diff --git a/openbsc/include/openbsc/bsc_nat.h b/openbsc/include/openbsc/bsc_nat.h
index 068ef68..e418496 100644
--- a/openbsc/include/openbsc/bsc_nat.h
+++ b/openbsc/include/openbsc/bsc_nat.h
@@ -127,6 +127,16 @@
 };
 
 /**
+ * BSCs point of view of endpoints
+ */
+struct bsc_endpoint {
+	/* the pending transaction id */
+	char *transaction_id;
+	/* the bsc we are talking to */
+	struct bsc_connection *bsc;
+};
+
+/**
  * the structure of the "nat" network
  */
 struct bsc_nat {
@@ -143,6 +153,9 @@
 	/* MGCP config */
 	struct mgcp_config *mgcp_cfg;
 	struct write_queue mgcp_queue;
+	struct msgb *mgcp_msg;
+
+	struct bsc_endpoint *bsc_endpoints;
 };
 
 /* create and init the structures */
@@ -177,9 +190,11 @@
 /**
  * MGCP/Audio handling
  */
+int bsc_write_mgcp_msg(struct bsc_connection *bsc, struct msgb *msg);
 int bsc_write_mgcp(struct bsc_connection *bsc, const u_int8_t *data, unsigned int length);
 int bsc_mgcp_assign(struct sccp_connections *, struct msgb *msg);
 void bsc_mgcp_clear(struct sccp_connections *);
+void bsc_mgcp_free_endpoint(struct bsc_nat *nat, int);
 void bsc_mgcp_free_endpoints(struct bsc_nat *nat);
 int bsc_mgcp_init(struct bsc_nat *nat);
 
diff --git a/openbsc/src/nat/bsc_mgcp_utils.c b/openbsc/src/nat/bsc_mgcp_utils.c
index 3639a7b..24f66a1 100644
--- a/openbsc/src/nat/bsc_mgcp_utils.c
+++ b/openbsc/src/nat/bsc_mgcp_utils.c
@@ -26,6 +26,8 @@
 #include <openbsc/mgcp.h>
 #include <openbsc/mgcp_internal.h>
 
+#include <osmocore/talloc.h>
+
 #include <netinet/in.h>
 #include <arpa/inet.h>
 
@@ -70,12 +72,23 @@
 	con->bsc_timeslot = -1;
 }
 
+void bsc_mgcp_free_endpoint(struct bsc_nat *nat, int i)
+{
+	if (nat->bsc_endpoints[i].transaction_id) {
+		talloc_free(nat->bsc_endpoints[i].transaction_id);
+		nat->bsc_endpoints[i].transaction_id = NULL;
+	}
+
+	nat->bsc_endpoints[i].bsc = NULL;
+	mgcp_free_endp(&nat->mgcp_cfg->endpoints[i]);
+}
+
 void bsc_mgcp_free_endpoints(struct bsc_nat *nat)
 {
 	int i;
 
 	for (i = 1; i < nat->mgcp_cfg->number_endpoints; ++i)
-		mgcp_free_endp(&nat->mgcp_cfg->endpoints[i]);
+		bsc_mgcp_free_endpoint(nat, i);
 }
 
 struct bsc_connection *bsc_mgcp_find_con(struct bsc_nat *nat, int endpoint)
@@ -95,6 +108,71 @@
 	return NULL;
 }
 
+int bsc_mgcp_policy_cb(struct mgcp_config *cfg, int endpoint, int state, const char *transaction_id)
+{
+	struct bsc_nat *nat;
+	struct bsc_endpoint *bsc_endp;
+	struct bsc_connection *bsc_con;
+	struct mgcp_endpoint *mgcp_endp;
+	struct msgb *bsc_msg;
+
+	nat = cfg->data;
+	bsc_endp = &nat->bsc_endpoints[endpoint];
+	mgcp_endp = &nat->mgcp_cfg->endpoints[endpoint];
+
+	bsc_con = bsc_mgcp_find_con(nat, endpoint);
+
+	if (!bsc_con) {
+		LOGP(DMGCP, LOGL_ERROR, "Did not find BSC for a new connection on 0x%x for %d\n", endpoint, state);
+
+		switch (state) {
+		case MGCP_ENDP_CRCX:
+			return MGCP_POLICY_REJECT;
+			break;
+		case MGCP_ENDP_DLCX:
+			return MGCP_POLICY_CONT;
+			break;
+		case MGCP_ENDP_MDCX:
+			return MGCP_POLICY_CONT;
+			break;
+		default:
+			LOGP(DMGCP, LOGL_FATAL, "Unhandled state: %d\n", state);
+			return MGCP_POLICY_CONT;
+			break;
+		}
+	}
+
+	if (bsc_endp->transaction_id) {
+		LOGP(DMGCP, LOGL_ERROR, "One transaction with id '%s' on 0x%x\n",
+		     bsc_endp->transaction_id, endpoint);
+		talloc_free(bsc_endp->transaction_id);
+	}
+
+	bsc_endp->transaction_id = talloc_strdup(bsc_endp, transaction_id);
+	bsc_endp->bsc = bsc_con;
+
+	/* we need to update some bits */
+	if (state == MGCP_ENDP_CRCX) {
+		struct sockaddr_in sock;
+		socklen_t len = sizeof(sock);
+		if (getpeername(nat->mgcp_queue.bfd.fd, (struct sockaddr *) &sock, &len) != 0) {
+			LOGP(DMGCP, LOGL_ERROR, "Can not get the peername...\n");
+		} else {
+			mgcp_endp->bts = sock.sin_addr;
+		}
+	}
+
+	/* we need to generate a new and patched message */
+	bsc_msg = bsc_mgcp_rewrite(nat->mgcp_msg, nat->mgcp_cfg->source_addr, mgcp_endp->rtp_port);
+	if (!bsc_msg) {
+		LOGP(DMGCP, LOGL_ERROR, "Failed to patch the msg.\n");
+		return MGCP_POLICY_CONT;
+	}
+
+	bsc_write_mgcp_msg(bsc_con, bsc_msg);
+	return MGCP_POLICY_DEFER;
+}
+
 /* we need to replace some strings... */
 struct msgb *bsc_mgcp_rewrite(struct msgb *input, const char *ip, int port)
 {
@@ -177,9 +255,11 @@
 	}
 
