NATted calls not working anymore

1. Brekeke Product Name and Version:
Brekeke SIP Server, Version 3.9.5.8, Standard
2. Java version:
Version 8 Update 161
3. OS type and the version:
Win7 64 bits
4. UA (phone), gateway or other hardware/software involved:
Snom phone connected thru VPN to BSS
Grandstream phone behind NAT
BSS has public and private IP interfaces
5. Your problem:
I used not to have problems with phones behind NAT.
NAT traversal > Keep address/port mapping is set to "On"
RTP exchanger > RTP relay is set to "Auto"

Now I'm not able anymore to call the UAs behind NAT from my UA in the VPN. I'm getting timeouts.
All UAs are registering ok.

Here's the outgoing packet:
INVITE sip:900890002@192.168.15.19:11542 SIP/2.0
Via: SIP/2.0/UDP 200.139.100.100:5060;branch=z9hG4bK11128064fae2-30-170442
Via: SIP/2.0/UDP 10.33.31.106:5060;branch=z9hG4bK-86s767kowetc;rport=5060
From: "Connect" <sip:890000@>;tag=a9wwiu8jj4
To: <sip:900890002@200.139.100.100;user=phone>
Call-ID: 313538383837343530303237343336-67yw78zov1qa
CSeq: 1 INVITE
Max-Forwards: 69
Contact: <sip:900890000@200.139.100.100:5060;line=mig21oq4>;reg-id=1
c=IN IP4 200.139.100.100

Rule:
registered=sip:900890002(sip:900890002@192.168.15.19:11542/UDP) & Connect

Source IP:
10.33.31.106:5060 (UDP)

Destination IP:
200.168.45.78:11542 (UDP)

Wireshark shows the target packets being sent to the private IP (192.168.15.19), not the public IP (200.168.45.78 )


Dial Plan:
Matching Patterns
$request = ^INVITE
To = sip:8900(..)@
From = sip:9008900(..)@

Deploy Patterns:
$auth = false
To = sip:9008900%1@
From = sip:8900%2@

Calls from NATted devices to devices in the VPN are working.

I've done a upgrade/reinstall of the software (saving webapps directory) to correct the Apache vulnerability

Any idea what could be wrong? New BSS version issue?

Udo

The Grandstream phones are GS Wave Android softphones. They can be on open internet or behind a WiFi router: in any case they can call the phones in the VPN, but the can't be called UNLESS they are in the same LAN, in which case 2 of them can talk to each other.
So it seems to be an issue with Far End NAT traversal.

BR

Udo

Dear Uhupfeld,
Im sorry for this post not relate to your post.
But it very difficult for newbie same me. I post a subject to forum but not received support. Now i have problem with connection from smartphone to Voip Brekeke SIP.
Could you support me, please?

Im sorry if it make bother to you and thank you so much!

uhupfeld,

> NATted calls not working anymore

Did the issue start happening after you upgraded the SIP Server?
Are you using the same configuration/DialPlan as the before the upgrade?
Did you change VPN's routing settings?


> Wireshark shows the target packets being sent to the private IP (192.168.15.19), not the public IP (200.168.45.78 )

Are you sure that 900890002's REGISTER request was sent from 200.168.45.78?
If not, there is no way to know 900890002's destination is 200.168.45.78... so you must tune the DialPlan to specify the destination.

Hi Truong,

Thank you for using Brekeke product.
This is a user community forum not for official technical support.

If you request a official technical support from our team, please contact support@brekeke.com to open a support ticket.

Thank you

Do you have any settings at "External IP address pattern" or/and "Internal IP address pattern" in Configuration>System page?

Hello Mohney,

I'm not 100% sure that the software update broke it or if something just changed. As mentioned, I did a few actions. Also Windows was updated.
What I've noticed after further testing:
a) GS Wave has real problems. I can make calls to NATted Snom phones and to Zoiper android phones on 4G and WiFi, but it doesn't receive any calls when connected to BSS. A Zoiper phone in the same Android phone works without problems. Could be an interoperability issue?
b) Zoiper is back to work. Still, now all configurations require Outbound Proxy set to ON: the WiFi (NATted) configuration but also the open 4G internet configuration require it.
I used to be able to make calls between UAs on open internet without Outbound Proxy set. This doesn't seem possible now.
Yet BSS recognized NAT: in the REGISTER packets it correctly differentiates when the Zoiper phone is registering through VPN (no NAT) or through 4G (NAT on)

Dial Plan is the same. Just added a specific rule to handle these tests.

Something is different, just don't know exactly what.

BR

Udo

Hello Niloc,

Both are empty.
I've handled VPNs in a different way, I'm using a very efficient SD-WAN solution...

BR

Udo

Let you find the 900890002's registration record at SIP Server's "Registered Clients" page. And paste "Contact URI (Source IP Address)" field here.

Hello Niloc,

Now that we discarded GS Wave and with Zoiper we turned on Outbound Proxy, the internal IP addresses don't show up anymore.

sip:900890002@200.168.45.78:60263
(200.168.45.78:60263)

BR

so an INVITE can reach to 200.168.45.78 now?

Yes, as I've said before, Zoiper with Outbound Proxy works.
GS Wave doesn't, in LAN or with Outbound Proxy (though it works with Sipgate ITSP)

Here is the registration message:
REGISTER sip:200.139.100.200;transport=TCP SIP/2.0
Via: SIP/2.0/TCP 192.168.15.78:60250;branch=z9hG4bK-524287-1---baf4950235607d0a;rport=43757;received=177.97.221.199
Max-Forwards: 70
Contact: <sip:900890002@177.97.221.199:43757;transport=TCP;rinstance=240b4118d3ecbeef>
To: <sip:900890002@200.139.100.200;transport=TCP>
From: <sip:900890002@200.139.100.200;transport=TCP>;tag=8efa691d
Call-ID: 8lmXhSrfSsPI17cBTCCTOA..
CSeq: 7 REGISTER
Expires: 600
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
User-Agent: Zoiper rv2.10.8.4
Authorization: Digest username="900890002",realm="sip.xxx.com.br",nonce="ba36c5cb08bff0541c0b159327a7e43411c0d3f0",uri="sip:200.139.100.200;transport=TCP",response="464543050f8fa88144fa144bd72acc88",algorithm=MD5
Allow-Events: presence, kpml, talk
P-Behind-NAT: Yes
Content-Length: 0

And on the IPs I have:
Source IP: 177.97.221.199:43757 (TCP)
Destination IP: n/a

The private IP is 192.168.15.78, but the public IP is being used for communication.

