SIP ALG: what it is and how to turn it off
SIP ALG (application layer gateway) is a router feature that rewrites the addresses inside call messages as they leave your network. It was meant to help calls through NAT. With today's phones and phone systems it usually breaks them, which is why almost every SIP provider asks you to disable SIP ALG.
- Phones drop their registration
- One-way or no audio
- Calls drop after about 32 seconds
- Incoming calls do not ring
- Hold and transfer fail
Updated 10 November 2026.
What SIP ALG does
Your router edits the message. Sometimes it gets the edit wrong.
Your phone writes its own address into every SIP message. Behind a router that address is private, such as 192.168.1.20, so the ALG swaps in the router's public one. Modern phones already correct for this, and a second, partial correction is what breaks the call.
- Via
- Phone sent
SIP/2.0/UDP 192.168.1.20:5060;rport - Provider received
SIP/2.0/UDP 203.0.113.7:5060 - The rport tag the phone added is gone, so replies may go back to the wrong port.
- Contact
- Phone sent
<sip:[email protected]:5060> - Provider received
<sip:[email protected]:1032> - A port the router may not keep open. Incoming calls stop arriving a few minutes later.
- c= (audio)
- Phone sent
IN IP4 192.168.1.20 - Provider received
IN IP4 192.168.1.20 - Missed. The provider sends your caller's voice to a private address, and you hear nothing.
Signs SIP ALG is breaking your calls
Five symptoms, one cause worth ruling out first.
Phones drop their registration
They show as offline every few minutes, then come back. The ALG rewrote the address the provider uses to reach them.
One-way or no audio
The call connects, but one side hears nothing. The audio address inside the message was changed, or left private.
Calls drop after about 32 seconds
The answer's confirmation (ACK) never arrives, so the other side gives up after 32 seconds: 64 times SIP's half-second base timer.
Incoming calls do not ring
Outgoing calls work, but the provider cannot reach the address the ALG wrote down.
Hold and transfer fail
These send fresh messages mid-call, and the ALG rewrites each one again, not always the same way.
Should you turn SIP ALG off?
Almost always. Two narrow cases say otherwise.
Turn it off when
- Your provider or phone system maker tells you to, which nearly all do.
- You see any of the five signs above.
- Your phones or PBX handle NAT themselves: keepalives, rport or a public address setting. Almost every current one does.
Leave it on only when
- Your provider says in writing that its service depends on it.
- On a SonicWall, your PBX sits outside the firewall and its maker asks for SIP transformations.
How to disable SIP ALG
Pick your router. Menu names move between firmware versions.
If your menu differs, search the router's own settings for SIP, ALG or Passthrough. On some routers the option has no visible label and only the maker or your ISP can change it.
- Sign in at routerlogin.net
- Advanced > Setup > WAN Setup
- Tick Disable SIP ALG
- Apply
Netgear ships it switched on. Older menus may name the page WAN Setup under Advanced only.
After you turn SIP ALG off
Three steps, or the old rewrites linger.
- 1
Restart the router
This clears the NAT table, which still holds the rewritten connections.
- 2
Restart the phones or PBX
They register again from scratch, through a router that now leaves the messages alone.
- 3
Call in, call out, wait a minute
Make an incoming and an outgoing call and stay on past 32 seconds. Then try hold and a transfer.
How to tell if SIP ALG is the cause
Compare what you sent with what arrived.
Two checks, both free, both in tools you already have.
Read the SIP log on both ends
Your PBX or SIP app logs the messages it sends. If the provider's side shows a different Contact or audio address than your log does, something between you rewrote it, and on a home or office router that something is the ALG.
Change the port or encrypt
An ALG only reads unencrypted SIP, usually on port 5060. If your provider offers TLS or a different port and the problem disappears when you switch, the ALG was the cause. Turn it off anyway, so a later change does not bring it back.
SIP ALG questions
Should I turn SIP ALG off?
Is it safe to disable SIP ALG?
Does disabling SIP ALG affect gaming?
How do I turn off SIP ALG on UniFi?
What are ports 5060 and 5061?
Is SIP over TCP or UDP?
My router has no SIP ALG setting. What now?
ALG off, phones registered. Now finish the trunk.
The four trunk settings and the dial rule, in the menus of 3CX, FreePBX, Asterisk and Yeastar: SIP trunk configuration. Another fault? Our SIP troubleshooting guide starts from the symptom. New to trunks? Start with what a SIP trunk is.