VoIP Infrastructure Guide

VoIP Firewall Configuration

8 min read · Updated April 2026

VoIP firewall configuration is where most deployments go wrong. Wrong ports, SIP ALG enabled, or asymmetric rules cause registration failures, one-way audio, and dropped calls. Here is how to get it right.

In this guide

01VoIP ports to open 02Why SIP ALG breaks VoIP 03Firewall rule examples 04NAT and VoIP 05Testing your firewall 06QoS and priority marking

1. VoIP ports to open

VoIP requires two separate port ranges for SIP signaling and RTP media:

Protocol	Port/Range	Direction	Purpose
UDP/TCP	5060	Both	SIP signaling (unencrypted)
TCP	5061	Both	SIP over TLS (encrypted)
UDP	10000-20000	Both	RTP media (audio/video)
UDP	3478, 5349	Both	STUN/TURN (NAT traversal)

The RTP port range varies by platform. Asterisk defaults to 10000-20000. FreeSWITCH uses 16384-32768. Check your PBX settings and open the matching range bidirectionally — both inbound AND outbound.

2. Why SIP ALG breaks VoIP — disable it immediately

SIP ALG (Application Layer Gateway) inspects and modifies SIP packets to help with NAT traversal. In practice it almost always breaks VoIP by rewriting headers incorrectly, breaking authentication, dropping packets it does not understand, and corrupting REGISTER packets.

Disable SIP ALG on every router and firewall in the call path.

; Common commands to disable SIP ALG:
; Cisco IOS
no ip nat service sip udp port 5060

; MikroTik
/ip firewall service-port disable sip

; iptables (Linux)
iptables -t raw -A PREROUTING -p udp --dport 5060 -j NOTRACK
iptables -t raw -A OUTPUT -p udp --sport 5060 -j NOTRACK

3. Firewall rule examples

; iptables rules for a SIP server
iptables -A INPUT -p udp --dport 5060 -j ACCEPT
iptables -A INPUT -p tcp --dport 5060 -j ACCEPT
iptables -A INPUT -p tcp --dport 5061 -j ACCEPT
iptables -A INPUT -p udp --dport 10000:20000 -j ACCEPT
iptables -A INPUT -p udp --dport 3478 -j ACCEPT

; UFW
ufw allow 5060/udp
ufw allow 5060/tcp
ufw allow 5061/tcp
ufw allow 10000:20000/udp

4. NAT and VoIP

NAT breaks VoIP because SIP endpoints advertise their private IP addresses in SDP and Contact headers. Solutions:

Option A

Session Border Controller (SBC)

An SBC rewrites SDP and Contact headers with its public IP and anchors media. Best for production deployments with multiple endpoints behind NAT.

Option B

STUN for endpoints

Configure each SIP endpoint to use a STUN server to discover its public IP. Works for softphones and IP phones. Fails with symmetric NAT.

Option C

PBX external IP

Configure Asterisk externip/localnet or FreeSWITCH ext-rtp-ip with your public IP. The PBX rewrites its own SDP. Works when PBX is behind static NAT.

5. Testing your VoIP firewall configuration

; Test SIP connectivity
sipsak -s sip:yourserver.com
sipsak -v -s sip:yourserver.com  ; verbose

; Test TLS
openssl s_client -connect yourserver.com:5061

; Test RTP port range
nc -u -z yourserver.com 10000

Capture SIP on both sides of the firewall. If Contact header IPs differ between captures, SIP ALG is rewriting packets.

6. QoS marking for VoIP

Mark SIP and RTP with DSCP EF (46) to give voice packets priority over data traffic on shared links.

; Mark VoIP traffic for QoS
iptables -t mangle -A OUTPUT -p udp --dport 5060 -j DSCP --set-dscp-class EF
iptables -t mangle -A OUTPUT -p udp --sport 10000:20000 -j DSCP --set-dscp-class EF

Frequently asked questions

What ports does VoIP use?

VoIP uses UDP/TCP port 5060 for SIP signaling, TCP port 5061 for SIP over TLS, and UDP ports 10000-20000 for RTP media. STUN uses UDP port 3478. All ports must be open bidirectionally on every firewall in the call path.

Should I disable SIP ALG for VoIP?

Yes — disable SIP ALG on every router and firewall in the call path. SIP ALG attempts to rewrite SIP headers for NAT but almost always corrupts them, causing registration failures, one-way audio, and dropped calls.

Why does VoIP not work through my firewall?

Most common VoIP firewall issues: SIP ALG enabled, RTP port range not open bidirectionally, asymmetric rules allowing outbound but blocking inbound RTP, or UDP state timeout too short. Capture SIP on both sides of the firewall to find exactly where packets are being dropped.

VoIP calls failing through your firewall?

Paste your SIP trace into SIPSymposium. The analyzer detects NAT issues in Contact and SDP headers, identifies missing ACKs caused by firewall drops, and checks for SIP ALG interference.

Analyze my trace Create free account

Related guides