Asterisk PJSIP NAT: map the advertised addresses

Draw the address owners before selecting a setting

Asterisk behind a translating router, a remote phone behind its own NAT and direct media between endpoints are different topologies. Draw the SIP source and destination, Contact and Via owners, SDP address owner, RTP sender and each translation boundary before changing configuration. A carrier-facing transport setting cannot repair every remote-phone Contact, and an endpoint option does not publish the PBX router's external address.

Keep signaling and media evidence separate. A completed SIP dialog can still advertise an unusable SDP destination, while bidirectional RTP packets can reach Asterisk without being decoded into usable audio. Record the installed Asterisk branch, transport, endpoint and generated-configuration owner before interpreting an example from another system.

Compare the advertised and actual media address

Use transport rewriting for Asterisk behind NAT

On a PJSIP transport, local_net defines destinations considered local. Asterisk documents that NAT-related external settings are not applied to communication inside those ranges. When a message goes outside local_net, external_media_address can replace a local SDP media address and external_signaling_address supplies the external SIP address. Those conditions make an omitted or over-broad local network as important as the external value.

The current Asterisk 22 reference also lists external_signaling_hostname from 22.11.0. It places a supplied FQDN in outgoing Contact and Via headers, performs no validation and is mutually exclusive with external_signaling_address. Treat it as a version-gated signaling-header control, not dynamic-DNS discovery, media rewriting or proof that a remote peer can resolve and reach the name.

Choose remote-endpoint return paths one control at a time

For a remote endpoint, force_rport sends SIP responses to the source port even when the request omitted the rport parameter. rewrite_contact changes an inbound Contact or appropriate Record-Route address to the observed source IP and port for later requests; it does not rewrite messages sent by the endpoint. Asterisk notes that refreshed registrations can then create changing contact addresses, so review max_contacts, remove_existing and remove_unavailable rather than merely increasing the limit.

For media, rtp_symmetric sends RTP to the address and port from which Asterisk received RTP, while media_address controls the address Asterisk places in SDP for that endpoint. These controls solve different observations. Apply only the setting supported by a capture and retain the earlier value for rollback.

Keep direct media and ICE paths explicit

direct_media determines whether media may flow directly between endpoints. Disabling it keeps Asterisk in the media path for the documented simple NAT topology; enabling it can require the endpoints to reach each other's advertised addresses. Neither value is a universal performance or NAT repair. Record which leg owns SDP and where the first missing RTP packet should be visible.

ICE, STUN, TURN and a VPN can change address discovery or media reachability, but they do not establish SIP authentication, dialplan permission, codec agreement or audio quality. Reassess older NAT workarounds when a client moves behind a relay or VPN instead of stacking every mechanism.

Locate the first wrong address or missing packet

Capture one authorized failing call on both sides of the managed boundary. Compare the request destination, source, Via, Contact and Record-Route values with SDP c= and m= lines on each leg. For one-way audio, name the silent direction, expected RTP sender, advertised destination, observed source and the first capture point where packets disappear. An internal success does not validate the public path.

Inspect loaded objects before changing them. pjsip show transport <name>, pjsip show endpoint <name>, pjsip show aor <name> and pjsip show contacts separate the transport, endpoint policy and current bindings. Limit the logger or packet capture to the authorized reproduction and remove credentials or personal numbers before sharing evidence.

core show version
pjsip show transports
pjsip show transport <transport-name>
pjsip show endpoint <endpoint-name>
pjsip show aor <aor-name>
pjsip show contacts

Change, activate and prove one boundary

Preserve the known-good configuration, change only the demonstrated owner and use the activation path supported by the installed branch and configuration manager. The Asterisk 22 reference defaults transport allow_reload to no because reloading a transport may disrupt in-progress calls. A saved edit, routine module reload or FreePBX Apply Config action is therefore not proof that a transport object changed; schedule a restart when the documented boundary requires it.

Repeat the same external call, then a neighboring internal and remote flow. Confirm the loaded value, final SIP response, negotiated addresses, bidirectional RTP, decoded audio and normal hangup separately. Roll back through the same configuration owner if the expected state is absent. Use the actual PBX media range and trusted peer networks in firewall rules; never disable the firewall or expose a copied broad port range as the permanent fix. No PBX, endpoint, transport, NAT device, packet path or call was tested for this guide.

Do not collapse direct media into the NAT option bundle

The Asterisk direct-media guide keeps direct_media and disable_direct_media_on_nat distinct from local_net, external addresses, media_address, symmetric RTP, rport and Contact rewriting. Draw the final SDP and packet path before selecting the owner of a one-way-audio failure.

Verify final SDP and RTP before changing the NAT profile

Use the PJSIP media-address guide to compare loaded endpoint and transport state with the accepted SDP and both RTP directions. A copied NAT bundle can hide whether the fault belongs to signaling, advertised media, packet source or return routing.

Preserve the FreePBX owner of PJSIP NAT rewriting

On a FreePBX system, use the Asterisk SIP Settings guide to map External Address and Local Networks into generated transport state, then prove the loaded object and final signaling and SDP addresses. Do not hand-edit generated PJSIP files or widen local networks to make one trace look correct.