Multiple subnet NAT problem

I have recently amended a working Trixbox setup to add an extra subnet, and incurred some audio problems.

Previously, I had a single server with two NICs, one WAN (eth0) and one LAN (eth1). There were 3 extensions working off the LAN side and three trunks working through the WAN interface. All the extensions could talk to eath other and could dial out or receive incoming traffic from each trunk. The server also operated a Linux firewall with exceptions for incoming traffic through eth0 on UDP ports 5004-5081 and 10001-20000.

I had some LAN congestion issues so I needed to separate the phone and data traffic. I started this by migrating one of the extensions to a new subnet on a new NIC (eth2). The other extensions are left on eth1.

Trixbox uses a sip_nat.conf file that includes both the eth1 and eth2 subnets:
externip=86.xx.xx.xx
localnet=192.168.2.0/255.255.255.0 ; eth2
localnet=192.168.1.0/255.255.255.0 ; eth1
nat=yes

The two subnets can talk to each other (ping etc) but I only get audio to work from eth2 to eth1. There is no audio from eth1 to eth2. The phones ring OK in either direction. Similarly, external calls into eth2 make the phone ring but no incoming audio. Using tcpdump, I can show that the lack of audio corresponds with the lack of rtp traffic.

I can change the situation if I change the nat line in each extension's configuration (which are set to nat=never in the original set up). If I change an extension in the eth2 subnet so that nat=route, I can now get audio on calls from that extension to another extension within the eth1 subnet (where nat is still set to 'never'). But calls from the eth1 extension to the eth2 extension do not give audio in either direction, even though the phone rings.

I should also point out the rtp situation. I have Trixbox set to use rtpstart=10001 and rtpend=20000, but the phone on the eth2 subnet is a Panasonic Globarange hardwired to use rtp ports 8000-55998. However, changing the rtp.conf file to suit the Globarange ports range, makes no difference.

Any suggestions very gratefully received.

David