Keep three media-address observations separate
For each call leg, preserve the accepted SDP c= address and m= port, the source address and port of packets that Asterisk actually sends, and the destination to which the far side actually sends. These values can differ legitimately because of NAT, symmetric RTP, a media relay, direct media or an interface-selection rule. RFC 3264 defines the offer/answer exchange, but a syntactically accepted SDP body is not proof that packets reached that address.
Name the initial and final offer and answer, then compare them with the observed RTP five-tuples in both directions. Do not diagnose a private SDP address from a screenshot alone when a later answer, re-INVITE or UPDATE changed the negotiated path.
Distinguish endpoint media controls from transport rewriting
Asterisk documents endpoint media_address as the address used when creating SDP, while warning that transport external_media_address can still alter the final SDP. When bind_rtp_to_media_address is enabled and media_address is set, Asterisk also binds the RTP instance to that address. Advertising an address and sourcing packets from an address are therefore related but separate decisions.
Transport local_net defines which destinations are local for rewriting. For a destination outside those networks, external_media_address can replace a local SDP media address. Record the loaded transport and endpoint objects, resolved address and selected interface; an edited file or GUI field is not the effective runtime state.
Do not merge signaling NAT and media NAT switches
rtp_symmetric tells Asterisk to send media back to the address and port from which media was received. force_rport governs where SIP responses are sent, and rewrite_contact rewrites inbound Contact or Record-Route information for later SIP requests and reliable-transport reuse. They do not describe one identical NAT operation.
The migration guide maps legacy nat=yes behavior onto multiple res_pjsip options, which is a useful warning against copying one old boolean into a universal bundle. Enable only the control supported by signaling and packet evidence, and keep external_signaling_address scoped to SIP signaling rather than treating it as the media destination.
Treat keepalive, direct media and proxies as different paths
Asterisk documents rtp_keepalive as sending comfort-noise frames at an interval, which may keep a NAT or firewall opening alive. It does not prove two-way audio, correct payload mapping or a reachable advertised address. Likewise, direct_media can move media away from Asterisk after call setup, so a capture limited to the PBX may stop seeing packets without proving loss.
The proxy guide shows that external and local NAT settings are not appropriate merely because a proxy is present; the example where Asterisk and the proxy share a network leaves them unset. Determine which hop sees the remote endpoint and which component owns media relay or address rewriting before applying any public-address template.
Respect FreePBX ownership and prove one correction
On FreePBX-managed systems, change the owning GUI field, supported custom include or documented integration boundary, apply configuration, then compare generated files with loaded PJSIP state. Direct edits to generated files can be replaced and do not establish what the running service loaded. Preserve backups and the previous working values.
Retest a fresh authorized call after changing one evidenced boundary. Retain both call legs' SDP, Asterisk RTP source, received-media source, direct-media transitions and decoded audio result. No Asterisk or FreePBX system, address rewrite, NAT traversal, proxy path, media stream or call was tested for this guide.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- Asterisk 22 res_pjsip reference ↗
- Asterisk latest res_pjsip reference ↗
- Asterisk res_pjsip NAT configuration guide ↗
- Asterisk PJSIP with proxies ↗
- Asterisk chan_sip to res_pjsip migration guide ↗
- Asterisk PJSIP troubleshooting guide ↗
- RFC 3264: SDP offer/answer ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.