Also there are 7 remote sites connected through VPN on the Main site 10.1.1.0/24 where FreePBX is.
I ve a SIP trunk to my provider network which is registered correctly
When i make a call from SIP phone on a remote site to a mobile or another remote phone, in the traces from eth0 in the SDP packets there is an IP that its not on my network (172.16.32.26) and all the RTP packets are going to this IP address.
So what are the subnets at the remote sites? You don’t have a VPN on every phone so they are going through your VPN at the router. That means they still have IPs from their local network. What is the IP of the phone that you are testing with?
Random IPs don’t just get shoved in there. Something is doing it.