SIP No audio/media between pbx and ATA on different vlans

Question

PBX ip (freepbx but called wazo in the pic below) = 10.10.1.76 (internal lan) 
 ATA (obi200) = 10.1.3.102 (vlan 3) 
 The ata is configured on its own vlan to isolate it from the main lan. The ata is able to connect to external sip provider (on the internet) without any signaling or media issues. 
 PBX is configured on the local network and it too works well with its configured trunks and local lan clients. 
 Goal: An extension on the pbx has been configured exclusively for the ATA's use. Firewall rule below has been set up to allow the ATA to register successfully to the PBX.

Problem: That's as far as I get. The signaling sets up correctly but RTP/media is only getting passed inbound. That is, when a call is made using the extension configured above, I can hear the other party, but they can't hear me. Firewall has been disabled in freepbx to rule that out. 
 I'm not seeing anything in the firewall log or IPS. Ideas? Thanks!

Jay Jay · Answer

Through the magic of tcpdump I discovered this: 
 20:24:58.286320 IP 10.10.1.76.14644 > 10.10.3.102.17000: UDP, length 172 20:24:58.299378 IP 10.10.3.102 .17000 > 17.142.160.59 .14644: UDP, length 172 
 17.xxxxx is not my real IP. The RTP stream wasn't going back to the PBX IP, but rather to my public ip. I thought about using a DNAT rule but that would likely cause other problems. Instead, poking around in the obi I found an option to enable symmetric RPT. 
 It's under ITSP PROVIDER x - SIP - General 
 Enable X_SymmetricRTPEnable [on/off] 
 From the obi admin guide: 
 Enable device to apply symmetric RTP behavior on every call: That is, send RTP to peer at the address where incoming RTP packets are received from 
 Tcpdump output: 
 Before: 
 20:24:58.286320 IP 10.10.1.76.14644 > 10.10.3.102.17000: UDP, length 172 20:24:58.299378 IP 10.10.3.102 .17000 > 17.142.160.59 .14644: UDP, length 172 
 After: 
 20:35:13.645291 IP 10.10.1.76.15876 > 10.10.3.102.17006: UDP, length 172 20:35:13.645818 IP 10.10.3.102 .17006 > 10.10.1.76 .15876: UDP, length 172 Problem resolved!