How to connect SIP through NAT?

Question

SIP

We connected a sip number (from the A1 provider, this is RB, maybe someone came across it), we pulled a separate cable and inserted it into the Mikrotik (in ether5).
There is a wiring diagram. but in reality we have such a scheme that it is immediately connected to Mikrotik, and from it it was planned via NAT to the PBX (but the system administrator got sick, we are trying to solve it ourselves somehow)
On the van interface 10.166.98.102/30
Gateway 10.166.98.101/30
At the level of IP transport registered routes 10.126.17.231/ 10.126.17.233/ 10.126.49.231/ 10.126.49.231.
And everything is pinged from Mikrotik, even from the PBX (ATS server 192.168.1.21) is pinged. But here sip does not connect. Tried with NAT:
/ip firewall filter add chain=forward dst-add=192.168.1.21 protocol=udp dst-port=5060,10000-20000 action=accept
/ip firewall nat add chain=dstnat in-interface=ether5 protocol=udp dst-port=5060 action=netmap to-address=192.168.1.21 to-port=5060 /
ip firewall service set sip disabled=no
and can you tell me what's wrong?

Answer 1

From the SIP provider to the telephony server, you prescribed the rules, but where are the rules from the telephony server to the SIP provider?
Traffic from the PBX to the provider must be masked (NAT). the SIP provider does not have a route to 192.168.1.21.

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether5 src-address=192.168.1.21

RTP must be thrown out. you have enabled SIP ALG (/ip firewall service set sip disabled=no)

/ip firewall nat add chain=dstnat in-interface=ether5 protocol=udp dst-port=10000-20000 action=netmap to-address=192.168.1.21 to-port=10000-20000