How to Disable SIP ALG on Every Major Router Brand

SIP ALG is the single most common cause of VoIP problems on business networks, and it has been for over a decade. It ships enabled by default on nearly every router sold, and it will keep breaking your calls until you explicitly turn it off.

The concept behind SIP ALG is reasonable: inspect SIP packets as they cross the router and rewrite the headers so they work correctly through NAT. In practice, the implementations are buggy, outdated, and they break more than they fix. Modern VoIP endpoints handle NAT traversal themselves using STUN, symmetric RTP, and outbound proxy configurations. SIP ALG interferes with these mechanisms by rewriting headers that were already correct.

For the full explanation of why SIP ALG causes problems, see SIP ALG: The Router Setting That Breaks Everything. This post is the practical companion: how to disable it on every major router brand you are likely to encounter.

The symptoms

Before you start changing settings, confirm that SIP ALG is likely the culprit. The classic pattern:

• One-way audio — you can hear the other party but they cannot hear you, or vice versa. This is the most common symptom. See One Way Audio: I Can Hear Them But They Can't Hear Me for a deeper dive.
• Calls fail on transfer — a call connects fine, but when transferred to another extension or external number, the audio drops or the call disconnects.
• Intermittent registration failures — phones randomly go unregistered and then re-register on their own.
• No audio in either direction — the call connects (you see it ringing and answered) but neither side can hear anything.
• Calls work on the same network but fail to external numbers — internal extension-to-extension calls are fine, but calls through a SIP trunk fail.

If you are seeing these symptoms and the phones are behind a NAT router, SIP ALG is the first thing to check.

How to prove it

The definitive test is a packet capture on both sides of the router. Capture on the LAN side (between the phone and the router) and on the WAN side (between the router and the internet). Compare the SIP INVITE messages. If the Contact header, Via header, or SDP connection address has been rewritten between the two captures, SIP ALG is active and modifying your traffic.

You can upload both captures to our PCAP analyzer to compare the SIP headers side by side without manually digging through Wireshark.

The faster test: disable SIP ALG, reboot the router, and see if the problem goes away. If it does, you have your answer.

Ubiquiti (UniFi / EdgeRouter)

UniFi Security Gateway and UniFi Dream Machine

The UniFi controller interface does not expose a SIP ALG toggle. You need to use the CLI.

SSH into the gateway and run:

configure
set service nat rule 1 disable
set system conntrack modules sip disable
commit
save

On UDM and UDM Pro running UniFi OS, SSH in and run:

iptables -t raw -A PREROUTING -p udp --dport 5060 -j NOTRACK
iptables -t raw -A OUTPUT -p udp --sport 5060 -j NOTRACK

Note: On UDM devices, these iptables rules do not persist across firmware upgrades. You may need a boot script or the udm-utilities approach to make them permanent.

EdgeRouter

SSH in or use the CLI tab in the EdgeRouter web interface:

configure
set system conntrack modules sip disable
commit
save

Then reboot the router. The conntrack SIP module is what performs ALG inspection. Disabling it stops the packet mangling.

Fortinet (FortiGate)

FortiGate firewalls have SIP ALG enabled by default through the SIP Application Layer Gateway and the SIP session helper.

In the FortiGate CLI:

config system settings
    set sip-helper disable
    set sip-nat-trace disable
    set default-voip-alg-mode kernel-helper-based
end

config system session-helper
    show

Find the entry for SIP (port 5060) and delete it:

config system session-helper
    delete <id>
end

Replace <id> with the number shown next to the SIP entry. Then reboot. Some FortiOS versions also require disabling the SIP inspection profile in the firewall policy if one is applied:

config firewall policy
    edit <policy_id>
        set voip-profile ""
    next
end

SonicWall

SonicWall firewalls have "Consistent NAT" and "SIP Transformations" that act as SIP ALG.

In the web management interface:

1. Navigate to Voice > Settings (on older firmware: VoIP > Settings)
2. Uncheck Enable SIP Transformations
3. Under Network > NAT Policies, verify there are no NAT policies specifically manipulating SIP traffic
4. Navigate to Network > Firewall > Advanced and ensure Enable Consistent NAT is checked (this helps VoIP without the ALG mangling)
5. Apply and reboot

On Gen 7 SonicWall (SonicOS 7.x), the path is Policy > Security Services > VoIP and the setting is Enable SIP ALG.

