- Router
NAT Traversal with Voice over IP (VoIP)
IV. Voice-over-IP (VoIP)
Voice-over-IP (VoIP) systems are great for linking remote offices or working from home, but when working over the Internet they will typically be going through NAT (Network Address Translation), which complicates the process of making and receiving calls.
If the VoIP (SIP) call's setup gives the wrong information to either side, this will often result in calls with one-way audio or no audio, or the call could fail entirely.
Network Address Translation is practically required on the Internet because of IPv4 IP address limits. Your router performs NAT to share the single Internet IP between all devices on your internal network. The only way to avoid NAT on the Internet is for both phones (not their routers) to have public Internet IP addresses, which would be expensive and could be insecure.
NAT Traversal with Voice over IP (VoIP) & SIP
The SIP protocol (Session Initiation Protocol) used by most VoIP systems does not inherently handle Network Address Translation, unless your SIP provider offers a NAT Proxy such as DrayTel's NAT proxy configuration.
With no method for SIP to handle NAT, your phone has an internal IP address of 192.168.1.19 for example; when making a call, it will tell the phone at the other end to send a call's audio to that IP address - that's not an Internet IP address and isn't directly routable.
The SIP call's packets are routed through NAT, their IP headers and ports being translated from 192.168.1.19 to the Internet IP and the remote end by the NAT router / gateway to the Internet. Although the IP headers are changed, there are additional IP addresses specified in SIP's SDP (Session Definition Protocol) packets, which define where to route the call's RTP (Real Time Protocol) audio packets to.
The NAT router / gateway will not normally alter the IP addresses in the SIP SDP packets, which will still point to that local 192.168.1.19 IP address. This can result in one-way audio, or no audio at all because the remote phone being called will attempt to send its audio to the 192.168.1.19 address, which isn't routable across the Internet.
To resolve this, either the phone needs to know its Internet IP address, to give that address when making calls, or its Internet NAT router / gateway will need to amend the phone's SIP packets so that they have the correct address.
The sections below detail some possible methods that can be used to help SIP calls to work through NAT:
VoIP Phone & SoftPhone NAT Traversal |
Methods for NAT traversal that can be implemented on a VoIP Phone or SoftPhone. Recommended where the IP-Phone or SoftPhone won't always be connected to the same router, or where it's not possible to implement NAT traversal on the router, for instance a 4G connection. |
NAT Traversal on the Router |
Methods of NAT traversal that can be implemented at the router or network level. Recommended for use with networks that have a number of fixed VoIP phones connecting through the router. |
VoIP Phone & SoftPhone NAT Traversal
Where the SIP client, either a SoftPhone app or IP-Phone, will routinely be connecting through different networks - for instance going from your home's Wi-Fi to 4G Internet, it's best to have the SIP client itself handle the NAT traversal because the router it's connecting through may not have any SIP/NAT traversal set up.
There are two primary methods for achieving this from the SIP client, without modifying any router settings, which are described in the table and sections below:
| Method | STUN Server | SIP Outbound Proxy |
|---|---|---|
| What does it do? | When registering and making / receiving calls, the IP-Phone checks with the configured STUN Server what Internet IP address it is using and what type of NAT it is located behind | All outgoing SIP calls are routed through the proxy, which handles the NAT translation of SIP & RTP packets |
| Recommended Usage |
|
|
| Limitations |
|
|
STUN Server
A STUN (Session Traversal Utilities for NAT) server allows a NAT-ted client to contact it and check what type of NAT the client is located behind, along with the public IP address it's using. It does this independently of the router it's connecting through, which makes it ideal for devices that move between networks frequently.
Once the IP-Phone or SoftPhone's SIP client has determined the Internet IP address the call is being routed through, it can then set the correct IP address to send call audio to.
It sets this in the SIP-SDP (Session-Definition-Protocol) packet, which contains the call's information, including the number it's calling from, the number it's calling and the IP address that the call's audio will be sent to.
STUN servers can operate over TCP or UDP and typically use UDP port 3478. If your SIP provider doesn't have a STUN server available, there are some public STUN servers available that can be used for this purpose. Because of the STUN server's important role in both making and receiving calls once set up, the SIP client may be unable to make or receive calls if the STUN server can not be contacted or has high latency / packet loss.
In the example below, the call proceeds once the STUN server has responded with the requested information, at which point the IP-Phone proceeds to call the remote phone, with the correct Internet IP address in its SIP-SDP packets:
Some SIP providers have provisions for handling NAT through the use of a SIP Outbound Proxy server.
All of the SIP client's SIP messages are routed through this proxy and are modified by the Proxy server to be able to make and receive calls through a network that has no other NAT traversal (such as SIP-ALG).
For instance DrayTel provide the "nat.draytel.org" server on port 5065 to handle SIP calls going through NAT-ted networks.
Is there an outgoing Proxy for DrayTEL ?
Check your SIP provider's setup information for an Outbound Proxy setting, it's possible that they provide one for handling NAT connections.
SIP Outbound Proxy
NAT Traversal on the Router
DrayTek routers provide a number of facilities to handle SIP calls and VoIP phones, which can assist with traversing the router's Network Address Translation or bypassing NAT entirely where possible. This can assist in the setup of many phones on a network that would be permanently connected through the DrayTek Vigor router, so that the router itself and the network design can be configured to either handle SIP when going through NAT, or by using the router's capabilities to create routed links between VoIP phones and their PBX system.