 	nat = fd->data;
+	nat->mgcp_msg = msg;
 	msg->l2h = msgb_put(msg, rc);
 	resp = mgcp_handle_message(nat->mgcp_cfg, msg);
 	msgb_free(msg);
+	nat->mgcp_msg = NULL;
 
 	/* we do have a direct answer... e.g. AUEP */
 	if (resp) {
@@ -216,6 +296,11 @@
 		return -1;
 	}
 
+	if (nat->mgcp_cfg->bts_ip) {
+		LOGP(DMGCP, LOGL_ERROR, "Do not set the BTS ip for the nat.\n");
+		return -1;
+	}
+
 	nat->mgcp_queue.bfd.fd = socket(AF_INET, SOCK_DGRAM, 0);
 	if (nat->mgcp_queue.bfd.fd < 0) {
 		LOGP(DMGCP, LOGL_ERROR, "Failed to create MGCP socket. errno: %d\n", errno);
@@ -259,5 +344,12 @@
 		return -1;
 	}
 
+	/* some more MGCP config handling */
+	nat->mgcp_cfg->data = nat;
+	nat->mgcp_cfg->policy_cb = bsc_mgcp_policy_cb;
+	nat->bsc_endpoints = talloc_zero_array(nat,
+					       struct bsc_endpoint,
+					       nat->mgcp_cfg->number_endpoints + 1);
+
 	return 0;
 }
diff --git a/openbsc/src/nat/bsc_nat.c b/openbsc/src/nat/bsc_nat.c
index d75c01d..0f9f08c 100644
--- a/openbsc/src/nat/bsc_nat.c
+++ b/openbsc/src/nat/bsc_nat.c
@@ -175,37 +175,6 @@
 	}
 }
 
-int bsc_write_mgcp(struct bsc_connection *bsc, const u_int8_t *data, unsigned int length)
-{
-	struct msgb *msg;
-
-	if (length > 4096 - 128) {
-		LOGP(DINP, LOGL_ERROR, "Can not send message of that size.\n");
-		return -1;
-	}
-
-	msg = msgb_alloc_headroom(4096, 128, "to-bsc");
-	if (!msg) {
-		LOGP(DINP, LOGL_ERROR, "Failed to allocate memory for BSC msg.\n");
-		return -1;
-	}
-
-	/* copy the data */
-	msg->l3h = msgb_put(msg, length);
-	memcpy(msg->l3h, data, length);
-
-	/* prepend the header */
-	ipaccess_prepend_header(msg, NAT_IPAC_PROTO_MGCP);
-
-	if (write_queue_enqueue(&bsc->write_queue, msg) != 0) {
-		LOGP(DINP, LOGL_ERROR, "Failed to enqueue the write.\n");
-		msgb_free(msg);
-		return -1;
-	}
-
-	return 0;
-}
-
 static int forward_sccp_to_bts(struct msgb *msg)
 {
 	struct sccp_connections *con;
diff --git a/openbsc/src/nat/bsc_nat_utils.c b/openbsc/src/nat/bsc_nat_utils.c
index f1bb4b5..7effe48 100644
--- a/openbsc/src/nat/bsc_nat_utils.c
+++ b/openbsc/src/nat/bsc_nat_utils.c
@@ -26,6 +26,7 @@
 #include <openbsc/gsm_data.h>
 #include <openbsc/bssap.h>
 #include <openbsc/debug.h>
+#include <openbsc/ipaccess.h>
 
 #include <osmocore/linuxlist.h>
 #include <osmocore/talloc.h>
@@ -122,4 +123,40 @@
 	}
 
 	return NULL;
-}
\ No newline at end of file
+}
+
+int bsc_write_mgcp(struct bsc_connection *bsc, const u_int8_t *data, unsigned int length)
+{
+	struct msgb *msg;
+
+	if (length > 4096 - 128) {
+		LOGP(DINP, LOGL_ERROR, "Can not send message of that size.\n");
+		return -1;
+	}
+
+	msg = msgb_alloc_headroom(4096, 128, "to-bsc");
+	if (!msg) {
+		LOGP(DINP, LOGL_ERROR, "Failed to allocate memory for BSC msg.\n");
+		return -1;
+	}
+
+	/* copy the data */
+	msg->l3h = msgb_put(msg, length);
+	memcpy(msg->l3h, data, length);
+
+        return bsc_write_mgcp_msg(bsc, msg);
+}
+
+int bsc_write_mgcp_msg(struct bsc_connection *bsc, struct msgb *msg)
+{
+	/* prepend the header */
+	ipaccess_prepend_header(msg, NAT_IPAC_PROTO_MGCP);
+
+	if (write_queue_enqueue(&bsc->write_queue, msg) != 0) {
+		LOGP(DINP, LOGL_ERROR, "Failed to enqueue the write.\n");
+		msgb_free(msg);
+		return -1;
+	}
+
+	return 0;
+}