Hi there,

I have the following setup: RB951Ui-2nD in a standard config + LTE modem Huawei E3372. This is so called HiLink version which means it has it's own router with NAT inside with no ways to configure DMZ or whatever. RB gets a private address say 192.168.8.2 and makes a NAT for WiFi & Eth with 192.168.88.0/24.

Due to double NAT there is no way to connect a VoIP adapter or even a SIP client on any android phone connected to the WiFi.
Tried the following:
 - SIP helper (ALG) on / off in IP->Firewall. With OFF doesn't even register. With ON registers, but can't make a call or can't disconnect a call made (wtf!)
 - STUN or "keepalive" method selected in the gateway. Doesn't register with STUN, with "keepalive" - as above, registers but can't talk

Now the idea is to either:
1. Make a RB only act as a bridge so only the LTE modem would do the DHCP, NAT etc. But this is an "ugly" solution and I'd rather avoid it. (Btw. tried switching to bridge but didn't work at all, not sure what I did wrong)
2. Exclude one Ethernet port from the predefined bridge (the one for VoIP gateway), and bridge it with LTE interface so it would talk to the modem directly and would get a separate IP address, say 192.168.8.3 (just next to RB's WAN) straight from the modem and all the routing would skip RB's NAT. Do you think it would work and could you give me a step-by-step setup guide?
... or any other idea?

Make a VPN from your MikroTik to another system that is on internet without NAT.

Though about that, but I'd have to buy a dedicated paid VPN service and also the ping (delay) would increase...
Thanks anyway.
What about making one ethernet port transparent as I mentioned? Any idea how to set it up?

I just gave a presentation on SIP ALG at the Mikrotik MUM in Denver Colorado 2017 explaining everything about SIP ALG in RouterOS
watch here:
https://youtu.be/tM7wyKdnIKA

I would suggest option 2. Make a separate port (you can even use VLAN's) so the DHCP from the Huawei modem will reach your VOIP adapter.

How to do that? I realized that it's imposible to bridge LTE interface with anything else - a software limitation.