T.38 pass-thru with SPA 3102

I’m struggling with this so I thought I’d reach out to the community. Here’s the details:

Freepbx 2.9.12
Asterix 1.8.14
Linksys SPA 3102

My Freepbx server is colocated on a public IP and my SPA 3102 is Natted behind our office router. I’ve set t38pt_udptl=yes and t38pt_usertpsource=yes in sip_general_custom.conf. My faxes are all failing. After combing the logs I think it has to do with this:

[2012-11-30 17:53:27] VERBOSE[25957] chan_sip.c: Got T.38 offer in SDP in dialog [email protected]

[2012-11-30 17:53:27] VERBOSE[25957] chan_sip.c: Got T.38 Re-invite without audio. Keeping RTP active during T.38 session.

To me that says it’s trying to send the audio stream back to 192.168.0.159 which of course is the internal IP address of the 3102.

I also see this in the logs:

a=T38FaxVersion:0
a=T38MaxBitRate:14400
a=T38FaxRateManagement:transferredTCF
a=T38FaxMaxDatagram:400
a=T38FaxUdpEC:t38UDPFEC
a=T38FaxVersion:0
a=T38MaxBitRate:14400
a=T38FaxRateManagement:transferredTCF
a=T38FaxMaxBuffer:200
a=T38FaxMaxDatagram:200
a=T38FaxUdpEC:t38UDPRedundancy

But then it eventually fails. I’ve tried every combo I can think of to try and get that IP address in the SDP dialog to change.

Has anyone else come across this issue?