I need some help to better understand how networks work, ports, and communication. Suppose we have this situation:

enter image description here

We have on the left a corporate network (let's call it "A") which has a DMZ with a server exposed to the public Internet (public IP), and on the right another corporate network (let's call it "B").

Commonly corporate networks has Symmetric NAT (isn't that correct?).

My goal is to create a video conference application to let a host in A communicate a host in B.

Talking about VoIP, is it enough to install a VoIP proxy server (e.g. Asterisk) in to let hosts communicate? I would open the required ports for for inbound and outbound traffic. Do I need TURN or STUN? I hope I've been enough clear, but the situation it's not clear to me, so in case help me to better explain.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 7 '17 at 13:51
  • A STUN/TURN server will definitely be required if the VoIP proxy server is hosted publically. But since its DMZ, here if you use a STUN server that will solve your problem otherwise it will work only if connection is initiated by host at site B. – enZyme Aug 31 '17 at 9:41

If peer "B" sends a request first to start a session then no STUN/TURN is required in your case because the request will be directly forward to peer "A" by DMZ server and it won't be blocked by NAT firewall.

  • But if peer "A" wants to start the session and sends the request to peer "B" then request will be blocked because peer "B" is behind the NAT and there is no DMZ server available for peer "B" which can forward incoming request of peer "A" to peer "B".For this TURN server will be required because it is symmetric NAT.

Learn more how STUN/TURN servers work: Understanding WEBRTC MEDIA CONNECTIONS — ICE, STUN, AND TURN


First lets clear up a few misconceptions. Corporate networks do not necessarily use NAT. If they do use NAT, it is not necessarily symmetric NAT. There are many different corporate network designs. Many corporations own large blocks of public addresses which are used for services facing the public Internet. Some corporations use things like MPLS VPNs to connect sites within the corporation or to other, partner businesses.

The VoIP application and server type you use needs to work with the network designs, and there are many network designs. This is too large a subject to be discussed here.

You may, or may not, need TURN or STUN. That depends on the VoIP application used and the network design.

In your example drawing, a very likely scenario is that A and B would establish a VPN across the public Internet to allow things like VoIP to communicate seamlessly. This is especially true for sites within the same corporation. If these are two separate companies, it is more likely that each has VoIP connecting to the public telephone system through SIP trunks, and will connect calls to the other company that way. Some companies need closer ties, and they will use a VPN to provide connection across the public Internet.

  • I'm trying to explain better my problem. In my scenario A and B are 2 separate companies, and no VPN can be used. A want to own a Voip server (e.g. Asterisk), and would place it in the server That would solve NAT traversal problem for hosts in A's LAN in my mind...but what about hosts present in B's LAN? Will them be able to start a communication with or do I need a second server in B? – rok Nov 9 '15 at 13:12
  • Separate companies would not share a VoIP server, each would have its own. Each company would probably have SIP trunking or TDM circuits into its VoIP system to let it get to the PSTN, and that is how each would contact the other if a VPN is not allowed. You just don't send traffic like VoIP unprotected across the Internet. – Ron Maupin Nov 9 '15 at 14:40
  • Bypassing privacy issues.. is it not technically possible for a host in the LAN of B to use the asterisk server of A to call a host in the LAN of A? Is there any NAT traversal problem? The asterisk server would be exposed to internet (located in a DMZ). – rok Nov 9 '15 at 14:58
  • This site is not designed for such discussions. This sort of discussion is meant to be in the chat room. This is getting too broad to discuss here. The Help Center has guidance on how to ask a proper question. – Ron Maupin Nov 9 '15 at 15:03

Unless you create a VPN between the sites/companies you will need some edge gateways with STUN/TURN functionality. Have a look at WebRTC. They have a really nice introductory site with examples and labs.

Not the answer you're looking for? Browse other questions tagged or ask your own question.