BR

Do you have a REGISTER packet sent from GS Wave ?
If so, paste it here.

I had to reinstall GS Wave.
Here is the info from 'Registered Clients':
sip:900890099@10.33.31.66:50702
(179.55.81.134:50702)
Expires : 60 Priority : 1000
User Agent : Grandstream Wave 1.0.3.34
Transport : UDP
Time Update : Fri May 08 19:14:01 BRT 2020

The REGISTER message under Dial Plan > History shows:
REGISTER sip:sip.xxx.com.br SIP/2.0
Via: SIP/2.0/UDP 10.33.31.66:50702;branch=z9hG4bK1942630536;rport=50702;received=179.55.81.134
From: <sip:900890099@sip.xxx.com.br>;tag=1930510972
To: <sip:900890099@sip.xxx.com.br>
Call-ID: 705204645-50702-1@BA.DD.DB.GG
CSeq: 2008 REGISTER
Contact: <sip:900890099@10.33.31.66:50702>;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B82204036>"
Max-Forwards: 70
User-Agent: Grandstream Wave 1.0.3.34
Supported: path
Expires: 60
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE, MESSAGE
P-Behind-NAT: Yes
Content-Length: 0

Source IP: 179.55.81.134:50702 (UDP)
Destination IP: n/a

And here is the attempt to call the GS Wave behind NAT from the Snom phone in the VPN:
Source IP 10.33.31.106:5060 (UDP) (Snom phone)
Destination IP 179.55.81.134:50702 (UDP) (GS Wave)

Outgoing packet (towards GS Wave):
INVITE sip:900890099@10.33.31.66:50702 SIP/2.0
Via: SIP/2.0/UDP 200.139.100.200:5060;branch=z9hG4bK80b84eb1feec-30-1a350f
Via: SIP/2.0/UDP 10.33.31.106:5060;branch=z9hG4bK-mf1rc8umtrxk;rport=5060
From: "Udo Connect" <sip:890000@>;tag=u7c1ktllm1
To: <sip:900890099@200.139.100.200;user=phone>
Call-ID: 313538383937363336383235303932-e1l3vlqcz7xx
CSeq: 1 INVITE
Max-Forwards: 69
Contact: <sip:900890000@200.139.100.200:5060;line=mig21oq4>;reg-id=1
X-Serialnumber: 00041346028A
P-Key-Flags: resolution="31x13", keys="4"
Accept: application/sdp
Allow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, SUBSCRIBE, PRACK, MESSAGE, INFO, UPDATE
Allow-Events: talk, hold, refer, call-info
Supported: timer, 100rel, replaces, from-change
Session-Expires: 3600
Min-SE: 90
Record-Route: <sip:200.139.100.200:5060;ftag=u7c1ktllm1;lr>
Content-Type: application/sdp
Content-Length: 468

v=0
o=root 881364913 881364913 IN IP4 200.139.106.228
s=call
c=IN IP4 200.139.100.200

Here is the attempt to call from the GS Wave to the Snom phone (VPN). This call is successful:
Source IP: 179.55.81.134:50702 (UDP)
Destination IP: 10.33.31.106 (UDP)

Incoming package:
INVITE sip:890000@sip.ipcall.com.br SIP/2.0
Via: SIP/2.0/UDP 10.33.31.66:50702;branch=z9hG4bK476107558;rport=50702;received=179.55.81.134
Route: <sip:sip.xxx.com.br:5060;lr>
From: <sip:900890099@sip.xxx.com.br>;tag=1443794579
To: <sip:890000@sip.xxx.com.br>
Call-ID: 842585135-50702-2@BA.DD.DB.GG
CSeq: 10 INVITE
Contact: <sip:900890099@10.33.31.66:50702>
Max-Forwards: 70
User-Agent: Grandstream Wave 1.0.3.34
Privacy: none
P-Preferred-Identity: <sip:900890099@sip.xxx.com.br>
Supported: replaces, path, timer, eventlist
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE, MESSAGE
Accept: application/sdp, application/dtmf-relay
P-Behind-NAT: Yes
Content-Type: application/sdp
Content-Length: 272

v=0
o=900890099 8000 8000 IN IP4 10.33.31.66
s=SIP Call
c=IN IP4 10.33.31.66

Outgoing package:
INVITE sip:900890000@10.33.31.106:5060;line=mig21oq4 SIP/2.0
Via: SIP/2.0/UDP 10.33.30.12:5060;branch=z9hG4bK80b8b3e9fb04-30-1a350f
Via: SIP/2.0/UDP 10.33.31.66:50702;branch=z9hG4bK476107558;rport=50702;received=179.55.81.134
From: <sip:890099@>;tag=1443794579
To: <sip:900890000@10.33.30.12>
Call-ID: 842585135-50702-2@BA.DD.DB.GG
CSeq: 10 INVITE
Contact: <sip:900890099@10.33.30.12:5060>
Max-Forwards: 69
User-Agent: Grandstream Wave 1.0.3.34
Privacy: none
P-Preferred-Identity: <sip:900890099@sip.xxx.com.br>
Supported: replaces, path, timer, eventlist
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE, MESSAGE
Accept: application/sdp, application/dtmf-relay
P-Behind-NAT: Yes
Record-Route: <sip:10.33.30.12:5060;ftag=1443794579;lr>
Content-Type: application/sdp
Content-Length: 239

v=0
o=900890099 8000 8000 IN IP4 10.33.30.12
s=SIP Call
c=IN IP4 10.33.30.12


BSS:
Public IP: 200.139.100.200 (fake) = sip.xxx.com.br
Private IP: 10.33.30.12

Snom phone on VPN:
10.33.31.106

GS Wave:
Public IP: 179.55.81.134
Private IP: 10.33.31.66

Despite having Outbound Proxy set, it is as if the GS Wave wouldn't send the info.

