How to connect SIP clients behind NAT?

Question

SIP

Good afternoon! There is a server "Awaya Office IP" in the corporate network, server address for example 10.0.0.2. An Asus RT-N12 router is connected to the network via the WAN port with a static address of 10.0.0.3. The router has NAT and DHCP enabled, which creates a 192.168.0.0/24 subnet. Inside the subnet, the client's IP phone is connected, having, for example, the address 192.168.0.2. Phone model "Awaya J129". One of the requirements of the IP provider is the availability of TCP 5061 and UDP 1024-65535 ports in both directions. Signaling occurs over TCP 5061, voice over UDP ports. I managed to redirect port 10.0.0.3:5061 to 192.168.0.2:5061 without any problems. At the moment, the client's IP phone is dialing any number. But when connecting (picking up the phone), there is no voice in both directions. Tell me - what rules could be set in the router, to allow UDP range 1024-65535 for phone [phone] ? I tried to register them in different ways, but the voice is not transmitted through NAT. Could there be another reason? Not in ports, but something else is missing in the settings? PS when connecting the phone directly to the 10.0.0.0/24 network, bypassing the router, the connection works without problems, the voice is in both directions, so the provider claims that its mission has been completed, the services are provided without restrictions and it is not going to change any settings on the server, but the problem with a router, I have to decide for myself.

Answer 1

For NAT to work properly through a router, one of the options must be configured
1) The phone must be able to make a hole in NAT. These are all sorts of technologies such as STUN, TURN and others, which are under the general term ICE
2) PBX and phone must understand that there is NAT between them - you need to make the appropriate settings both there and there.
As for port forwarding in the router, this action is not quite for this case - it is necessary when you have a single endpoint behind the router (such as ATC) where incoming calls should come (for example, from an external telephony provider)
I would recommend getting rid of NAT and DHCP, working in the router - put it in access point mode.