If VoIP system inside masqueraded (by NAT) LAN can not connect to SIP server and prefer to use STUN, then disable netfilter «SIP magick» by unloading helpers modules. 1) 2)
helpers