Does BSS support Proxy-Require?

BR

Comparing the Zoiper and the GS Wave REGISTER attempts, I see the Contact field as having the private IP on the GS Wave and the public IP in the Zoiper.

When I use the provider Sipgate in the same Android phone and same GS Wave, the softphone works without problems, making and receiving calls, without the Outbound Proxy set.
The only difference I've seen in the softphone configuration is that it requires a fixed UDP port, in this case 5160.
I've changed for BSS the port to 5180 and cleared the Outbound Proxy settings, but nothing changed. It can still make calls, but not receive calls.
The fact that Sipgate doesn't require an Outbound Proxy setting in GS Wave and still works makes me go back to my feeling that something changed in BSS, because now Zoiper is requiring OB to work.

Is the INVITE to Grandstream still sent to 10.33.31.66 (private IP) instead of 179.55.81.134 (public IP)?

Who is using 200.168.45.78?

In your first post, the Destination IP filed indicates 200.168.45.78... so the SIP Server tried to send the INVITE to there not 192.168.15.19.
Did you change VPN or OS's routing settings?

Yes, it is still sending the INVITE to 10.33.31.66.

The devices behind 200.168.45.78 are now Zoiper using OB.
We gave up on GS Wave there...
It is the network 192.168.15.0

To continue the GS Wave tests I've deployed an Android with GS Wave and Zoiper at 10.33.31.66. But the public address is 179.55.81.134.
The INVITE should go to this public address.

To GS Wave (not working):
INVITE sip:900890099@10.33.31.66:5180 SIP/2.0
Via: SIP/2.0/UDP 200.139.106.228:5060;branch=z9hG4bK80b8b2fd4abc-30-1a350f
Via: SIP/2.0/UDP 10.33.31.106:5060;branch=z9hG4bK-1d5ka8g0vr2w;rport=5060
From: "Udo Connect" <sip:890000@>;tag=j5hvkv7cab
To: <sip:900890099@200.139.106.228;user=phone>
Call-ID: 313538383938373530383334353335-bvkwn0st16wu
CSeq: 1 INVITE
Max-Forwards: 69
Contact: <sip:900890000@200.139.106.228:5060;line=mig21oq4>;reg-id=1

To Zoiper (working)
INVITE sip:900890077@179.55.81.134:33255;transport=UDP;rinstance=d206c6145cb2c57c SIP/2.0
Via: SIP/2.0/UDP 200.139.100.200:5060;branch=z9hG4bK80b828df7902-30-1a350f
Via: SIP/2.0/UDP 10.33.31.106:5060;branch=z9hG4bK-vcr6p6ufla4g;rport=5060
From: "Udo Connect" <sip:890000@>;tag=f2sj7pso6t
To: <sip:900890077@200.139.100.200;user=phone>
Call-ID: 313538383938383034393439353730-0g2mtqgn3ydm
CSeq: 1 INVITE
Max-Forwards: 69
Contact: <sip:900890000@200.139.100.200:5060;line=mig21oq4>;reg-id=1

There is something else now: Zoiper was able to receiva a call even without OB!
This is the registration:
REGISTER sip:sip.ipcall.com.br;transport=UDP SIP/2.0
Via: SIP/2.0/UDP 10.33.31.66:33255;branch=z9hG4bK-524287-1---4801a75caa1cb6d0;rport=33255;received=179.55.81.134
Max-Forwards: 70
Contact: <sip:900890077@179.55.81.134:33255;transport=UDP;rinstance=d206c6145cb2c57c>
To: "890077"<sip:900890077@sip.xxx.com.br;transport=UDP>
From: "890077"<sip:900890077@sip.xxx.com.br;transport=UDP>;tag=4443e55b
Call-ID: asEf_9Y-vobLU8iGojy6Yg..
CSeq: 7 REGISTER
Expires: 60
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
User-Agent: Zoiper rv2.10.8.4
Authorization: Digest username="900890077",realm="sip.xxx.com.br",nonce="dac52a024cbcd854800b322c20bfeed40cfdc91b",uri="sip:sip.ipcall.com.br;transport=UDP",response="721dc36b76c5e70eb122bbcb532f8db0",algorithm=MD5
Allow-Events: presence, kpml, talk
P-Behind-NAT: Yes
Content-Length: 0

This is the 'Registered Clients' info:
sip:900890077@179.55.81.134:33255
(179.55.81.134:33255)

It looks like I've turned off Outbound Proxy but OB is still active...

I´ll restart the phone to clean the memory...

After phone reboot Zoiper is still working without OB Proxy... The registration is now ok.
This is crazy... I didn't touch with BSS or Zoiper, just turned OB Proxy off, but now the registration isn't offering the private IP!
It recognizes as NAT but offers only the public IP address for communication!

Registration is good:
sip:900890077@179.55.81.134:59237
(179.55.81.134:59237)

GS Wave is still bad:
sip:900890099@10.33.31.66:5180
(179.55.81.134:5180)

BR

Where is the Outbound Proxy located? Which product is it?

> GS Wave is still bad:
> sip:900890099@10.33.31.66:5180
> (179.55.81.134:5180)

It seems that the BSS recognizes the Source IP Address is 179.55.81.134.
Is an INVITE sent to the private IP address 10.33.31.66 still?

Where did you run Wireshark for monitoring packets?

The Outbound Proxy is BSS itself.

Still sending INVITEs to the private IP in the case of GS Wave...

Wireshark is being run at BSS machine.

Let you look at the SIP Server's log...

