🔐 Complete NAT & Firewall Guide for VoIP Implementation
Summary: NAT and firewall misconfigurations are the leading cause of VoIP call failures, one-way audio, and registration issues. This comprehensive guide covers everything you need to implement VoIP successfully behind NAT and firewalls: SIP ALG problems and why to disable it, required port ranges, STUN/TURN/ICE traversal, RTP media handling, security best practices, and step-by-step troubleshooting. Whether you're deploying a cloud PBX or on-premises system, this guide ensures crystal-clear, reliable voice connectivity.
📖 Table of Contents
🔍 Why NAT Causes VoIP Problems
NAT (Network Address Translation) allows multiple devices on a private network to share a single public IP address. While NAT works well for web browsing and email, it creates significant challenges for VoIP because SIP and RTP protocols embed IP addresses and port numbers inside the packet payload.
When a VoIP packet passes through NAT, the router modifies the packet header (source IP and port) but does not modify the embedded SIP/SDP payload. This mismatch causes the far end to send media to the wrong address—resulting in one-way audio, no audio, or dropped calls.
🔹 What NAT Breaks in VoIP
- SIP Registration: The contact address in REGISTER messages contains private IP
- SDP Media Descriptions: The IP and port for RTP media are private
- Inbound Calls: The far end can't reach your private IP
- Call Signaling: Via and Contact headers contain unreachable addresses
⚠️ Common Symptoms
- One-Way Audio: You hear them, they don't hear you (or vice versa)
- No Audio: Both parties hear silence
- Registration Failures: Trunks won't register
- Dropped Calls: Calls disconnect after a few seconds
- Delayed Audio: High latency due to media path issues
NAT and firewall issues cause 70%+ of VoIP call quality and connectivity problems
⚠️ SIP ALG: The Hidden Villain
SIP ALG (Application Layer Gateway) is a feature on many routers that attempts to fix NAT issues for SIP traffic. It inspects SIP packets and rewrites the embedded IP addresses to match the public IP. In theory, this should solve NAT problems. In practice, SIP ALG often causes more problems than it solves.
⚠️ Critical: The general recommendation from VoIP providers and PBX vendors is to disable SIP ALG on your router. SIP ALG frequently corrupts SIP messages, breaks registrations, causes one-way audio, and interferes with call transfers.
🔹 Why SIP ALG Fails
- 1 Incomplete Rewriting: ALG may rewrite some headers but miss others, creating inconsistency
- 2 SDP Corruption: Rewriting SDP can break codec negotiation and media setup
- 3 Registration Issues: ALG may alter REGISTER messages, preventing successful registration
- 4 Transfer Failures: Call transfers often fail when ALG is enabled
- 5 Inconsistent Behavior: Different ALG implementations behave differently across router brands
🔹 How to Disable SIP ALG
| Router Brand | Location | Action |
|---|---|---|
| Consumer Routers (Netgear, TP-Link, Asus) | Security > Firewall > SIP ALG | Uncheck or disable |
| Cisco / Linksys | Administration > Advanced > SIP ALG | Disable |
| Business Routers (Fortinet, SonicWall) | Firewall Policy > SIP | Disable SIP inspection |
| pfSense / OPNsense | Firewall > Settings > SIP ALG | Uncheck "Enable SIP ALG" |
💡 Pro Tip: If you can't find SIP ALG in your router's settings, check under "VoIP," "NAT," "Application Layer Gateway," or "SIP Inspection." Some routers hide it in advanced firewall settings.
🚀 Need Help with NAT & Firewall Configuration for VoIP? NetviaVoice Can Help
Our VoIP specialists can help you configure NAT traversal, firewall rules, and SIP ALG settings for reliable, crystal-clear voice connectivity.
Visit NetviaVoice📋 Required Ports & Protocols
Opening the correct ports is essential for VoIP. Here's the complete list of ports you'll need:
| Protocol | Port Range | Purpose | Priority |
|---|---|---|---|
| SIP Signaling | UDP/TCP 5060 | Call setup, registration, teardown | Essential |
| SIP TLS | TCP 5061 | Encrypted SIP signaling | Recommended |
| RTP Media (FreePBX/Asterisk) | UDP 10000-20000 | Voice and video media streams | Essential |
| RTP Media (3CX) | UDP 9000-10999 | Voice and video media streams | Essential |
| RTP Media (Alternative) | UDP 20000-27999 | Voice and video media streams | Essential |
| HTTP/HTTPS Provisioning | TCP 80/443 | Phone provisioning and web management | Optional |
| TFTP Provisioning | UDP 69 | Legacy phone provisioning | Optional |
⚠️ Important: Always check your PBX documentation for exact port ranges. RTP ports vary significantly between systems. FreePBX typically uses 10000-20000, while 3CX uses 9000-10999 by default.
🔄 NAT Traversal: STUN, TURN, ICE
NAT traversal techniques allow VoIP endpoints to discover their public IP address and establish media paths through NAT.
🔹 STUN (Session Traversal Utilities for NAT)
- Discovers public IP address and port
- Simple to implement on endpoints
- Works for most NAT types (full cone, restricted)
- Best for: Most VoIP deployments behind standard NAT
🔹 TURN (Traversal Using Relays around NAT)
- Relays media through a server
- Works with all NAT types (including symmetric)
- Adds latency and bandwidth costs
- Best for: Restrictive firewalls, symmetric NAT
🔹 ICE (Interactive Connectivity Establishment)
- Combines STUN and TURN
- Tries multiple connection paths
- Selects the best path automatically
- Best for: WebRTC, modern VoIP endpoints
🔹 PBX-Level NAT Settings
- Set external IP address in PBX
- Enable STUN on PBX if needed
- Configure NAT mode for extensions
- Set local network ranges
💡 Pro Tip: For most VoIP deployments, STUN on endpoints plus proper PBX NAT settings is sufficient. TURN is only needed for highly restrictive firewalls or symmetric NAT.
