I’m using this: https://manpages.ubuntu.com/manpages/bionic/man1/stunserver.1.html
this is my command: /opt/stunserver/stunserver --primaryadvertised PUBLIC_IP --reuseaddr
This service must run on the same server as GENIEACS.
Did you set STUN server on the CPE? You know when it’s working once the CPE has UDPConnectionRequestURL set. Have you tried to make tcpdump on port 3478 to see if CPEs are even trying to connect?
in my trace the device is using completely different port as source and not 3478. It seems that negotiation between the device and stun server has failed.
The device should be sending different port as source. This is how the port stay’s open when the ACS tries to send UDP connection request. So either your stun is not configured properly or the device doesn’t work with stun as it should.
What I would suggest is that you try one of the public available STUN servers (google) and try to see if the udpconnectionrequest address will change. This would mean that your stun is not configured properly. If it doesn’t change this would mean that your device is a bit strange.