Additional situation:
Linphone, despite being recommended by Brekeke, is also not taking calls. It makes calls, but doesn´t receive them.
In the desktop versions, the phones just crash. In the case of Android softphones, the Linphone softphone sends after the INVITE, back to BSS the message "400 Bad request", without any further info. The message isn't passed along to the caller phone, which can be ANY phone, even another Linphone.
The caller phone just waits until timeout.
The call doesn't show up in the Dial Plan History.
In the session logs I have this (call from 900890033 to 900890066):

============================================
Rule@1 [Ramais Connect]
Pattern: $request = ^INVITE
Input: $request = INVITE sip:890066@Vsip.ipcall.com.br SIP/2.0
Result: true

Pattern: To = sip:8900(..)@
Input: To = sip:890066@Vsip.ipcall.com.br
%1 <= 66
Result: true

Pattern: From = sip:9008900(..)@
Input: From = <sip:900890033@Vsip.ipcall.com.br>;tag=xBgXGopAn
%2 <= 33
Result: true

============================================

registrar: lookuped: 'sip:900890066' as 'sip:900890066@10.33.31.68:57226' (27637)
session.9387: sipex.9386: start: from=<sip:900890033@Vsip.ipcall.com.br> to=<sip:900890066@10.33.30.12>

session.9387: information:
starttime = 05/12/20 21:42:10.703
timestamps = 05/12/20 21:42:10.622 (12) 05/12/20 21:42:10.634 (32) 05/12/20 21:42:10.666
spiral-hop = 1
dispatcher-id = 1
plugin = com.brekeke.net.sip.sv.session.plugins.InviteSession
request = INVITE sip:890066@Vsip.ipcall.com.br SIP/2.0
rulename = registered=sip:900890066(sip:900890066@10.33.31.68:57226/UDP) & Ramais Connect
org:From: = sip:900890033@Vsip.ipcall.com.br
new:From: = sip:890033@
org:To: = sip:890066@Vsip.ipcall.com.br
new:To: = sip:900890066@10.33.30.12
src:addr/port = 10.33.31.76:63572 (TCP local-addr)
src:interface = 10.33.30.12:5060 (TCP local-addr)
src:con:plugin= tcp-con.76: com.brekeke.net.sip.sv.transport.tcp.SIPtcpConnection (if:10.33.30.12:5060)
dst:addr/port = 10.33.31.68:57226 (UDP local-addr)
dst:interface = 10.33.30.12:5060 (UDP local-addr)
uac:user-agent= LinphoneW10/3.12.0-273-g20efb4ad4 (belle-sip/1.6.3)
uas:user-agent= LinphoneAndroid/4.2.3 (GT-I9192) LinphoneSDK/4.3.3 (tags/4.3.3^0)
Mirroring = off
mode:B2BUA = off
mode:RTPrelay = auto
mode:Auth = off (user-required)
mode:NAT = auto

session.9387: phase=0: Initializing
session.9387: System Used Memory = 12215
session.9387: Transport-Listener-cnt=1

session.9387: receive: from=UAC:10.33.31.76:63572(TCP/tcp-con.76: ) at 05/12/20 21:42:10.708
==============================================
INVITE sip:890066@Vsip.ipcall.com.br SIP/2.0
Via: SIP/2.0/TCP 10.33.31.76:63572;branch=z9hG4bK.yv54ifjqZ;rport=63572
From: <sip:900890033@Vsip.ipcall.com.br>;tag=xBgXGopAn
To: sip:890066@Vsip.ipcall.com.br
CSeq: 20 INVITE
Call-ID: ubwwWB15U5
Max-Forwards: 70
Supported: replaces, outbound
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO, UPDATE
Contact: <sip:900890033@10.33.31.76:63572;transport=tcp>;+sip.instance="<urn:uuid:6c321a1f-d43b-4a26-8d09-d541a32bc72d>"
User-Agent: LinphoneW10/3.12.0-273-g20efb4ad4 (belle-sip/1.6.3)
Content-Type: application/sdp
Content-Length: 518

v=0
o=900890033 303 15 IN IP4 10.33.31.76
s=Talk
c=IN IP4 10.33.31.76
t=0 0
a=rtcp-xr:rcvr-rtt=all:10000 stat-summary=loss,dup,jitt,TTL voip-metrics
m=audio 7076 RTP/AVP 96 97 98 0 8 18 101 99 100
a=rtpmap:96 opus/48000/2
a=fmtp:96 useinbandfec=1
a=rtpmap:97 speex/16000
a=fmtp:97 vbr=on
a=rtpmap:98 speex/8000
a=fmtp:98 vbr=on
a=fmtp:18 annexb=yes
a=rtpmap:101 telephone-event/48000
a=rtpmap:99 telephone-event/16000
a=rtpmap:100 telephone-event/8000
a=rtcp-fb:* trr-int 5000
a=rtcp-fb:* ccm tmmbr

==============================================

session.9387: content-type=application/sdp plugin=com.brekeke.net.content.application.Sdp

session.9387: pkt#=1 dp=1 st=0 sip:900890033@Vsip.ipcall.com.br(10.33.31.76:63572) --> sip:900890066@10.33.30.12(10.33.31.68:57226)
send="INVITE sip:900890066@10.33.31.68:57226;transport=udp SIP/2.0"

session.9387: phase=1: Inviting
session.9387: processtime=104

session.9387: send: to=UAS:10.33.31.68:57226(UDP) at 05/12/20 21:42:10.727
==============================================
INVITE sip:900890066@10.33.31.68:57226;transport=udp SIP/2.0
Via: SIP/2.0/UDP 10.33.30.12:5060;branch=z9hG4bK89789044b777-30-1a51a3
Via: SIP/2.0/TCP 10.33.31.76:63572;branch=z9hG4bK.yv54ifjqZ;rport=63572
From: <sip:890033@>;tag=xBgXGopAn
To: sip:900890066@10.33.30.12
CSeq: 20 INVITE
Call-ID: ubwwWB15U5
Max-Forwards: 69
Supported: replaces, outbound
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO, UPDATE
Contact: <sip:900890033@10.33.30.12:5060>;+sip.instance="<urn:uuid:6c321a1f-d43b-4a26-8d09-d541a32bc72d>"
User-Agent: LinphoneW10/3.12.0-273-g20efb4ad4 (belle-sip/1.6.3)
Record-Route: <sip:10.33.30.12:5060;ftag=xBgXGopAn;lr>
Content-Type: application/sdp
Content-Length: 518

