FortiGate behind ISP NAT (double NAT) – Yeastar S20 SIP trunks not working despite VIPs

[Yanis]

Hi,

I’m having an issue with a Yeastar S20 IPPBX behind a FortiGate in a double NAT setup, and I’m looking for help.

The FortiGate is behind an ISP modem (not in bridge mode). The Yeastar is behind the FortiGate, and SIP trunks connect it to other Yeastar systems on remote sites.

When the Yeastar is connected directly behind the ISP modem (without the FortiGate), the SIP trunks work fine.
Once the Yeastar is placed behind the FortiGate, the trunks no longer establish, even though:

• all required SIP/RTP ports are opened,

• VIPs and firewall policies are correctly configured,

• ports are forwarded on both the ISP modem and the FortiGate.

I suspect the issue is related to double NAT or SIP/NAT handling on the FortiGate or ISP modem.

If anyone has experience with Yeastar + FortiGate + SIP in NAT environments, I would really appreciate any guidance or advice on how to make this work properly.

Thanks in advance

[yderek]

@Yanis  Hi, Yanis 

Is your firewall VIP and policy been hit correctly? Do you see the hit count in the policy and VIP object ? 

How's firewall VIP object looks like ? can you upload the output here ? 

====================

show firewall policy xx ---> replace xx with policy ID 

show firewall vip 

====================

Can you also check whether you have SIP ALG enabled or not ? Upload the command below 

====================

show full  system settings | grep voip
show full  system session-helper | grep sip

====================

[Yanis]

Hi, thanks for your reply.

Here are the outputs you requested regarding SIP ALG and SIP session-helper:

show full system settings | grep voip
default-voip-alg-mode kernel-helper-based
gui-voip-profile disable

show full system session-helper | grep sip
(no output)

So on this FortiGate, both SIP ALG and SIP session-helper are currently disabled.

Regarding VIPs and policy:

show firewall policy 1
- name: POLICY-VOIP-YEASTAR
- NAT: enable
- service: ALL

show firewall vip
- VIPs for SIP 5060/5061 (TCP/UDP) and RTP 10000-12000 mapped to 192.168.98.100

The VIP and the policy are being hit correctly.

When the Yeastar PBX is directly behind the ISP modem, the SIP trunks register successfully.
When placed behind the FortiGate (double NAT scenario), the trunks fail to register, even though forwarding is working.

[Yanis]

@yderek 

Here are additional screenshots to clarify the configuration.

1 — Traffic logs show that SIP traffic is hitting the FortiGate and is being DNATed to the PBX (192.168.98.100) and accepted by firewall policy 1.

2 — Firewall policy configuration confirms NAT is enabled with Preserve source port (Fixed‑port), which avoids source port translation for SIP/RTP.

3 — VIP configuration confirms that SIP (5060/5061 TCP+UDP) and RTP (10000‑12000 UDP) are correctly forwarded to the Yeastar PBX, and VIPs are grouped under the same policy.

So at this stage, the FortiGate:

✔ receives SIP
✔ forwards SIP
✔ does not apply SIP ALG
✔ preserves SIP source ports