Which router settings matter for VoIP (SIP ALG, QoS)?

SIP ALG: turn it off

SIP ALG (Application Layer Gateway) is a router feature that tries to help VoIP by rewriting the addresses inside call signalling. Modern cloud phone systems already handle this, so the router's edits corrupt the messages instead. The symptoms are calls that drop at a fixed time, one-way audio, phones that register and then vanish, and incoming calls that ring once and stop.

The setting is found under different names depending on the router: SIP ALG, SIP Helper, SIP Passthrough, SIP Transformations or Consistent NAT. Turn it off, save, restart the router and then restart the phones. On some ISP-supplied modems the setting is hidden or cannot be changed, which is one reason to put the modem in bridge mode and use your own router.

QoS: give voice priority

Quality of Service lets the router send voice packets ahead of everything else when the connection is busy. Without it, a large upload from a backup or cloud sync can delay voice packets enough to cause choppy audio, even on a fast connection. Most business routers can prioritise by DSCP marking, by device or by traffic type.

• Enable QoS and set the upload and download limits to slightly below your real speeds so the router, not the ISP, does the queuing.
• Prioritise traffic marked DSCP EF (46) for voice; 3CTel phones and apps mark voice this way where the network preserves it.
• Where DSCP is not available, prioritise the phones by device or MAC address, or place them on a voice VLAN.
• Deprioritise backup, file sync and video streaming during business hours if the upload is small.

NAT, timeouts and firewalls

Double NAT happens when an ISP modem-router and your own router both translate addresses. Each layer can time out or rewrite differently, causing intermittent one-way audio. Put the ISP device in bridge mode, or use it as the only router, so there is one layer.

Phones keep their connection to the platform alive with regular small messages. If the router or firewall closes idle UDP sessions faster than that interval, incoming calls stop arriving until the phone re-registers. Set the UDP timeout to a few minutes rather than 30 seconds. Firewalls with intrusion prevention or deep inspection should be set to leave voice traffic alone.

3CTel does not require inbound ports to be opened. If a guide tells you to forward ports to your phones, check with support first; it is usually unnecessary and reduces security.

Getting help with the settings

If your IT provider manages the router, send them this list: SIP ALG off, QoS for DSCP 46, single NAT, UDP timeout of at least a few minutes, no inspection of voice traffic. A 3CTel specialist can join a call with your IT provider to confirm the configuration or, if 3CTel installed the network equipment, make the changes directly.