v=0
o=900890033 303 15 IN IP4 10.33.31.76
s=Talk
c=IN IP4 10.33.31.76
t=0 0
a=rtcp-xr:rcvr-rtt=all:10000 stat-summary=loss,dup,jitt,TTL voip-metrics
m=audio 7076 RTP/AVP 96 97 98 0 8 18 101 99 100
a=rtpmap:96 opus/48000/2
a=fmtp:96 useinbandfec=1
a=rtpmap:97 speex/16000
a=fmtp:97 vbr=on
a=rtpmap:98 speex/8000
a=fmtp:98 vbr=on
a=fmtp:18 annexb=yes
a=rtpmap:101 telephone-event/48000
a=rtpmap:99 telephone-event/16000
a=rtpmap:100 telephone-event/8000
a=rtcp-fb:* trr-int 5000
a=rtcp-fb:* ccm tmmbr

==============================================

session.9387: stat: result=undefined(6) close=false
> +--------------+--------------+--------------+--------------+
> | 20 INVITE | | 20 INVITE | |
> +--------------+--------------+--------------+--------------+
> 1/1 0/0 1/1 0/0
> ResendStat: INVITE(20),

session.9387: receive: from=UAC:10.33.31.68:57226(UDP) at 05/12/20 21:42:11.055
==============================================
SIP/2.0 400 Bad request
Via: SIP/2.0/UDP 10.33.30.12:5060;branch=z9hG4bK89789044b777-30-1a51a3
Via: SIP/2.0/TCP 10.33.31.76:63572;branch=z9hG4bK.yv54ifjqZ;rport=63572
To: <sip:900890066@10.33.30.12>;tag=ep74s
Call-ID: ubwwWB15U5
CSeq: 20 INVITE
Content-Length: 0


==============================================

session.9387: failed: no request: CSeq=20 INVITE res=400
session.9387: stat: result=undefined(6) close=false
> +--------------+--------------+--------------+--------------+
> | 20 INVITE | | 20 INVITE | |
> +--------------+--------------+--------------+--------------+
> 1/1 0/0 1/1 0/0

Any idea what is wrong?

And here is the complete log of the issue with the GS Wave softphone (@10.33.31.66 internal IP - but using NAT - 900890099@sip.xxx.com.br):
- Registration
- Call from 900890000 (in the VPN) to 900890099 (NATted)

Please note:
In Wireshark I see a sequence of 6 INVITE, going to the public IP but trying to talk to the private IP:
529 10.33.30.12 179.55.81.134 SIP/SDP 1401 Request: INVITE sip:900890099@10.33.31.66:5180 |
- Internet Protocol Version 4, Src: 10.33.30.12, Dst: 179.55.81.134
- INVITE sip:900890099@10.33.31.66:5180 SIP/2.0

register.14: processing: rule=register
register.14: recv: at 05/12/20 22:07:02.811
==============================================
REGISTER sip:sip.xxx.com.br SIP/2.0
Via: SIP/2.0/UDP 10.33.31.66:5180;branch=z9hG4bK1225455834;rport=5180;received=179.55.81.134
From: <sip:900890099@sip.xxx.com.br>;tag=321082301
To: <sip:900890099@sip.xxx.com.br>
Call-ID: 701694228-5180-1@BA.DD.DB.GG
CSeq: 2000 REGISTER
Contact: <sip:900890099@10.33.31.66:5180>;expires=0
Max-Forwards: 70
User-Agent: Grandstream Wave 1.0.3.34
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE, MESSAGE
P-Behind-NAT: Yes
Content-Length: 0


==============================================

register.14: target=local
register.14: local: failed: send response=401 policy:[realm=sip.xxx.com.br policy=6]
register.14: local: send: challenge: at 05/12/20 22:07:02.812
==============================================
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.33.31.66:5180;branch=z9hG4bK1225455834;rport=5180;received=179.55.81.134
From: <sip:900890099@sip.xxx.com.br>;tag=321082301
To: <sip:900890099@sip.xxx.com.br>;tag=b9a6adb0bs
Call-ID: 701694228-5180-1@BA.DD.DB.GG
CSeq: 2000 REGISTER
Server: Brekeke SIP Server rev.517-9
WWW-Authenticate: Digest realm="sip.xxx.com.br",nonce="693f704102b2905773086494221ea165225ef6e6",algorithm=MD5
Content-Length: 0


==============================================

register.14: local: recv re-request: at 05/12/20 22:07:02.858
==============================================
REGISTER sip:sip.xxx.com.br SIP/2.0
Via: SIP/2.0/UDP 10.33.31.66:5180;branch=z9hG4bK318215825;rport=5180;received=179.55.81.134
From: <sip:900890099@sip.xxx.com.br>;tag=321082301
To: <sip:900890099@sip.xxx.com.br>
Call-ID: 701694228-5180-1@BA.DD.DB.GG
CSeq: 2001 REGISTER
Contact: <sip:900890099@10.33.31.66:5180>;expires=0
Authorization: Digest username="900890099", realm="sip.xxx.com.br", nonce="693f704102b2905773086494221ea165225ef6e6", uri="sip:sip.xxx.com.br", response="0b9b3e3f3d3c55f2cba2d53a265c2a90", algorithm=MD5
Max-Forwards: 70
User-Agent: Grandstream Wave 1.0.3.34
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE, MESSAGE
P-Behind-NAT: Yes
Content-Length: 0


