Hi! I have profile named default: sofia status profile default ================================================================================================= Name default Domain Name N/A Auto-NAT false DBName sofia_reg_default Pres Hosts 172.31.1.100,172.31.1.100 Dialplan XML Context default Challenge Realm auto_from RTP-IP 172.31.1.100 Ext-RTP-IP <EXT_ADDR> SIP-IP 172.31.1.100 Ext-SIP-IP <EXT_ADDR> URL sip:mod_sofia@<EXT_ADDR>:5060 BIND-URL sip:mod_sofia@<EXT_ADDR>:5060;maddr=172.31.1.100;transport=udp,tcp HOLD-MUSIC local_stream://moh OUTBOUND-PROXY N/A CODECS IN PCMA,PCMU,G729 CODECS OUT PCMA,PCMU,G729 TEL-EVENT 101 DTMF-MODE rfc2833 CNG 13 SESSION-TO 0 MAX-DIALOG 0 NOMEDIA false LATE-NEG false PROXY-MEDIA false ZRTP-PASSTHRU false AGGRESSIVENAT true Also: sip-ip [172.31.1.100] sip-port [5060] rtp-ip [172.31.1.100] dialplan [XML] user-agent-string [ASTPP] debug [0] sip-trace [no] tls [false] inbound-reg-force-matching-username [true] disable-transcoding [true] all-reg-options-ping [false] unregister-on-options-fail [true] log-auth-failures [true] status [0] inbound-bypass-media [false] inbound-proxy-media [false] disable-transfer [true] enable-100rel [false] rtp-timeout-sec [400] dtmf-duration [2000] manual-redirect [true] aggressive-nat-detection [true] enable-timer [false] minimum-session-expires [120] session-timeout-pt [1800] auth-calls [true] apply-inbound-acl [default] inbound-codec-prefs [PCMA,PCMU,G729] outbound-codec-prefs [PCMA,PCMU,G729] inbound-late-negotiation [false] sip-capture [no] forward-unsolicited-mwi-notify [false] context [default] rfc2833-pt [101] rtp-timer-name [soft] hold-music [local_stream://moh] manage-presence [true] presence-hosts [172.31.1.100,172.31.1.100] presence-privacy [false] inbound-codec-negotiation [generous] auth-all-packets [false] ext-rtp-ip [<EXT_ADDR>] ext-sip-ip [<EXT_ADDR>] rtp-hold-timeout-sec [1800] force-register-domain [172.31.1.100] force-subscription-domain [172.31.1.100] force-register-db-domain [172.31.1.100] challenge-realm [auto_from] nonce-ttl [60] pass-callee-id [false] rtcp-audio-interval-msec [5000] local-network-acl [localnet.auto] NDLB-force-rport [true] But problem is, when client tries to connect to FS, it still answers to port 5060, not looking on NDLB-force-rport option. As well, as private addresses shown across packets, not using ext-sip and ext-rtp options. ------------------------------------------------------------------------ recv 378 bytes from udp/[136.169.20.219]:3589 at 19:54:34.619718: ------------------------------------------------------------------------ REGISTER sip:172.31.1.100:5060 SIP/2.0 Via: SIP/2.0/UDP 192.168.0.101:5060;branch=z9hG4bK322184305 From: <sip:6399081327@172.31.1.100:5060>;tag=1569039960 To: <sip:6399081327@172.31.1.100:5060> Call-ID: 1500202051@192.168.0.101 CSeq: 197 REGISTER Contact: <sip:6399081327@192.168.0.101:5060>;expires=5 Max-Forwards: 30 User-Agent: dble Expires: 5 Content-Length: 0 ------------------------------------------------------------------------ send 571 bytes to udp/[136.169.20.219]:5060 at 19:54:34.619864: ------------------------------------------------------------------------ SIP/2.0 401 Unauthorized Via: SIP/2.0/UDP 192.168.0.101:5060;branch=z9hG4bK322184305;received=136.169.20.219 From: <sip:6399081327@172.31.1.100:5060>;tag=1569039960 To: <sip:6399081327@172.31.1.100:5060>;tag=jD7SQFyXcK1gr Call-ID: 1500202051@192.168.0.101 CSeq: 197 REGISTER User-Agent: ASTPP Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, NOTIFY, PUBLISH, SUBSCRIBE Supported: path, replaces WWW-Authenticate: Digest realm="172.31.1.100", nonce="7d83af94-2a69-40cc-a9c3-1659945a34b2", algorithm=MD5, qop="auth" Content-Length: 0 Can you please point what I’m missing? Thanks! Regards, Igor