Start with the failed media direction
One-way audio is a directional packet problem: one receiver is not receiving usable RTP from the address and port it expects. Name the broken direction before changing configuration. “Caller hears callee but callee cannot hear caller” means the caller-to-callee media direction is failing; it does not automatically identify which NAT boundary or SDP advertisement is wrong.
Read the INVITE SDP offer
INVITE sip:+12025550123@sip.example.net SIP/2.0
Via: SIP/2.0/UDP 198.51.100.20:5060;branch=z9hG4bK-example1
Call-ID: nat-test-001@example.com
CSeq: 101 INVITE
Content-Type: application/sdp
v=0
o=asterisk 1001 1001 IN IP4 198.51.100.20
s=Example call
c=IN IP4 198.51.100.20
t=0 0
m=audio 12466 RTP/AVP 0 8 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000The session-level c= line advertises the address where the offerer expects media; m=audio advertises port 12466, RTP profile and payload types. If either value names an unreachable internal address, signaling can succeed while audio fails. Confirm whether a media-level c= overrides the session value.
Compare the 200 OK answer
SIP/2.0 200 OK
Via: SIP/2.0/UDP 198.51.100.20:5060;branch=z9hG4bK-example1
Call-ID: nat-test-001@example.com
CSeq: 101 INVITE
Content-Type: application/sdp
v=0
o=peer 2002 2002 IN IP4 203.0.113.10
s=Example answer
c=IN IP4 203.0.113.10
t=0 0
m=audio 18042 RTP/AVP 0 101
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000| Sender | Destination | Expected evidence |
|---|---|---|
| Asterisk | 203.0.113.10:18042 | Outbound UDP packets increase during speech. |
| Peer | 198.51.100.20:12466 | Inbound UDP packets arrive and are accepted by Asterisk. |
| Endpoint leg | Its negotiated address/port | Separate SDP and capture confirm both directions. |
Map observed behavior to PJSIP options
[transport-udp-nat]
type=transport
protocol=udp
bind=0.0.0.0:5060
local_net=192.0.2.0/24
external_signaling_address=198.51.100.20
external_media_address=198.51.100.20
[carrier-endpoint]
type=endpoint
aors=carrier-aor
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yeslocal_net defines addresses treated as local when rewriting; external signaling and media addresses describe the reachable side of NAT. rtp_symmetric sends media to the observed source, force_rport uses the request source for SIP responses, and rewrite_contact records a reachable source rather than an unusable Contact. direct_media=no keeps Asterisk between endpoints. These controls solve different observations and should not be toggled as a bundle without evidence.
[remote-phone]
type=endpoint
media_address=198.51.100.20
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
direct_media=nomedia_address can affect the address placed in SDP for an endpoint in supported versions. Verify availability and interaction with transport external media settings in the installed release. A wrong forced address can break otherwise correct local calls.
Packet-driven workflow
sudo tcpdump -ni any host 203.0.113.10 and udp portrange 10000-20000 -w /tmp/example-rtp.pcap
sudo tcpdump -nnr /tmp/example-rtp.pcap 'udp'
sudo asterisk -rx "rtp set debug on"
# place one controlled call
sudo asterisk -rx "rtp set debug off"Sent RTP packet to 203.0.113.10:18042 (type 00, seq 004221, ts 160320)
Got RTP packet from 203.0.113.10:18042 (type 00, seq 008017, ts 321600)Sent RTP packet to 203.0.113.10:18042 ...
# no corresponding "Got RTP" lines during the same intervalCapture on the interface nearest each boundary when possible. Compare packet source/destination to negotiated SDP rather than merely counting UDP. RTP debug can be noisy; scope the call window, turn it off immediately, and protect captures because payloads and identifiers may be sensitive.
One-way-audio decision matrix
| Observation | Likely boundary | Next verification |
|---|---|---|
| Wrong public address in local SDP | Asterisk NAT advertisement | Inspect transport local_net/external_media_address. |
| Correct SDP, no inbound UDP at host | Network/peer/firewall path | Capture outside firewall and confirm peer destination. |
| UDP reaches host, Asterisk shows no received RTP | Local firewall, port range or demultiplexing | Match rtp.conf and socket ownership. |
| Asterisk receives and sends RTP, endpoint hears nothing | Endpoint leg or codec/playout | Capture endpoint leg and inspect negotiated payload. |
| Media begins then changes after re-INVITE | Dialog update/direct media | Compare SDP before and after re-INVITE. |
| SRTP on one side, RTP on other unexpectedly | Encryption negotiation | Inspect media_encryption and crypto/fingerprint attributes. |
Verify the correction
Repeat one controlled call and preserve its Call-ID. Confirm the offer and answer contain reachable addresses, both directions produce packets at the negotiated ports, Asterisk reports received and sent RTP, and audio is intelligible for at least the test duration. Validate DTMF separately because telephone-event payload negotiation can fail while speech works. A ping or an Available endpoint is not media proof.
Common failures and false leads
A firewall that permits SIP but not RTP creates a classic silent call. Symmetric NAT can change source ports. A peer may send media from an address different from signaling. Container or cloud security groups can add another boundary. Direct media can move RTP away from Asterisk after answer. Codec mismatch can sound like a path failure but will be visible in payload negotiation. Silence suppression and brief calls can mislead packet counts; use a deliberate voice test.
Rollback and recovery
Restore the previous transport and endpoint blocks from the reviewed backup, reload only the affected PJSIP configuration when supported, and repeat the baseline test. Remove temporary capture files under the retention policy and turn off RTP/SIP debug. If the change altered firewall rules, delete only the numbered rule created for the test and verify the remaining policy. Do not leave a widened RTP range as a diagnostic workaround.
NAT address rewriting and media symmetry for an observed topology.
Private or translated addresses otherwise become unusable SDP destinations.
Reachable SDP plus packets in both negotiated directions.
Offer/answer comparison, narrow capture and RTP debug.
Locate the first boundary where the expected packet disappears.
Restore prior endpoint/transport and exact firewall rule set.
Captures may contain voice and identifiers; NAT flags do not replace access control.
Related engineering resources
Authoritative references
Implementation closure
Observed missing direction, offer and answer SDP, endpoint/public addresses, NAT ownership, permitted RTP range, and a synchronized packet-capture window.
PJSIP NAT/media options and firewall/NAT rules only at the first boundary proven wrong by packets.
Change one evidenced boundary, reload only if that option supports reload, and repeat the same controlled call. A blind restart is not a diagnostic step.
Negotiated SDP advertises reachable addresses and ports, RTP packets traverse both directions, and both parties hear the test audio.
Capture on both sides of the suspected boundary and compare packet direction, source, destination, SSRC, and timing.
Stop when the missing direction is not named, captures are not authorized, or the proposed fix widens network access without packet evidence.
Two-way media is reproduced across repeated calls, signaling remains healthy, temporary capture access is removed, and the exact corrected boundary is recorded.