Howto:VOIP through NAT routers

Abstract

This page discusses NAT traversal of VOIP.

Introduction

VOIP signaling involves the exchange of IP addresses. Signaling addresses and media addresses RTP or T.38).

If the signaling crosses network borders you may get in trouble with private IP addresses. If a private signaling endpoint hands-out a private IP address (signaling or media) the external endpoint won't be able to reach that IP address.

What will work

The only reliable way to get the whole thing working is to handle the problem on the private network.
Keep your private signaling endpoint from hand-out private IP addresses.

What you need

You need a fullcone NAT router and a STUN server in the public network.

How to configure

Configure the public STUN server on your private signaling endpoint. It will use STUN to create a NAT mapping on the fullcone NAT router. It will then hand-out the mapped IP addresses (signaling and media) instead of the private ones.

What may work

It MAY work even if the private signaling endpoint does not care about giving private IP addresses to the external endpoint, but only if the external endpoint has implemented a special workaround for NAT-unaware devices.

What you need

You need a NAT router that at least do symmetric NAT.

How to configure

Nothing to do on the private equipment. The private signaling endpoint will hand-out private IP addresses.
The external endpoint will detect and ignore all private IP addresses/ports and will reply to that IP address/port where it receives from (signaling and media).
It won't work if the internal endpoint does not work symmetrically (signaling and media)!
All innovaphone devices work symmetrically (signaling and media).

What won't work

Outgoing T.38 fax through symmetric NAT routers WILL NOT work, since the external called party is responsible to start communication with the fax answer tone indication. On the other hand the external endpoint must wait for the internal endpoint to send a T.38 packet in order to know where to send the fax answer tone indication.

Note: To overcome this problem by default our Gateways when switch to t.38 they send "no-signal" packets so the other side knows were to send the traffic.