# SIP ALG

> What SIP ALG is, why it breaks SIP trunks (failed registration, one-way audio, dropped calls), and how to turn it off on common routers and firewalls.

Source: https://edesy.in/docs/sip-trunking/troubleshooting/sip-alg

SIP ALG (Application Layer Gateway) is a router feature that rewrites SIP packets as they pass through NAT. It is meant to help, but it often corrupts headers and SDP, which causes failed registration, one-way audio, and calls that drop after about 30 seconds. Turn it off when you connect a PBX to an Edesy trunk and let the PBX handle NAT itself.

## Signs that SIP ALG is the problem

| Sign | Why |
|---|---|
| Registration works, then drops at random | The ALG rewrites Contact headers and expiry |
| One-way audio that NAT settings do not fix | The ALG changes the SDP address after your PBX set it correctly |
| Calls drop after about 30 seconds | The ACK is rewritten or lost |
| `401` loops on a credentials trunk | The ALG alters headers covered by the digest |
| Works on a mobile hotspot, fails on the office network | The office router has SIP ALG on |

## How to turn it off

The setting has different names. Look for "SIP ALG", "SIP helper", "SIP passthrough", "SIP fixup" or "SIP inspection".

| Device | Where to look |
|---|---|
| Home and small-office routers | Advanced, NAT, or Firewall settings. Uncheck SIP ALG. |
| pfSense | Firewall and NAT settings. Do not install a SIP proxy package; use static outbound NAT port mapping for the PBX. |
| Linux / iptables | Unload the SIP conntrack helpers: `nf_nat_sip` and `nf_conntrack_sip`. |
| Enterprise firewalls | Disable SIP inspection or SIP ALG on the policy that covers the PBX. Check the vendor's docs for the exact command. |

Restart the router if the change does not apply immediately, then restart the PBX's SIP stack so it registers again.

## After turning it off

1. Make sure your PBX's external address and local networks are set. See [One-Way Audio and NAT](https://edesy.in/docs/sip-trunking/troubleshooting/one-way-audio-and-nat).
2. Check that the trunk shows **Registered** on the Edesy trunk page.
3. Place a call and talk both ways for over a minute.

## FAQ

### Is SIP ALG ever needed?

Rarely. Modern PBXs handle NAT themselves. With an external address set on the PBX, SIP ALG only gets in the way.

### Can I use TCP to avoid SIP ALG?

Some ALGs inspect only UDP, so switching the trunk to TCP sometimes helps. Edesy trunks accept UDP and TCP on port `5070`. Turning the ALG off is still the proper fix.

### Will TLS avoid SIP ALG?

Yes, an encrypted connection cannot be rewritten. TLS is available on request; contact support.