We strongly suggest to avoid any packet inspection on traffic coming from IPs:
103.135.87.3
103.135.87.14
103.135.87.35
The reason is because voice traffic can create a lot of network noise and firewalls can treat that suspicious
QoS ( Bandwidth Reservation )
Although the traffic is deemed high priority when it leaves our network, it may not arrive to your network in the same way, this is out of our control and is controlled by your ISP, or their upstream providers. As such we recommend to reserve some bandwidth on your router to ensure traffic flows in each direction even under high load.
The recommend settings is 100kbps both upload and download per user. E.g. if you have 10 users we recommend reserving 1Mbps in each direction
SIP ALG, or Session Initiation Protocol Application Layer Gateway, is a tool that some networks use to speed along SIP requests to initiate connections.
This tool involves rewriting the packet headers of SIP requests that pass through the router out to the internet. For some services, this tool may be useful.
Still, for many VoIP providers, the rewritten SIP packet header strips out information that is necessary to securely authorize the device making the connection.
More importantly, it responds directly to the device that is requesting the connection. This feature can lead to some of the most common issues that customers have with VoIP — phones losing connection, dropped calls, and one-way audio.
SIP ALG modifies SIP packets in unexpected ways, corrupting them and making them unreadable. This can give you unexpected behaviour, such as phones not registering and incoming calls failing. Therefore if you are experiencing problems we recommend that you check your router settings and turn SIP ALG off if it is enabled.
Most home/residential routers have a web interface. Typically this is 192.168.1.1 but you just check your default gateway by typing ipconfig in Windows command prompt or ifconfig on Linux systems from any connected device on the same LAN.
If your router does not have a web interface you will most likely need a Telnet client to login.
Disable the option SIP Passthrough under Advanced Settings / WAN -> NAT Passthrough.
If your router doesn’t have this option SIP ALG may be disabled via Telnet.nvram get nf_sip
(It should return a “1”)nvram set nf_sip=0
nvram commit
Reboot
SIP ALG cannot be disabled. (See above on how to get around this)
Barracuda Firewalls
Go to Firewall > Firewall Rules > Custom FirewallAccess Rules
Click the “Disabled” check box next to any rules named LAN-2-INTERNET-SIP and INTERNET-2-LAN-SIP
This disables SIP ALG.
Navigate to the web interface
-> Select Configuration
-> Select NAT
-> Select ALG
-> Disable SIP ALG
SIP ALG cannot be disabled in the settings of BT HomeHubs but can be disabled with BT Business Hub versions 3 and higher.
In ‘Advanced’ settings –> ‘Application Level Gateway (ALG) Configuration’ un-tick the ‘SIP’ option.
No ALG function available – Consider using a public STUN server
DrayTek Vigor 2760 devices, the option can be found in the regular interface at Network -> NAT -> ALG.
If your device does not have a web interface then you’ll need a telnet client.
You will be prompted to provide a username and/or password. These are the same credentials used to access the router’s web interface.
Afterwards, type in these commands:
sys sip_alg 0
sys commit
On Draytek Vigor2750 and Vigor2130 please use these commands instead:
kmodule_ctl nf_nat_sip disable
kmodule_ctl nf_conntrack_sip disable
Huawei E5330
Navigate to the web interface
Click Settings.
Enter the required username and password, then click Log In.
Note: The default username and password is admin.
Click the Security dropdown.
Click SIP ALG Settings.
Untick the Enable SIP ALG box.
Click Apply.
Fortigate:
Disabling the SIP ALG in a VoIP profile
SIP is enabled by default in a VoIP profile. If you are just using the VoIP profile for SCCP you can use the following command to disable SIP in the VoIP profile.
config voip profile
edit VoIP_Pro_2
config sip
set status disable
end
The SIP ALG setting is usually found in the Security menu.
Vodafone / Huawei (HHG2500)
TalkTalk / Huawei (HG633)
EE / Huawei (E5330)
Type the following into the CLI
To check if currently enabled or disabled run show security alg status | match sip
To disable run:
configure
set security alg sip disable
commit
Check for a SIP ALG option in the Administration tab under ‘Advanced’.
You should also disable the SPI Firewall option.
Disable SIP Helper.
Look for a ‘SIP ALG’ checkbox in ‘WAN’ settings.
Under ‘NAT Filtering’ uncheck the option ‘SIP ALG’
Port Scan and DoS Protection should also be disabled.
Disable STUN in VoIP phone’s settings.
To disable SIP ALG you need to telnet into your Speedtouch router and type the following:
-> connection unbind application=SIP port=5060
-> saveall
2017/18 See Huawei (HG633)
Navigate to the web interface
Select ‘Port Forwarding’ from the menu
Uncheck SIP-ALG from the ALG section at the bottom of the page.
TG588 TG589 TG582
Open Command Prompt – “Start” → “Run” → type “cmd” and press “Enter”.
In Command Prompt, type “telnet 192.168.1.254” and press enter. 192.168.1.254 is the default IP address of the router. If you are running on Windows 7/8/8.1/10, you might need to install the telnet client from “Control Panel” → “Programs and Features” → “Turn Windows features on and off”.
The default username is “Administrator”, and there is no default password, leave blank.
Type “connection unbind application=SIP port=5060” and press “Enter”.
Type “ saveall ” and press “Enter”.
Type “exit” and press “Enter” to exit the telnet session.
Depending on the version of Tomato, SIP ALG can be found under Advanced then Conntrack/Netfilter in the Tracking/NAT Helpers section. If you find SIP checked then SIP ALG is enabled. Uncheck it to disable it.
Navigate to your routers web interface.
The default username is admin and the default password is admin.
On the left, click on Advanced Setup and then click on NAT and then click on ALG.
Uncheck the box by SIP Enabled. (Some TP firmware shows this as SIP Transformations which is the same thing).
Click Save/Apply.
Go to Advanced > Options.
Disable (uncheck) SIP.
Disable (uncheck) RTSP.
Click Apply.
Use the configuration tree if supported: system -> conntrack -> modules -> sip -> disable
Alternatively, you can SSH into the device and run the following commands:
configure
set system conntrack modules sip disable
commit
save
exit
SIP ALG cannot be disabled in the settings of SuperHubs.
Please see our workarounds at the top of the page.
2018 Onwards – See Huawei (HHG2500)
Type the following into the CLI
configure
set system conntrack modules sip disable
commit
save
exit
Detailed instructions can be found here: https://www.voicehost.co.uk/help/watchguard-firewall-sip-configuration
Under Network or Advanced -> ALG un-tick the options Enable SIP ALG and Enable SIP Transformations.
Telnet commands must be used to disable SIP ALG with some other Zyxel routers.
Telnet into the router.
Select menu items 24 then 8.
To display the current SIP ALG status run the following command:
ip nat service sip active
To turn off SIP ALG:
ip nat service sip active 0
Go to Settings > Configuration > Network > ALG.
Disable SIP ALG.
Turn ON Enable SIP Transformations.
Turn OFF Enable Configure SIP Inactivity Timeout.