Why are SIP calls via my server silent?

Question

I have FreeSWITCH SIP server up and running. It has public IP and sits behind 1-to-1 NAT (it's Amazon EC2 instance actually).

I can connect to it, make a call to other endpoint (namely, my android device to my pc and vice versa) and signals are send with no problems (call, answer, hangup, etc). Unfortunately, and what drives me crazy, that's all: no audio gets through, no video either.

Server does not throw errors, it reports many retransmission though, looks like this:

switch_rtp.c:915 [ zrtp engine]: WARNING! HELLO Max retransmissions count reached (20 retries). ID=15

Codecs are set up correctly (same config worked locally on my LAN). NAT/firewall on client side may be a problem, signals do get through (perhaps due to fixed port, data streaming runs on random one, that is currently my best bet). STUN/TURN/ICE setting on client seem to have no effect. Endpoints sit behind symmetric NAT. On server there are no iptables rules, security group is set as suggested there: http://wiki.freeswitch.org/wiki/Firewall

Help, please. How to make it work or at least diagnose what's wrong?

Answer 1

Silence means no RTP, double check your firewall settings

Also check if you have correct public IP addresses in SDP section of SIP responses, EC2 instances are behind NAT

tcpdump and wireshark are your firends here

Answer 2

Research part: (thanks Matthias, tcpdump log analysis helped) When communicating client-server signal part of session was routed to correct IPs (and that's what I checked first time), while media were not (that I didn't notice, argh). RTP streams were headed to 10...* network (server's private IP) and to 192.168.. net (my computer private IP). Easy to spot once you know what are you looking for.

Solution consisted of two parts. First, I had to disable ALG support on my home router, because it interfered with STUN my client used to break through the NAT. Basically, what STUN managed to find out, ALG reversed. After that simple change, RTP from server were directed to correct address.

Second, it occured to me after setting up SECOND server that I missed configuring external IPs in FreeSWITCH config for internal profile. Manual here: http://wiki.freeswitch.org/wiki/Amazon_ec2 is correct, I just somehow managed to omit two lines in suggested config. Basically, vanilla configuration with changes described in quoted link do work for me.