Three firewall settings that break phone calls

When a system works everywhere except at one site, it's almost never the phone system. It's a network device doing something too clever.

1. The feature that claims to help telephony

Many routers include a feature, usually called SIP ALG, that rewrites telephony messages in transit to correct addresses. The intention is good; the result rarely is. It changes some fields and not others, and produces calls that connect with no audio, or that drop after a few seconds.

2. The session timeout

Telephony uses exchanges that can stay silent for several dozen seconds. A firewall that closes a session after thirty seconds of inactivity then cuts the call, always at the same point. It's the most recognisable signature: calls that drop at exactly thirty seconds, or exactly one minute.

The symptom is misleading because it looks like a carrier problem. A cutoff at a time that is always the same almost always points to a session timeout, not a network fault.

3. The audio port range

Signalling travels over a known port; audio travels over a wide port range. Allowing the first without the second gives you a call that connects and stays silent. This matches what you see: signalling works fine, audio doesn't get through.

How to check in five minutes

1. Make a call from the site in question and note the exact duration before it drops. A round number points to a session timeout.
2. Test the same phone on another network, a mobile hotspot for example. If the fault disappears, it's local.
3. Look for SIP ALG in the router's interface and turn it off.
4. Check that the audio port range is allowed in both directions.

What we can do on our end

Some of these situations can be worked around by forcing audio to relay through our servers rather than going direct. It's a setting we turn on when a site is difficult, while waiting for the equipment to be fixed. It uses a bit more in resources, and it works.

The remote-work case

A remote worker connects through their own router, which no one controls. That's why the same symptoms keep reappearing, one household at a time. The answer isn't to configure thirty home routers; it's to route audio through our servers for those phones, so traversal becomes predictable.

What to ask your IT provider

1. Turn off any telephony inspection or rewriting feature on the router and firewall.
2. Set the session timeout to at least one hundred and eighty seconds.
3. Allow the audio port range in both directions, outbound and on the return of the same session.
4. Don't throttle bandwidth on these flows: telephony copes badly with a poorly tuned QoS policy.

One symptom, one likely cause

• Call that drops at a time that is always the same: session timeout
• Call connects but is silent in one direction: port range or announced address
• Call that fails only on transfer: signalling rewritten in transit
• Fault at a single site: local equipment, not the platform
• Fault to a single destination: carrier routing

What to remember

A round number in the duration before a call drops almost always points to a setting, not a fault. That's good news: a setting can be fixed once and for all.

We see these cases every day, and we know how to work around them while the equipment gets fixed. See our expertise page.