Netgear

Most Netgear consumer and prosumer routers have SIP ALG buried in the settings.

In the web interface:

1. Navigate to Advanced > WAN Setup (or Advanced > Setup > WAN Setup)
2. Look for Disable SIP ALG checkbox — check it to disable
3. On some models it appears as NAT Filtering — set to Open rather than Secured
4. Apply and reboot

On Netgear Nighthawk and Orbi models, the setting is usually under Advanced > WAN Setup > Disable SIP ALG.

TP-Link

Consumer routers (Archer series)

1. Log into the router admin (usually 192.168.0.1 or tplinkwifi.net)
2. Navigate to Advanced > NAT Forwarding > ALG
3. Uncheck SIP ALG (and H.323 ALG if present)
4. Save and reboot

Omada (managed)

In the Omada controller:

1. Go to Settings > Network > Service (or Gateway > ALG depending on firmware)
2. Disable SIP ALG
3. Apply

Cisco (Meraki, ISR, ASA)

Meraki MX

Meraki does not have a traditional SIP ALG. However, the content filtering and IPS features can interfere with SIP traffic. If you are having VoIP issues through a Meraki MX:

1. In the Meraki dashboard, go to Security & SD-WAN > Firewall
2. Ensure UDP ports 5060 and your RTP range (typically 10000-20000) are allowed outbound
3. Under Threat Protection, check if SIP traffic is being flagged
4. Enable UDP hole punching if available in your firmware version

Cisco ISR (IOS)

no ip nat service sip udp port 5060
no ip nat service sip tcp port 5060

Save the config and reload.

Cisco ASA

policy-map global_policy
 class inspection_default
  no inspect sip

Then write memory and reload.

Mikrotik (RouterOS)

Mikrotik routers have a SIP helper in the connection tracking module.

In the terminal:

/ip firewall service-port set sip disabled=yes

Or in WinBox: IP > Firewall > Service Ports, find sip, and disable it.

pfSense / OPNsense

pfSense does not have SIP ALG in the traditional sense, but the default packet filter can interfere with SIP if not configured correctly.

1. Navigate to System > Advanced > Firewall & NAT
2. Check Static Port on outbound NAT rules for your VoIP devices (this prevents the firewall from randomizing the source port)
3. If using Automatic Outbound NAT, switch to Hybrid or Manual and create a rule for your VoIP subnet with Static Port checked
4. Disable Firewall Scrub if you are seeing mangled SIP packets (rare but possible)

OPNsense: same approach. Navigate to Firewall > NAT > Outbound and enable static port for VoIP traffic.

ISP-provided routers

If you are using a router provided by your ISP (AT&T BGW, Comcast xFi, Verizon Fios), SIP ALG may be enabled and the setting may not be exposed in the consumer interface.

Your options:

1. Check for a hidden advanced settings page. Some ISP routers have a settings page at a non-standard URL (e.g., 192.168.1.254/xmtvsetup for some AT&T gateways) that exposes more options including SIP ALG.
2. Enable IP Passthrough / Bridge Mode. Put the ISP router in bridge mode and use your own router behind it. This bypasses the ISP router's NAT and ALG entirely.
3. Call the ISP. Some ISPs can disable SIP ALG remotely. Worth asking, though success varies.

Bridge mode is the most reliable option. It also gives you control over your firewall, NAT, and QoS settings, which matters for VoIP quality.

After disabling SIP ALG

After disabling SIP ALG on any router:

1. Reboot the router. Settings changes to NAT helpers and connection tracking modules typically require a reboot to take full effect.
2. Restart your phones or PBX. Force a fresh SIP registration so the new (unmangled) headers are used.
3. Test calls. Make a call to an external number. Test a transfer. Test a call on hold. These are the scenarios most affected by SIP ALG.
4. Run a VoIP quality test. Use our VoIP quality test to verify that media (RTP) is flowing correctly in both directions with acceptable jitter and packet loss.

If the problems persist after disabling SIP ALG, the issue may be elsewhere: double NAT, restrictive firewall rules, or a network quality problem. See How to Tell Where the Problem Actually Is for a systematic troubleshooting approach.

For the full technical explanation of why SIP ALG causes these problems, see SIP ALG: The Router Setting That Breaks Everything. For help reading the SIP traces that reveal ALG mangling, see Reading a SIP Trace: Practical Troubleshooting.