==============================================

registrar: lookuped: 'sip:900890099' is not found.
registrar: deleted: 'sip:900890099' as 'sip:900890099@10.33.31.66:5180 at 179.55.81.134:5180(UDP/NAT)' (41)
register.14: succeed: send: at 05/12/20 22:07:02.861
==============================================
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.33.31.66:5180;branch=z9hG4bK318215825;rport=5180;received=179.55.81.134
From: <sip:900890099@sip.xxx.com.br>;tag=321082301
To: <sip:900890099@sip.xxx.com.br>;tag=bd8cb1528s
Call-ID: 701694228-5180-1@BA.DD.DB.GG
CSeq: 2001 REGISTER
Server: Brekeke SIP Server rev.517-9
Expires: 0
Date: Wed, 13 May 2020 01:07:02 GMT
Path: <sip:200.139.100.200:5060;lr>
Content-Length: 0


==============================================

register.14: close: at 05/12/20 22:07:02.862
management.14: close: register: from=sip:900890099@sip.xxx.com.br at 05/12/20 22:07:02.862

============================================
PreCheck [BloqueioUserAgent]
Pattern: $str.lowercase(User-Agent) = friendly-scanner|sundayddr|sipcli/v1.8|linphone/3.7.0 (belle-sip/1.3.0)
Input: $str.lowercase(User-Agent) = grandstream wave 1.0.3.34
Result: false

============================================

============================================
Rule@1 [register]
Pattern: $request = ^REGISTER
Input: $request = REGISTER sip:sip.xxx.com.br SIP/2.0
Result: true

============================================

register.15: processing: rule=register
register.15: recv: at 05/12/20 22:07:02.919
==============================================
REGISTER sip:sip.xxx.com.br SIP/2.0
Via: SIP/2.0/UDP 10.33.31.66:5180;branch=z9hG4bK784324631;rport=5180;received=179.55.81.134
From: <sip:900890099@sip.xxx.com.br>;tag=321082301
To: <sip:900890099@sip.xxx.com.br>
Call-ID: 701694228-5180-1@BA.DD.DB.GG
CSeq: 2002 REGISTER
Contact: <sip:900890099@10.33.31.66:5180>;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B82204036>"
Authorization: Digest username="900890099", realm="sip.xxx.com.br", nonce="693f704102b2905773086494221ea165225ef6e6", uri="sip:sip.xxx.com.br", response="0b9b3e3f3d3c55f2cba2d53a265c2a90", algorithm=MD5
Max-Forwards: 70
User-Agent: Grandstream Wave 1.0.3.34
Supported: path
Expires: 60
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE, MESSAGE
P-Behind-NAT: Yes
Content-Length: 0


==============================================

register.15: target=local
registrar: registered(60): 'sip:900890099' as 'sip:900890099@10.33.31.66:5180 at 179.55.81.134:5180(UDP/NAT)' (43)
register.15: succeed: send: at 05/12/20 22:07:02.924
==============================================
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.33.31.66:5180;branch=z9hG4bK784324631;rport=5180;received=179.55.81.134
From: <sip:900890099@sip.xxx.com.br>;tag=321082301
To: <sip:900890099@sip.xxx.com.br>;tag=bbfef3dbas
Call-ID: 701694228-5180-1@BA.DD.DB.GG
CSeq: 2002 REGISTER
Server: Brekeke SIP Server rev.517-9
Contact: <sip:900890099@10.33.31.66:5180>;expires=60;q=1.0;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B82204036>"
Expires: 60
Date: Wed, 13 May 2020 01:07:02 GMT
Path: <sip:200.139.100.200:5060;lr>
Supported: path
Content-Length: 0


==============================================

register.15: close: at 05/12/20 22:07:02.924
management.15: close: register: from=sip:900890099@sip.xxx.com.br at 05/12/20 22:07:02.924

============================================
PreCheck [BloqueioUserAgent]
Pattern: $str.lowercase(User-Agent) = friendly-scanner|sundayddr|sipcli/v1.8|linphone/3.7.0 (belle-sip/1.3.0)
Input: $str.lowercase(User-Agent) =
Result: false

============================================


============================================
Rule@1 [Ramais Connect]
Pattern: $request = ^INVITE
Input: $request = INVITE sip:890099@10.33.30.12;user=phone SIP/2.0
Result: true

Pattern: To = sip:8900(..)@
Input: To = <sip:890099@10.33.30.12;user=phone>
%1 <= 99
Result: true

Pattern: From = sip:9008900(..)@
Input: From = "Connect" <sip:900890000@10.33.30.12>;tag=o520i3wi94
%2 <= 00
Result: true

============================================

registrar: lookuped: 'sip:900890099' as 'sip:900890099@10.33.31.66:5180' (43)
session.18: sipex.17: start: from=<sip:900890000@10.33.30.12> to=<sip:900890099@200.139.100.200>

session.18: information:
starttime = 05/12/20 22:07:12.743
timestamps = 05/12/20 22:07:12.612 (1) 05/12/20 22:07:12.613 (7) 05/12/20 22:07:12.620
spiral-hop = 1
dispatcher-id = 1
plugin = com.brekeke.net.sip.sv.session.plugins.InviteSession
request = INVITE sip:890099@10.33.30.12;user=phone SIP/2.0
rulename = registered=sip:900890099(sip:900890099@10.33.31.66:5180/UDP) & Ramais Connect
org:From: = sip:900890000@10.33.30.12
new:From: = sip:890000@
org:To: = sip:890099@10.33.30.12
new:To: = sip:900890099@200.139.100.200
src:addr/port = 10.33.31.106:5060 (UDP local-addr)
src:interface = 10.33.30.12:5060 (UDP local-addr)
dst:addr/port = 179.55.81.134:5180 (UDP global-addr)
dst:interface = 200.139.100.200:5060 (UDP global-addr)
uas:user-agent= Grandstream Wave 1.0.3.34
Mirroring = off
mode:B2BUA = off
mode:RTPrelay = auto
mode:Auth = off (user-required)
mode:NAT = on { Near-End-NAT Dst-Far-End-NAT }

