ICE Candidates only showing local, no public

I’ve been running OpenVidu successfully for nearly 12 months now but I’ve recently hit some issues with certain users not passing video.

OpenVidu 2.17 on a vSphere VM, Ubuntu 18.04 clean
Behind a pfsense firewall. VM has a local IP which is 1:1 NAT with a dedicated public IP. Rules pass all the required ports for both IPv4 and IPv6.

I’ve noticed that the ICE candidates that go out (and there’s a lot of them) use the local IPv4 and IPv6 addresses but do not list the public addresses. On our AWS OpenVidu it sends the public IP as a candidate. It amazes me that this has never been a problem before. We upgraded to 2.17 a couple of weeks ago and have run a big event since successfully. It does appear that all users have been connecting via 3478 though, and not a direct port.

What would prevent our on-premise OpenVidu server from sending it’s public IP as a candidate?

We use NPT IPv6 translation in pfSense. The IPv6 candidates are all the local prefixed IPv6 addresses.

Is there a way of adding candidates manually?

Many thanks,

James