I wouldn't use STUN. It's an unnecessary complicated science project.
Unless the two media endpoints can't reach other, or the signaling agents can't reach other due to asymmetric signaling or bad NAT devices or stupidly implemented SIP ALGs or whatever, "nathelper" alone will do just fine. Just apply its fixups to your Contact URIs and SDP endpoints and get perfectly good far-end NAT traversal.
I have deployed this many times for service providers and it works great. There will always be problems with some flaky end-user equipment, but in general the benefits far outweigh the costs of screwing around with STUN or anything of the sort.