session.18: phase=0: Initializing
session.18: System Used Memory = 9744
session.18: receive: from=UAC:10.33.31.106:5060(UDP) at 05/12/20 22:07:12.749
==============================================
INVITE sip:890099@10.33.30.12;user=phone SIP/2.0
Via: SIP/2.0/UDP 10.33.31.106:5060;branch=z9hG4bK-n02ogowa8ejm;rport=5060
From: "Connect" <sip:900890000@10.33.30.12>;tag=o520i3wi94
To: <sip:890099@10.33.30.12;user=phone>
Call-ID: 3135383933333230333236363936-gqmb4fei403s
CSeq: 1 INVITE
Max-Forwards: 70
Contact: <sip:900890000@10.33.31.106:5060;line=mig21oq4>;reg-id=1
X-Serialnumber: 00041346028A
P-Key-Flags: resolution="31x13", keys="4"
Accept: application/sdp
Allow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, SUBSCRIBE, PRACK, MESSAGE, INFO, UPDATE
Allow-Events: talk, hold, refer, call-info
Supported: timer, 100rel, replaces, from-change
Session-Expires: 3600
Min-SE: 90
Content-Type: application/sdp
Content-Length: 462

v=0
o=root 470841170 470841170 IN IP4 10.33.31.106
s=call
c=IN IP4 10.33.31.106
t=0 0
m=audio 56182 RTP/AVP 9 0 8 99 112 18 101
a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:J9Xk2CHElFo7IUd6ZHBVHMWoHgk+MPBmTK5l0HI4
a=rtpmap:9 G722/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:99 G726-32/8000
a=rtpmap:112 AAL2-G726-32/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=ptime:20
a=sendrecv

==============================================

rtp.35000: start: media=audio port=35000 (IPv4)

rtp.35000: target=10.33.31.106:56182
session.18: RTPparam: IN=0 OUT=0
session.18: content-type=application/sdp plugin=com.brekeke.net.content.application.Sdp

session.18: pkt#=1 dp=1 st=0 sip:900890000@10.33.30.12(10.33.31.106:5060) --> sip:900890099@200.139.100.200(179.55.81.134:5180)
send="INVITE sip:900890099@10.33.31.66:5180 SIP/2.0"

session.18: phase=1: Inviting
session.18: processtime=145

session.18: send: to=UAS:179.55.81.134:5180(UDP) at 05/12/20 22:07:12.758
==============================================
INVITE sip:900890099@10.33.31.66:5180 SIP/2.0
Via: SIP/2.0/UDP 200.139.100.200:5060;branch=z9hG4bK3de5d1b7cbae-30-18b2c2
Via: SIP/2.0/UDP 10.33.31.106:5060;branch=z9hG4bK-n02ogowa8ejm;rport=5060
From: "Connect" <sip:890000@>;tag=o520i3wi94
To: <sip:900890099@200.139.100.200;user=phone>
Call-ID: 3135383933333230333236363936-gqmb4fei403s
CSeq: 1 INVITE
Max-Forwards: 69
Contact: <sip:900890000@200.139.100.200:5060;line=mig21oq4>;reg-id=1
X-Serialnumber: 00041346028A
P-Key-Flags: resolution="31x13", keys="4"
Accept: application/sdp
Allow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, SUBSCRIBE, PRACK, MESSAGE, INFO, UPDATE
Allow-Events: talk, hold, refer, call-info
Supported: timer, 100rel, replaces, from-change
Session-Expires: 3600
Min-SE: 90
Record-Route: <sip:200.139.100.200:5060;ftag=o520i3wi94;lr>
Content-Type: application/sdp
Content-Length: 468

v=0
o=root 470841170 470841170 IN IP4 200.139.100.200
s=call
c=IN IP4 200.139.100.200
t=0 0
m=audio 35000 RTP/AVP 9 0 8 99 112 18 101
a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:J9Xk2CHElFo7IUd6ZHBVHMWoHgk+MPBmTK5l0HI4
a=rtpmap:9 G722/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:99 G726-32/8000
a=rtpmap:112 AAL2-G726-32/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=ptime:20
a=sendrecv

==============================================

session.18: stat: result=undefined(6) close=false
> +--------------+--------------+--------------+--------------+
> | 1 INVITE | | 1 INVITE | |
> +--------------+--------------+--------------+--------------+
> 1/1 0/0 1/1 0/0
> ResendStat: INVITE(1),

============================================
PreCheck [BloqueioUserAgent]
Pattern: $str.lowercase(User-Agent) = friendly-scanner|sundayddr|sipcli/v1.8|linphone/3.7.0 (belle-sip/1.3.0)
Input: $str.lowercase(User-Agent) = grandstream wave 1.0.3.34
Result: false

============================================

============================================
Rule@1 [register]
Pattern: $request = ^REGISTER
Input: $request = REGISTER sip:sip.xxx.com.br SIP/2.0
Result: true

============================================

register.16: processing: rule=register
register.16: recv: at 05/12/20 22:07:33.032
==============================================
REGISTER sip:sip.xxx.com.br SIP/2.0
Via: SIP/2.0/UDP 10.33.31.66:5180;branch=z9hG4bK1463155263;rport=5180;received=179.55.81.134
From: <sip:900890099@sip.xxx.com.br>;tag=321082301
To: <sip:900890099@sip.xxx.com.br>
Call-ID: 701694228-5180-1@BA.DD.DB.GG
CSeq: 2003 REGISTER
Contact: <sip:900890099@10.33.31.66:5180>;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B82204036>"
Authorization: Digest username="900890099", realm="sip.xxx.com.br", nonce="693f704102b2905773086494221ea165225ef6e6", uri="sip:sip.xxx.com.br", response="0b9b3e3f3d3c55f2cba2d53a265c2a90", algorithm=MD5
Max-Forwards: 70
User-Agent: Grandstream Wave 1.0.3.34
Supported: path
Expires: 60
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE, MESSAGE
P-Behind-NAT: Yes
Content-Length: 0


