News

News

NAT Traversal for VoIP: STUN, TURN, and ICE Explained

VoIP often fails behind NAT because SIP controls the call but RTP carries the audio—and NAT hides the private IP the endpoints think they should use. STUN, TURN, and ICE are the tools that fix this.

Definition: NAT traversal is the set of techniques that let VoIP signaling and media cross a Network Address Translation boundary so internal phones can call external ones.

The three helpers

Tool Role When used
STUN Discover public IP:port Most home/office NATs
TURN Relay media when direct fails Symmetric NAT / strict firewalls
ICE Negotiate best path (STUN then TURN) Endpoint candidates

Why SIP needs help

SIP messages embed the private IP in the SDP. Without correction, the far end tries to send RTP to an unreachable address. STUN reveals the public mapping; an SBC or ALG rewrites the SDP so media flows.

Practical fixes

  • Enable SIP ALG only if it works—many break SIP; prefer an SBC.
  • Use an SBC at the edge to handle NAT and security uniformly.
  • For remote workers, use a VPN or TURN relay.
  • Set consistent RTP ports and open UDP ranges on the firewall.

Newrock perspective

A Newrock SBC terminates NAT and normalizes SIP/RTP for both on-prem and remote users, removing the need to juggle ALG settings per site.

FAQ

Is STUN enough?

For typical NAT yes; for symmetric/strict NAT you need TURN relay or an SBC.

Does an SBC replace STUN/TURN?

It performs the NAT handling centrally, so endpoints behind it don't each need their own traversal config.

Why is one-way audio common?

Classic NAT/SDP mismatch—fix with SBC or correct NAT settings.

UDP or TCP for SIP/RTP?

SIP often UDP or TCP; RTP is UDP. Keep both allowed through the firewall.

Conclusion

NAT is the #1 cause of VoIP one-way-audio and registration failures. An SBC (or correct STUN/TURN/ICE) solves it cleanly and centrally.

Customer-centric, focus on customer value

Consult now

Copyright © New Rock Technologies, Inc. All Rights Reserved. 沪ICP备15008515号-1