MikroTik RouterOS includes a SIP Application Layer Gateway (ALG), also called the SIP connection-tracking helper. It attempts to make SIP work through NAT by inspecting SIP signalling and modifying information embedded inside the SIP message.

In most modern VoIP deployments, the PBX, handsets and SIP provider already handle NAT correctly. The MikroTik SIP helper can therefore interfere with this process and should normally be disabled.

What the MikroTik SIP helper does

When enabled, the helper may inspect unencrypted SIP traffic and:

• Rewrite IP addresses or ports contained in SIP headers such as:
• Via
• Contact
• Route
• Record-Route
• Rewrite addresses and ports in the SDP body, particularly:
• The connection address in the c= line.
• The RTP media port in the m= line.
• Create connection-tracking expectations or temporary firewall pinholes for anticipated RTP media.
• Attempt to associate SIP signalling and RTP streams with the same NAT session.
• Recalculate message lengths after changing the SIP payload.

This behaviour is commonly called SIP ALG, SIP inspection or SIP transformation.

Problems caused by SIP ALG

The helper cannot reliably understand every PBX, provider, NAT or SIP implementation. Its changes can conflict with the NAT handling already performed by Asterisk, FreePBX, hosted platforms, SIP proxies and modern handsets.

Typical symptoms include:

• Calls connecting with no audio.
• One-way audio.
• Incoming calls failing while outgoing calls work.
• Calls disconnecting after approximately 30 or 60 seconds.
• SIP registrations expiring or repeatedly dropping.
• Phones becoming unreachable after initially registering.
• Incorrect public or private addresses appearing in Contact, Via or SDP.
• RTP being sent to the wrong IP address or port.
• Multiple phones behind the same public IP interfering with one another.
• Intermittent failures that disappear after restarting the router or phone.
• SIP messages being rejected because they were changed in transit.
• Problems with re-INVITEs, call transfers, hold, direct media or session refreshes.

SIP messages can also pass through several NAT devices. If more than one device applies SIP ALG, each device may rewrite information changed by the previous one, producing particularly unpredictable results.

The helper cannot inspect encrypted SIP carried over TLS, but leaving it enabled can still create inconsistent behaviour when a deployment uses a mixture of encrypted and unencrypted signalling.

Disable the SIP helper

Run the following command from a MikroTik RouterOS terminal:

/ip firewall service-port disable sip

The equivalent action in WinBox or WebFig is:

1. Open IP.
2. Open Firewall.
3. Select Service Ports.
4. Locate sip.
5. Disable it.

Confirm the status from the terminal:

/ip firewall service-port print where name=sip

The sip entry should be shown as disabled.

The setting is persistent and remains disabled after a router restart.

After disabling it

Existing connection-tracking entries and SIP registrations may continue using state created while the helper was enabled. After making the change:

1. Restart or re-register the affected phones, PBX or SIP endpoint.
2. Allow existing SIP and RTP connection-tracking entries to expire.
3. Place inbound and outbound test calls.
4. Verify two-way audio.
5. Test calls lasting longer than one minute.
6. Test hold, transfer and re-INVITE operations where applicable.

Restarting the router will also clear existing connection-tracking state, but this interrupts all traffic and should only be performed during an appropriate maintenance window.

NAT and firewall configuration still matters

Disabling SIP ALG does not automatically configure VoIP access. The deployment must still have correct:

• Source NAT or masquerading.
• Destination NAT rules where inbound forwarding is required.
• SIP signalling permissions.
• RTP port permissions.
• PBX external address and local-network settings.
• Provider access-control rules.
• NAT keepalives or registration intervals.
• Endpoint NAT traversal settings.

Only the required SIP and RTP traffic should be permitted. SIP signalling and management interfaces should not be exposed broadly to the internet.

Modern SIP systems should control their own advertised addresses, NAT traversal and RTP port ranges. The router should perform predictable packet filtering and NAT without modifying the SIP application payload. For this reason, disabling the MikroTik SIP service-port helper is standard practice unless a tested legacy deployment has a specific, documented dependency on it.