable Contact or send media from a translated address. These are related but different situations. First draw which participant sits behind which boundary.

For a PBX behind NAT, transport settings such as local_net, external_signaling_address and external_media_address influence when external addresses are advertised. For remote endpoints, options such as rewrite_contact, force_rport and rtp_symmetric address different return-path behaviors. They are not a single enable-NAT switch.

Compare the advertised and actual media address

Inspect the actual addresses

Compare the SIP destination and Contact with the negotiated SDP media address and port. Trace the missing audio direction: which endpoint is sending, what address it selected and whether packets cross the firewall. An internal success does not validate the public carrier path.

Use the PBX's actual configured media range and the carrier's documented networks when reviewing rules. Copying a broad internet port-forwarding example can expose services unnecessarily and still fail to address the correct path.

Keep media topology explicit

direct_media controls whether Asterisk may move media directly between endpoints. Allowing direct media can change which devices must reach each other. Keeping Asterisk in the media path can simplify some designs but increases the traffic and processing handled there.

A VPN can change reachable addresses and the desired NAT behavior. Reassess settings after moving a phone onto a VPN rather than retaining every workaround from its earlier public path.

Validate one change

Capture a bounded failing call, make the justified adjustment and repeat the same call. Then test an internal call and a remote call to check for regressions. Schedule restarts when transport changes require them. Never disable the firewall as the permanent fix.