We have installed a PBX on AWS and connected it to our on-prem Router via VPN.

My on-prem router is connected to the SIP provider via a physical connection with another on-prem MUX device (device given by sip provider).

All connections are working fine, EXCEPT, my SIP provider has a condition that all connections to their server must originate from a specific IP that they have assigned to us.

Since AWS machine is connected via VPN, all calls from PBX are picking up the IP of the AWS machine as "source IP".

For resolving this, i need to replace / masquerade / NAT / change the IPs of all connections from AWS machine's IP to SIP provider's assigned IP. Someone suggested i need NAT loopback/reflection for this. Someone also suggested packet forwarding. someone suggest IP masquerading.

Please guide how can this be done?

Regards.Network Topology

vpn setup in router

wireshark capture showing source IP

  • This question is really too broad, and it seems to solicit primarily opinion-based answers, both of which are off-topic here. We nee more detailed information. See the Network Engineering Question Checklist for guidance, then edit your question. Keep in mind that your consumer-grade devices are off-topic here (e.g. DLink), as are protocols above OSI layer-4 (e.g. SIP) and host/server configurations.
    – Ron Maupin
    Oct 3, 2018 at 14:24
  • @ Ron, i think i have explained the problem clearly, but i may be wrong. I am not asking for opinions, but solutions. The main requirement is to replace or masquerade IP from AWS machine IP to my specified IP. I don't exactly know how this can be done. That is what i asked. I am not asking for device configurations. I am simply asking whats the best way to do the IP masquerading operation.
    – vichar
    Oct 4, 2018 at 6:13

1 Answer 1


It looks as though your network is already organised as a VPN, with some of it in location A (office) and some in B (AWS), and there's already NAT at the exit to the SIP provider's equipment.

You should therefore be able to achieve your goal with adjusting routing from Site B, to ensure that the traffic to SIP provider exits in the same way from Site A.

  • Thanks for the reply @jonathanjo. Can you specify what routing adjustments need to be done? That is what we are not able to get.
    – vichar
    Oct 3, 2018 at 13:44
  • We have actually specified static routes in site B, to make all traffic exit via site A. However, the source IP in the SIP connection is taken of site B machine. Whereas, we need the source IP to be of site A mux.
    – vichar
    Oct 3, 2018 at 13:46
  • You need to add the routes in everything from the PBX through to the SIP provider; it's not clear what addressing your using or what exactly the MUX unit is doing. It looks like you need a host route in, perhaps, PBX and Cisco router,
    – jonathanjo
    Oct 3, 2018 at 14:46
  • I have created a VPN between AWS vpc and cisco router. In AWS, i have given private IP of AWS machine (172.x.x.x). Since mux is connected to cisco router Wan2 port via physical cable, the router has it's IP (10.x.x.x). This private IP is also mentioned as remote connection's private IP in AWS vpn connection. So, a connection is established from AWS machine to mux directly via vpn. Hence, the source IP generated is of AWS machine (172.x.x.x) in sip connections. The requirement is the source IP should be 10.x.x.x.
    – vichar
    Oct 4, 2018 at 6:17
  • It's very hard to understand whether you mean the PBX must a) have the address of the RV942, or b) simply that it must be in the network that the MUX is in, which seems more likely as otherwise it would have to have a route to your other internal networks. To help further, you'll have to show your (sanitised) configuration so we can see exactly what's happening. In particular the routing of the VPN.
    – jonathanjo
    Oct 4, 2018 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.