Post
NAT and firewall troubleshooting for VoIP
NAT and firewalls commonly affect VoIP because SIP signalling and RTP media advertise addresses and ports that may not be reachable from the other side. Registration can succeed while media fails.
Symptom map
| Symptom | Likely area | What to compare |
|---|---|---|
| No registration | DNS, transport, firewall, credentials | SIP request destination, response, and authentication |
| Outbound call fails | Dial plan, route, permissions | INVITE path and final SIP response |
| One-way audio | NAT, firewall, SDP, RTP pinholes | SDP addresses and actual RTP packet direction |
| No audio either way | Media ports, codec, SRTP, firewall | RTP/RTCP flow and negotiated media |
| Call drops after about 30 seconds | NAT binding or missing signalling | ACK, re-INVITE, session timers, and binding expiry |
Safe troubleshooting sequence
- Confirm the endpoint and PBX have correct time, DNS, gateway, and public/private address awareness.
- Capture one test call at the endpoint, PBX/SBC, and border firewall if possible.
- Follow the SIP transaction and note every network hop.
- Read the SDP offer and answer; record each media IP address and port range.
- Confirm RTP packets arrive at the advertised destination in both directions.
- Check firewall policy and NAT behaviour without exposing broad inbound ranges unnecessarily.
- Retest after changing one variable.
Avoid these assumptions
- Opening TCP 5060 does not automatically permit UDP RTP.
- SIP ALG is not universally helpful; it can rewrite messages incorrectly. Test its effect rather than assuming it is required.
- Port forwarding alone does not repair incorrect SDP addresses.
- A packet capture from only one side cannot prove that media reached the far endpoint.
Related: VoIP protocol guide and networking layers.