SIP ALG (Application Layer Gateway) is a router feature that rewrites SIP packets as they pass through NAT. It is meant to help, but it often corrupts headers and SDP, which causes failed registration, one-way audio, and calls that drop after about 30 seconds. Turn it off when you connect a PBX to an Edesy trunk and let the PBX handle NAT itself.
Signs that SIP ALG is the problem#
| Sign | Why |
|---|---|
| Registration works, then drops at random | The ALG rewrites Contact headers and expiry |
| One-way audio that NAT settings do not fix | The ALG changes the SDP address after your PBX set it correctly |
| Calls drop after about 30 seconds | The ACK is rewritten or lost |
401 loops on a credentials trunk |
The ALG alters headers covered by the digest |
| Works on a mobile hotspot, fails on the office network | The office router has SIP ALG on |
How to turn it off#
The setting has different names. Look for "SIP ALG", "SIP helper", "SIP passthrough", "SIP fixup" or "SIP inspection".
| Device | Where to look |
|---|---|
| Home and small-office routers | Advanced, NAT, or Firewall settings. Uncheck SIP ALG. |
| pfSense | Firewall and NAT settings. Do not install a SIP proxy package; use static outbound NAT port mapping for the PBX. |
| Linux / iptables | Unload the SIP conntrack helpers: nf_nat_sip and nf_conntrack_sip. |
| Enterprise firewalls | Disable SIP inspection or SIP ALG on the policy that covers the PBX. Check the vendor's docs for the exact command. |
Restart the router if the change does not apply immediately, then restart the PBX's SIP stack so it registers again.
After turning it off#
- Make sure your PBX's external address and local networks are set. See One-Way Audio and NAT.
- Check that the trunk shows Registered on the Edesy trunk page.
- Place a call and talk both ways for over a minute.
FAQ#
Is SIP ALG ever needed?#
Rarely. Modern PBXs handle NAT themselves. With an external address set on the PBX, SIP ALG only gets in the way.
Can I use TCP to avoid SIP ALG?#
Some ALGs inspect only UDP, so switching the trunk to TCP sometimes helps. Edesy trunks accept UDP and TCP on port 5070. Turning the ALG off is still the proper fix.
Will TLS avoid SIP ALG?#
Yes, an encrypted connection cannot be rewritten. TLS is available on request; contact support.