VoIP & SIP
NAT TraversalAlso known as SIP NAT, STUN, TURN and ICE
Definition
NAT traversal is the set of techniques that let VoIP signalling and media work through network address translation (NAT) routers and firewalls. Because SIP and SDP embed private IP addresses and ports inside messages, calls through NAT often fail or have one-way audio unless STUN, TURN, ICE, SBCs or keep-alives are used.
Why NAT breaks VoIP
A NAT router rewrites the source address of outgoing packets but not the addresses written inside SIP headers and SDP. The far end therefore sends RTP audio to a private address such as 192.168.1.20, which never arrives. NAT bindings also expire when idle, so inbound calls stop reaching a device after a few minutes.
Classic symptoms: one-way or no audio, calls dropping after about 30 seconds (no ACK reached the device), and registrations that work but inbound calls that do not.
Techniques
| Technique | Standard | What it does |
|---|---|---|
| STUN | RFC 8489 | Lets a client discover its public IP and port |
| TURN | RFC 8656 | Relays media through a public server when no direct path works |
| ICE | RFC 8445 | Tests candidate paths (host, STUN, TURN) and picks the best |
| rport | RFC 3581 | Server replies to the source address the request came from |
| Keep-alives | RFC 5626 / OPTIONS | Keep NAT bindings open between calls |
| Media anchoring | SBC / media relay | Server-side fix that sends RTP back to where it came from |
WebRTC builds ICE in and requires it. For SIP phones and PBXs, the most robust fix is usually an SBC or a PBX configured with its external address and a defined RTP port range forwarded on the firewall. Disabling “SIP ALG” on consumer routers resolves many unexplained faults.
NAT and mobile gateways
Gateways at branch sites almost always sit behind NAT. Designs where the gateway keeps an outbound connection to a cloud platform, instead of accepting inbound connections, avoid most of these problems. That is the model GSMCalls uses for multi-site deployments; see multi-site GSM gateways.
Frequently asked questions
What causes one-way audio in VoIP?
Most often NAT: SDP advertises a private address or an RTP port is blocked by a firewall, so audio only reaches one side.
Should I disable SIP ALG?
In most cases yes. Consumer-router SIP ALGs frequently rewrite SIP incorrectly and cause registration and audio problems.
What is the difference between STUN and TURN?
STUN only discovers your public address so you can send media directly. TURN relays the media through a server when a direct path is impossible.