New Member

Question

FortiGate behind ISP NAT (double NAT) – Yeastar S20 SIP trunks not working despite VIPs

Forum|Forum|8 months ago
January 5, 2026
3 replies
512 views

Hi,

I’m having an issue with a Yeastar S20 IPPBX behind a FortiGate in a double NAT setup, and I’m looking for help.

The FortiGate is behind an ISP modem (not in bridge mode). The Yeastar is behind the FortiGate, and SIP trunks connect it to other Yeastar systems on remote sites.

When the Yeastar is connected directly behind the ISP modem (without the FortiGate), the SIP trunks work fine.
Once the Yeastar is placed behind the FortiGate, the trunks no longer establish, even though:

all required SIP/RTP ports are opened,
VIPs and firewall policies are correctly configured,
ports are forwarded on both the ISP modem and the FortiGate.

I suspect the issue is related to double NAT or SIP/NAT handling on the FortiGate or ISP modem.

If anyone has experience with Yeastar + FortiGate + SIP in NAT environments, I would really appreciate any guidance or advice on how to make this work properly.

Thanks in advance

yderek

Staff

@Yanis Hi, Yanis

Is your firewall VIP and policy been hit correctly? Do you see the hit count in the policy and VIP object ?

How's firewall VIP object looks like ? can you upload the output here ?

====================

show firewall policy xx ---> replace xx with policy ID

show firewall vip

====================

Can you also check whether you have SIP ALG enabled or not ? Upload the command below

====================

show full system settings | grep voip
show full system session-helper | grep sip

====================

YanisAuthor

New Member

Hi, thanks for your reply.

Here are the outputs you requested regarding SIP ALG and SIP session-helper:

show full system settings | grep voip
default-voip-alg-mode kernel-helper-based
gui-voip-profile disable

show full system session-helper | grep sip
(no output)

So on this FortiGate, both SIP ALG and SIP session-helper are currently disabled.

Regarding VIPs and policy:

show firewall policy 1 - name: POLICY-VOIP-YEASTAR - NAT: enable - service: ALL

show firewall vip - VIPs for SIP 5060/5061 (TCP/UDP) and RTP 10000-12000 mapped to 192.168.98.100

The VIP and the policy are being hit correctly.

When the Yeastar PBX is directly behind the ISP modem, the SIP trunks register successfully.
When placed behind the FortiGate (double NAT scenario), the trunks fail to register, even though forwarding is working.

Sign up

Login with SSO

Login to the community

Login with SSO