I have a FreeSWITCH server that lies behind a NAT on the server side. While usual SIP-Calls (using UDP) are working, I'm facing issues when it comes to the WebSocket Server. While specifying the external IP in the profile definition (<param name="ext-sip-ip" value="$${external_rtp_ip}"/>), on WebSocket the server sends the private instead of the public ip. The reverse proxying is done using nginx.
As I didn't found an answer on the web, I hope you can help me!

Here is a snippet of the ws communication (FreeSWITCH is answering the INVITE; 172.XX.42.1 is the private gateway and public nginx server; 172.XX.0.3 is the private IP the FreeSWITCH server uses):

    SIP/2.0 200 OK
    Via: SIP/2.0/WS ii6c2sdshbua.invalid;branch=z9hG4bK7579777;received=172.XX.42.1;rport=43567
    From: <sip:13c0f2b0-b5b8-4822-afe6-38930cddc646@domain.tld>;tag=8a01krubf0
    To: <sip:a3352c35-7a6d-4c9e-aeea-1a5f74e90b6f@domain.tld>;tag=p2K9pvtH70Nmm
    Call-ID: l6ijpvvic6l1ung778sr
    CSeq: 6213 INVITE
    Contact: <sip:a3352c35-7a6d-4c9e-aeea-1a5f74e90b6f@PUBLIC.IP:5060;transport=udp>
    User-Agent: FreeSWITCH-mod_sofia/1.3.4-n20140511T185316Z-1~trusty+1+git~20140509T214701Z~7e0995d069~64bit
    [...]
    o=FreeSWITCH 1403358295 1403358296 IN IP4 172.XX.0.3
    s=FreeSWITCH
    c=IN IP4 172.XX.0.3
    [...]
    a=ice-pwd:6MXY3JdpOCdmDT9W
    a=candidate:0823320109 1 udp 659136 172.XX.0.3 25176 typ host generation 0

The nginx proxy configuration looks like the following:
  location /sip {
    access_log off;
    proxy_pass http://172.XX.0.3:5066;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    # WebSocket support (nginx 1.4)
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_redirect off;
  }


What configuration options do I have to set, so that FreeSWITCH uses the public IP for candiate creation and all other occurences instead of the private one?
Or is it easier to adjust nginx configuration to replace the IP?

Kind regards
Bernhard