---
title: Disable SIP ALG in firewall
slug: disable-sip-alg-in-firewall
docTags: 
createdAt: 2026-03-17T11:18:11.137Z
---

## What is SIP ALG?

SIP ALG stands for Application Layer Gateway and is common in many commercial routers. Its purpose is to prevent some of the problems caused by router firewalls by inspecting VoIP traffic (packets) and modifying it where necessary.

Many routers have SIP ALG turned on by default.

There are various solutions for SIP clients behind NAT — some on the client side (STUN, TURN, ICE), and others on the server side (Proxy RTP solutions such as RtpProxy or MediaProxy).

Generally speaking, ALG typically works on the client-side LAN router or gateway. In some scenarios, client-side solutions are not valid — for example, STUN with a symmetrical NAT router. If the SIP proxy does not provide a server-side NAT solution, then an ALG solution may have a place.

An ALG understands the protocol used by the specific applications it supports (in this case SIP) and performs deep packet inspection of traffic passing through it. A NAT router with a built-in SIP ALG can rewrite information within SIP messages (SIP headers and SDP body), making signaling and audio traffic between the client behind NAT and the SIP endpoint possible.

## How can it affect VoIP?

Even though SIP ALG is intended to assist users who have phones on private IP addresses (Class C 192.168.X.X), in many cases it is poorly implemented and actually causes more problems than it solves. SIP ALG modifies SIP packets in unexpected ways, corrupting them and making them unreadable. This can result in unexpected behavior, such as phones failing to register and incoming calls not connecting.

Therefore, if you are experiencing problems, we recommend checking your router settings and disabling SIP ALG if it is enabled.