VoIP.infoThe independent guide to business communications.
VoIP.info Guide

NAT for VoIP: signaling and media addresses

Map each translation boundary and compare advertised destinations with reachable addresses.

Reviewed 2026-10-14Foundational

Address translation affects multiple layers

NAT changes network addressing, while SIP and SDP can also carry addresses inside signaling. A translated packet source does not automatically correct every application-level address. This is why call setup can work while incoming delivery or audio fails.

Compare the advertised and actual media address
A phone or PBX at private address 10.0.0.10 sends through a NAT/firewall to a remote service. Return media also traverses that boundary and must reach the intended endpoint.

10.0.0.10 is an illustrative private address. Both directions traverse the NAT/firewall; signaling success does not validate SDP media reachability.

Draw both participants

Identify whether the PBX, phone or both are behind NAT. Record which side initiates communication and whether media is relayed. A solution for an office PBX behind a router may not suit a public VPS with remote phones.

Inspect the failed direction

For registration or incoming calls, review contact and response routing. For missing sound, inspect SDP and actual media destinations. Use the PBX's topology-specific settings and carrier guidance, then review the matching firewall policy.

Avoid universal fixes

Broad port forwarding, indiscriminate SIP ALG changes and copying every NAT option can introduce new problems. Make one evidence-supported change and re-test internal, outside and transferred calls. A VPN changes the reachable topology and should trigger a fresh review of earlier NAT workarounds.

Use Linphone NatPolicy without flattening traversal methods

Liblinphone exposes ICE, STUN, TURN and UPnP as distinct controls with different precedence and evidence. The Linphone traversal guide maps those controls to candidates and the selected path rather than presenting one universal NAT switch.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Continue your research

Hub

VoIP networking

Trace signaling and audio through your actual topology before changing ports or prioritization.

Explore topic →
Troubleshooting · Asterisk 22 LTS · FreePBX 17 / Debian 12 checks

One-way VoIP audio

Trace the missing direction from advertised media address to receiving endpoint.

Read guide →
Interactive tool

VoIP bandwidth calculator

Estimate IP-layer voice traffic per direction from codec rate, packet duration and concurrent calls.

Open tool →
Guide · WebRTC standards; browser and server behavior must be checked by version

ICE: candidate gathering, checks and the selected path

Understand how WebRTC finds a usable media route and what an ICE failure actually narrows down.

Read guide →
Guide · Protocol concepts; firewall and endpoint controls vary by release

SIP ALG: prove what the router changes

Compare signaling on both sides of an intermediary before changing its SIP helper.

Read guide →
Guide · Wireshark 4.x / current upstream tool documentation; inspect installed versions

NAT diagnosis with signaling and media evidence

Identify whether a failing address belongs to SIP routing, media negotiation or a changed network mapping.

Read guide →
Networking guide · Current Liblinphone NatPolicy API, Liblinphone 5.5 network-parameter reference and Linphone ICE feature documentation reviewed October 14, 2026 with RFC 8445, RFC 8489, RFC 8656 and RFC 8839; library capabilities do not prove that one distributed Linphone application exposes the same controls, that an account or peer accepts ICE, that a server resolves or authenticates, that a relay was allocated or selected, or that media was delivered, and no application, SDK build, account, device, network, NAT, firewall, STUN or TURN service, DNS result, credential, candidate, SDP body, connectivity check, relay allocation, packet, media stream or call was inspected or tested

Linphone NAT traversal: ICE, STUN and TURN policy

Keep Linphone NAT policy, candidate gathering, TURN allocation, ICE checks, selected media path and audible result separately observable.

Read guide →
Diagnostic · Current Liblinphone NatPolicy API, Liblinphone 5.5 network-parameter reference and Linphone ICE feature documentation reviewed October 14, 2026 with RFC 8445, RFC 8489, RFC 8656 and RFC 8839; library capabilities do not prove that one distributed Linphone application exposes the same controls, that an account or peer accepts ICE, that a server resolves or authenticates, that a relay was allocated or selected, or that media was delivered, and no application, SDK build, account, device, network, NAT, firewall, STUN or TURN service, DNS result, credential, candidate, SDP body, connectivity check, relay allocation, packet, media stream or call was inspected or tested

Linphone ICE fails or a TURN relay is not selected

Trace one Linphone media failure from effective NatPolicy through server resolution, candidate gathering, SDP exchange, ICE checks, selected pair and RTP before changing the account.

Read guide →