Some possible methods are explained in the table and sections below:
| Method | SIP-ALG | VPN Tunnel | Port Forwarding | IPv6 |
|---|---|---|---|---|
| What does it do? | Inserts the correct Internet IP address in place of internal addresses and translates it for incoming & outgoing packets | Creates a direct routed link between two networks, avoiding the need for NAT between these two points |
Forwards any incoming traffic on the specified ports to the specified IP phone or PBX system Forward SIP on UDP 5060 and the RTP range specified by the device |
IPv6 does not use NAT, calls are routed directly to the remote PBX server or SIP provider |
| Recommended Usage |
Connecting IP-Phones in an office to a hosted PBX or SIP provider |
Linking a remote worker / branch office to a central PBX system |
Forwarding incoming SIP packets & RTP audio to a single fixed IP address of a PBX system or IP-Phone |
Connecting IP-Phones in an office to a hosted PBX or SIP provider |
| Limitations |
|
|
|
|
SIP ALG - Session Initiation Protocol Application Layer Gateway
The SIP-ALG is a router level 'NAT-Helper' which performs additional packet level translation for SIP packets to aid in routing the SIP messages and RTP audio through the router's NAT. It does this by altering the packets going from the LAN to the WAN; replacing the references to internal IP addresses and ports in the SIP packets with the router's Internet IP and the correct port information. The return packets are translated back to the internal IP address so the VoIP phone is not directly aware of the change.
The benefit of this is that when enabled, IP phones making calls through the router require no additional set up of proxy or STUN servers to successfully make and receive calls, which is ideal for connecting fixed location VoIP desk phones that will always be connected through the router, to their SIP provider or hosted PBX.
DrayTek routers with SIP-ALG enabled are designed to handle a large number of SIP sessions, up to 256 active at one time. This is typically sufficient for most VoIP phone & network implementations but can be exceeded with some network configurations or VoIP phone configurations, particularly if there are a large number of BLF (Busy Lamp Field) indicators configured on many VoIP desk phones.
This feature can be enabled from the [NAT] > [ALG] menu on the router, where the SIP and RTP ALGs can be enabled. The listening ports and protocols to manage (TCP/UDP) can be configured, if your network uses a port other than 5060 to for SIP. This requires 3.8.5 or later firmware, for older firmware versions, see this guide:
Below are two examples of how calls are handled with and without the router's SIP-ALG enabled, assuming that there is no other NAT traversal method configured:
| SIP ALG Enabled | SIP ALG Disabled |
|---|---|
 |
 |
VPN Tunnel
It is possible to avoid NAT by using a VPN Tunnel, which creates a secure and encrypted tunnel between two networks (LAN-to-LAN VPN), or a remote device and a network (Teleworker VPN). With a VPN set up, both sides are linked as if connecting locally, so there is no translation of IP addresses required, which avoids the need for any NAT traversal.
For an example, a DrayTek VigorBX 2000 IP-PBX / router in the main office could connect a LAN-to-LAN VPN tunnel to a remote office's DrayTek Vigor 2762 router. IP Phones connected into to the Vigor 2762 router would register with the PBX system without being affected by NAT. The VPN tunnel itself may be passing over a NAT-ted connection, but the calls passing through the VPN tunnel will work as though going across a local network.
The limitation of this method is that both the VoIP phone and PBX system must be able to connect to each other through the VPN, like the Vigor 2762 and VigorBX 2000 example above. With a hosted PBX system, it wouldn't typically be possible to create a VPN link between the router and the hosted PBX, and would instead be going over the NAT-ted Internet connection to reach the hosted PBX system.
Port Forwarding
If there is a single IP-Phone or PBX system that needs to be able to receive calls, the router can be configured to send all incoming SIP calls and their RTP audio in to that address. To do this, set up a port forward on the router in a [NAT] > [Open Ports] entry, which allows opening up to 10 different ranges of ports to a single internal IP address.
In the example below, any incoming traffic on UDP ports 5060 for SIP and UDP ports 10000-20000, which are an example of an RTP port range. The RTP range can vary between devices so check the RTP port range on your device and match that setting on the router.
If the DrayTek Vigor router has an integrated VoIP ATA (i.e. 2862Vac), disable the router's internal VoIP ATA from the [VoIP] > [General Settings] menu, otherwise the internal VoIP ATA will be listening on UDP port 5060, taking precedence over the NAT port forwarding configuration.
While this does allow incoming calls to be routed through directly to the SIP client device (PBX or phone), it does not handle the information in the SIP packets for incoming and outgoing calls, therefore it must be used in combination with SIP-ALG, STUN or a SIP proxy to send correct address information when making and receiving calls.
Routing calls over IPv6
DrayTek Vigor routers provide IPv4 & IPv6 dual-stack connectivity to each LAN subnet and if the ISP supports IPv6 Internet connectivity, this means that every device on the IPv6 side of the router's LAN can make use of a directly routable IPv6 address. The IPv6 address space is so large that it allows all devices on the LAN to be provided an IPv6 routable IP address, with ISPs typically providing a /56 subnet which has billions of individual addresses. This large address space eliminates the need for and usage of NAT when using pure IPv6 connectivity.
Similarly to using a VPN, it requires both parties to be using IPv6 address space or some additional gateway to translate between IPv4 and IPv6 networks, which will likely be necessary until more of the Internet transitions onto IPv6 networks. If two offices have IPv6 Internet access, VoIP phones configured to use IPv6 should be able to make and receive calls without requiring NAT helpers such as STUN or SIP-ALG
How do you rate this article?
Add a comment to this article
NOTE : All comments are reviewed before publication and may not be posted or may be redacted if the editors do not consider them helpful. The use of offensive or obscene language, copyrighted material, or advertising or promotion or linking to any other product or service is prohibited. By submitting your comment, you confirm that you are the original author and assign copyright of the content to DrayTek indefinitely and irrevocably.
