NAT Traversal

NAT (Network Address Translation) traversal refers to the techniques used to establish VoIP connections through firewalls and routers that translate between private and public IP addresses. NAT devices rewrite IP addresses in packet headers, which can break SIP signaling and RTP media streams because these protocols embed IP addresses within their message payloads.

How It Works in VICIdial

VICIdial’s Asterisk server addresses NAT through several mechanisms. In SIP and PJSIP configurations, the externip or external_media_address setting tells Asterisk to advertise the server’s public IP in SDP messages rather than its private IP. The localnet setting identifies which IP ranges are behind NAT so Asterisk knows when to apply address rewriting.

For agent phones behind NAT (the most common scenario with remote agents), the nat=yes or direct_media=no setting forces all RTP media through the Asterisk server rather than attempting direct media between endpoints. While this increases server load, it eliminates the one-way audio problems that direct media causes through NAT devices.

IAX2 avoids most NAT issues entirely because it multiplexes signaling and media on a single port, making it inherently NAT-friendly. This is why many VICIdial deployments use IAX2 for remote agent connections.

Why It Matters

NAT-related audio issues are the single most common problem in VICIdial deployments. One-way audio, no audio, and intermittent call drops are almost always caused by incorrect NAT configuration. The symptoms appear inconsistently — calls between agents on the local network work perfectly, but calls involving external carriers or remote agents fail.

Proper NAT configuration requires coordinating settings across Asterisk, the firewall, and the carrier. The safest approach is to place VICIdial servers on public IPs, disable direct media, and open the full RTP port range. See the VICIdial setup guide for NAT configuration checklists.