==============================================

register.16: target=local
registrar: registered(60): 'sip:900890099' as 'sip:900890099@10.33.31.66:5180 at 179.55.81.134:5180(UDP/NAT)' (46)
register.16: succeed: send: at 05/12/20 22:07:33.081
==============================================
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.33.31.66:5180;branch=z9hG4bK1463155263;rport=5180;received=179.55.81.134
From: <sip:900890099@sip.xxx.com.br>;tag=321082301
To: <sip:900890099@sip.xxx.com.br>;tag=b7303f4c3s
Call-ID: 701694228-5180-1@BA.DD.DB.GG
CSeq: 2003 REGISTER
Server: Brekeke SIP Server rev.517-9
Contact: <sip:900890099@10.33.31.66:5180>;expires=60;q=1.0;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B82204036>"
Expires: 60
Date: Wed, 13 May 2020 01:07:33 GMT
Path: <sip:200.139.100.200:5060;lr>
Supported: path
Content-Length: 0


==============================================

register.16: close: at 05/12/20 22:07:33.081
management.16: close: register: from=sip:900890099@sip.xxx.com.br at 05/12/20 22:07:33.081

session.18: receive: from=UAC:10.33.31.106:5060(UDP) at 05/12/20 22:07:42.930
==============================================
CANCEL sip:890099@10.33.30.12;user=phone SIP/2.0
Via: SIP/2.0/UDP 10.33.31.106:5060;branch=z9hG4bK-n02ogowa8ejm;rport=5060
From: "Connect" <sip:900890000@10.33.30.12>;tag=o520i3wi94
To: <sip:890099@10.33.30.12;user=phone>
Call-ID: 3135383933333230333236363936-gqmb4fei403s
CSeq: 1 CANCEL
Max-Forwards: 70
Reason: SIP;cause=487;text="Request terminated by user"
Content-Length: 0


==============================================

session.18: pkt#=2 dp=1 st=0 sip:900890000@10.33.30.12(10.33.31.106:5060) --> sip:900890099@200.139.100.200(179.55.81.134:5180)
send="CANCEL sip:900890099@10.33.31.66:5180 SIP/2.0"

session.18: send: to=UAC:10.33.31.106:5060(UDP) at 05/12/20 22:07:42.932
==============================================
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.33.31.106:5060;branch=z9hG4bK-n02ogowa8ejm;rport=5060
From: "Connect" <sip:900890000@10.33.30.12>;tag=o520i3wi94
To: <sip:890099@10.33.30.12;user=phone>;tag=bd3b7a61cs
Call-ID: 3135383933333230333236363936-gqmb4fei403s
CSeq: 1 CANCEL
Server: Brekeke SIP Server rev.517-9
Content-Length: 0


==============================================

session.18: phase=6: Closing
session.18: send: to=UAC:10.33.31.106:5060(UDP) at 05/12/20 22:07:42.932
==============================================
SIP/2.0 487 Request Terminated
Via: SIP/2.0/UDP 10.33.31.106:5060;branch=z9hG4bK-n02ogowa8ejm;rport=5060
From: "Connect" <sip:900890000@10.33.30.12>;tag=o520i3wi94
To: <sip:890099@10.33.30.12;user=phone>;tag=baf3ecf2bs
Call-ID: 3135383933333230333236363936-gqmb4fei403s
CSeq: 1 INVITE
Server: Brekeke SIP Server rev.517-9
Content-Length: 0


==============================================

session.18: status: Zombie at Closing
session.18: stat: result=Cancel(2) close=false
> +--------------+--------------+--------------+--------------+
> | | 487 | 1 INVITE | |
> +--------------+--------------+--------------+--------------+
> 0/0 0/0 1/1 0/0
> ResendStat: 487-INVITE(1),

session.18: receive: from=UAC:10.33.31.106:5060(UDP) at 05/12/20 22:07:43.087
==============================================
ACK sip:890099@10.33.30.12;user=phone SIP/2.0
Via: SIP/2.0/UDP 10.33.31.106:5060;branch=z9hG4bK-n02ogowa8ejm;rport=5060
From: "Connect" <sip:900890000@10.33.30.12>;tag=o520i3wi94
To: <sip:890099@10.33.30.12;user=phone>;tag=baf3ecf2bs
Call-ID: 3135383933333230333236363936-gqmb4fei403s
CSeq: 1 ACK
Max-Forwards: 70
Contact: <sip:900890000@10.33.31.106:5060;line=mig21oq4>;reg-id=1
Content-Length: 0


==============================================

session.18: pkt#=3 dp=1 st=0 sip:900890000@10.33.30.12(10.33.31.106:5060) --> sip:900890099@200.139.100.200(179.55.81.134:5180)
send="ACK sip:900890099@10.33.31.66:5180 SIP/2.0"

session.18: Accept ACK and doesn't forward it
session.18: stat: result=Cancel(2) close=false ( wait-retry )
> +--------------+--------------+--------------+--------------+
> | | | 1 INVITE | |
> +--------------+--------------+--------------+--------------+
> 0/0 0/0 1/1 0/0

The issue is at the registration, which makes BSS during INVITE send the packets to the right IP address but with the wrong IP in the header
And the real problem is that this happens only to GS Wave, so I can't create a rule just for this phone, as I don't know which users will use it.

Softphone summary:
Zoiper: works ok making and receiving calls.
GS Wave: makes calls, but doesn't receive them due to issues with registration
Linphone: makes calls, but doesn't receive them. In Android answers 400 Bad request, in Desktop crashes.

BR

The reason of the "400 Bad request" is the syntax error in your DialPlan rule.

From = sip:8900%2@ in Deploy Pattern must be a SIP-URI.

For example
From = sip:8900%2@200.139.100.200
or From = sip:8900%2@sip.xxx.com.br

or if you want to replace a username part of SIP-URI, you can write the definition like
From/user = 8900%2