🛡️ Firewall Configuration
Proper firewall configuration ensures VoIP traffic flows smoothly while blocking malicious traffic.
🔹 Firewall Rules for VoIP
| Rule | Source | Destination | Port | Action |
|---|---|---|---|---|
| Inbound SIP from Provider | Provider IP Range | PBX Public IP | UDP 5060 | Allow |
| Inbound RTP from Provider | Provider IP Range | PBX Public IP | UDP 10000-20000 | Allow |
| Outbound SIP to Provider | PBX Public IP | Provider IP Range | UDP 5060 | Allow |
| Outbound RTP to Provider | PBX Public IP | Provider IP Range | UDP 10000-20000 | Allow |
| Management Access | Admin IP Range | PBX Public IP | TCP 443 | Allow |
| Block All Other SIP | Any | PBX Public IP | UDP 5060 | Deny |
⚠️ Important: Always whitelist your provider's IP ranges rather than opening SIP to the entire internet. This prevents toll fraud and unauthorized access.
🔊 Fixing One-Way Audio
One-way audio is the most common VoIP NAT issue. Here's how to diagnose and fix it:
- 1 Check SIP ALG: Disable SIP ALG on your router—this is the #1 cause of one-way audio.
- 2 Verify RTP Ports: Ensure the correct RTP port range is open in your firewall in both directions.
- 3 Configure External IP: Set the external/public IP address in your PBX NAT settings.
- 4 Enable STUN: Configure STUN on endpoints if they're behind NAT.
- 5 Check Symmetric RTP: Enable symmetric RTP on your PBX to send media back to the source address.
- 6 Verify Codec Negotiation: Ensure both endpoints support at least one common codec.
- 7 Test with Network Tools: Use Wireshark or tcpdump to confirm RTP is flowing both ways.
💡 Pro Tip: If audio works when you call internally but fails on external calls, the issue is almost certainly NAT/firewall related. If audio fails on all calls, check codec configuration.
🔒 VoIP Security Best Practices
✅ Network Security
- Whitelist provider IPs for SIP traffic
- Block SIP from unknown sources
- Use TLS for SIP signaling (port 5061)
- Use SRTP for media encryption
- Implement rate limiting for SIP requests
✅ Access Control
- Use strong passwords for SIP credentials
- Enable digest authentication
- Restrict management access to admin IPs
- Disable unnecessary services
- Regularly audit user accounts
✅ Monitoring
- Monitor for toll fraud patterns
- Set up alerts for unusual call activity
- Review CDRs regularly
- Monitor registration failures
✅ Best Practices
- Keep firmware updated on all devices
- Use VLANs to separate voice and data
- Implement QoS for voice priority
- Document all firewall rules
🔧 Troubleshooting Checklist
| Symptom | Likely Cause | Solution |
|---|---|---|
| Trunk not registering | SIP ALG blocking, wrong credentials, port 5060 blocked | Disable SIP ALG, verify credentials, open port 5060 |
| One-way audio | RTP blocked, NAT misconfiguration, SIP ALG | Open RTP ports, set external IP, disable SIP ALG |
| No audio on external calls | Codec mismatch, RTP port range incorrect | Verify codec settings, check RTP port range |
| Dropped calls after 30 seconds | SIP timeout, no RTP flowing | Check RTP ports, configure symmetric RTP |
| Echo on calls | Acoustic or hybrid echo (not NAT) | Enable AEC, adjust volume, use headset |
| Delayed audio | High latency, jitter, poor QoS | Implement QoS, use wired connection, upgrade bandwidth |
💡 Pro Tip: Always check your PBX's activity log (FreePBX: Reports → Asterisk Log; 3CX: Dashboard → Activity Log) for detailed error messages when troubleshooting.
❓ Frequently Asked Questions
VoIP calls fail behind NAT because SIP and RTP packets contain private IP addresses that aren't routable on the public internet. NAT modifies packet headers but not the embedded SIP/SDP payload, causing mismatched signaling and media paths. This leads to registration failures, one-way audio, and dropped calls.
SIP ALG (Application Layer Gateway) is a feature on many routers that attempts to fix NAT issues for SIP traffic. However, it often causes more problems than it solves—corrupting SIP messages, breaking registrations, and causing one-way audio. The general recommendation is to disable SIP ALG and use proper NAT traversal methods instead.
Essential VoIP ports include: SIP signaling (UDP/TCP 5060, TLS 5061), RTP media (typically UDP 10000-20000 or 20000-27999 depending on your PBX), and possibly HTTP/HTTPS for provisioning (80/443). Always consult your PBX documentation for exact port ranges.
One-way audio is usually caused by NAT/firewall blocking RTP media in one direction. Solutions include: opening RTP port ranges, disabling SIP ALG, configuring STUN/TURN/ICE on endpoints, setting external IP in your PBX, and ensuring symmetric RTP. Test with network tools to confirm RTP is flowing both ways.
STUN (Session Traversal Utilities for NAT) discovers your public IP and port. TURN (Traversal Using Relays around NAT) relays media through a server when direct connectivity fails. ICE (Interactive Connectivity Establishment) combines both—it tries multiple connection paths and picks the best one. For VoIP behind NAT, STUN is usually sufficient; TURN is needed for restrictive firewalls.
📢 Ready to implement VoIP successfully behind NAT and firewalls? Let NetviaVoice help you get it right.