SIP ALG: Why It Silently Breaks VoIP Calls and How to Disable It

SIP Application Layer Gateway (ALG) is enabled by default on most consumer and many business-grade routers. It was designed to solve the NAT traversal problem for SIP calls by inspecting SIP packets and modifying IP address information within SIP headers. In practice, SIP ALG implementations in the vast majority of consumer routers are incorrect—they modify SIP packets in ways that break modern VoIP signaling rather than helping it. If your VoIP operation is experiencing one-way audio, calls dropping at exactly 30 seconds, registration failures, or inconsistent call quality that seems to depend on which network an agent is on, SIP ALG is the first thing to check.

How SIP ALG Breaks VoIP: The Technical Explanation

SIP signaling embeds IP address information in multiple fields within SIP headers and the SDP (Session Description Protocol) body—the Contact header, Via header, SDP connection data (c= line), and media addresses (m= lines). SIP ALG attempts to translate these private IP addresses to public IP addresses as packets pass through the NAT. When the ALG implementation incorrectly modifies these fields—inserting wrong addresses, partially updating headers, or corrupting field values—the SIP proxy on the other end receives malformed signaling that causes call setup failures, media routing errors, and mid-call disconnections.

• Calls drop at 30 or 60 seconds: The most classic SIP ALG symptom. The initial INVITE succeeds but the router's ALG fails to handle the re-INVITE sent at the 30-second point (a standard SIP keepalive mechanism in many implementations), causing the SIP proxy to interpret the call as stalled and tear it down.
• One-way audio: The SIP signaling for call setup succeeds, but the SDP body has been incorrectly modified, causing RTP media to be directed to the wrong IP address. One party's audio reaches the other; the reverse stream fails.
• Registration failures: SIP phone registrations that succeed from outside the network fail from within, or vice versa, because the ALG is modifying the Contact header to an incorrect address that the SIP server cannot route back to the device.