T.38 and NAT: can it work?

Just wondering if anyone has had any success with T.38 working through NAT. I have this setup and it does not work:

Fax -> SPA 2102 -> NAT Router -> Internet -> Asterisk 1.8 PBX -> Asterisk 10 gateway -> PRI

However, if I use my VPN tunnel everything works great:

Fax -> SPA 2102 -> Tunnel -> Asterisk 1.8 PBX -> Asterisk 10 gateway -> PRI

Voice calls work no problem through NAT, and from what I can see the UDPTL packets use the same port as RTP packets do. So I’m not sure why RTP gets back in and UDPTL doesn’t.