First of all, it is necessary to load the nathelper module and configure its parameters. Put the following into the configuration file to load the module:

loadmodule "/usr/local/lib/ser/modules/nathelper.so"

Then set the following parameters:

# We will you flag 6 to mark NATed contacts
modparam("registrar", "nat_flag", 6)

# Enable NAT pinging
modparam("nathelper", "natping_interval", 60)

# Ping only contacts that are known to be
# behind NAT
modparam("nathelper", "ping_nated_only", 1)

The first parameter tells the registrar module which flag should be used to mark contacts behind NAT. Second parameter is interval (in seconds) for keep alive messages (to keep the NAT bindings open), and the last parameter specifies that only contacts that are behind NAT should be pinged.

To check if the sender of a message is behind NAT, we will put the following test at the beginning of the main routing section of the configuration file (right after the test for too large messages):

# special handling for NATed clients; first, nat test is
# executed: it looks for via!=received and RFC1918 addresses
# in Contact (may fail if line-folding used); also,
# the received test should, if complete, should check all
# vias for presence of received
if (nat_uac_test("3")) {
    # allow RR-ed requests, as these may indicate that
    # a NAT-enabled proxy takes care of it; unless it is
    # a REGISTER

    if (method == "REGISTER" || ! search("^Record-Route:")) {
        log("LOG: Someone trying to register from private IP, rewriting\n");

        # This will work only for user agents that support symmetric
        # communication. We tested quite many of them and majority is
        # smart smart enough to be symmetric. In some phones, like
        # it takes a configuration option. With Cisco 7960, it is
        # called NAT_Enable=Yes, with kphone it is called
        # "symmetric media" and "symmetric signaling". (The latter
        # not part of public released yet.)

        fix_nated_contact(); # Rewrite contact with source IP of signalling
        if (method == "INVITE") {
            fix_nated_sdp("1");  # Add direction=active to SDP
        };
        force_rport();  # Add rport parameter to topmost Via
        setflag(6);     # Mark as NATed
    };
};

The test does exactly what was described in previous sections.

At the end of the processing we also need to perform similar test for the callee and force using of RTP proxy if necessary. Because there can be potentially many places in an average configuration script from which we send out messages (all occurrences of the t_relay() or forward() actions), we will put the whole test into a separate route section and call the section instead of t_relay():

#
# Forcing media relay if necessary
#
route[1] {
    if (uri=~"[@:](192\.168\.|10\.|172\.16)" && !search("^Route:")){
        sl_send_reply("479", "We don't forward to private IP addresses");
        break;
    };
    if (isflagset(6)) {
        force_rtp_proxy();
        t_on_reply("1");
        append_hf("P-Behind-NAT: Yes\r\n");
    };

    if (!t_relay()) {
        sl_reply_error();
        break;
    };
}


onreply_route[1] {
    if (status =~ "(183)|2[0-9][0-9]") {
        fix_nated_contact();
        force_rtp_proxy();
    };
}

The route section checks if flag 6 (marks NAT) is set and if it is set then it will force using of the RTP proxy. We will also setup an onreply_route section which will process 200 OK messages (we also need to rewrite the “Contact” header field and SDP body in the reply).