There is no SIP ALG to disable on pfSense — the firewall does not have one. If a pfSense site shows classic ALG symptoms like one-way audio or phones that de-register, the real culprits are outbound NAT rewriting your SIP source ports and UDP state timeouts that are too short for VoIP. Both have exact, documented fixes.
Most guides for this search send you hunting for a checkbox that does not exist. Netgate’s own developers are blunt about it: pfSense has no SIP ALG, and the closest thing to one — the optional siproxd package — is something you would have to install yourself. Nothing in a stock pfSense install rewrites SIP headers.
That changes what troubleshooting means here. An ALG rewrites the addresses inside SIP packets; pfSense never touches SIP payloads. What its defaults do is rewrite the source port of outbound UDP traffic and expire idle UDP states on timers too aggressive for some VoIP services — and both behaviors produce the same symptoms an ALG would. Match your symptom below and apply its fix.
Your SIP source port is being rewritten
The symptom: one-way audio on external calls, or inbound calls that intermittently fail to reach you. By default, pfSense rewrites the source port of outbound UDP, and the NAT-traversal logic on your provider’s side keys off the source port it actually receives.
The fix is Static Port outbound NAT:
- Go to Firewall > NAT > Outbound.
- Switch the mode to Hybrid Outbound NAT (or Manual, if you prefer full control).
- Add a rule matching your phones or PBX (or all UDP from the voice VLAN).
- Check Static Port on that rule and save.
With Static Port set, SIP leaves the firewall from the same port the phone sent it — which is what your provider’s NAT handling expects to see.
Your phones de-register on their own
The symptom: phones randomly show unreachable, and inbound calls go to voicemail until someone places an outbound call or reboots a handset. Default PF UDP timeouts are too short for some VoIP services, so the state your phone registered through quietly expires.
- Go to System > Advanced > Firewall & NAT.
- Set Firewall Optimization Options to Conservative.
Netgate notes a 20–30 second keep-alive on the phones is often the better fix, keeping the state alive without loosening timeouts firewall-wide.
The siproxd trap
The siproxd package is an opt-in SIP proxy, not an ALG — but if someone installed it to “fix VoIP,” it can be the thing breaking VoIP. Official guidance: use it only when a remote PBX strictly requires all phones to register from source port 5060, never when the PBX is on your LAN. Installed and symptomatic? Uninstall or disable it first.
Prove it with a packet capture
After enabling Static Port, run a capture from Diagnostics > Packet Capture on WAN, filtered to UDP port 5060. SIP should leave with source port 5060 unrewritten and Contact and SDP unmodified — proof nothing mid-path is altering your signaling.
A clean capture with failing calls means the problem lives upstream of the firewall. An ISP-supplied modem in front of pfSense can run its own ALG — the symptom map in what SIP ALG is and how it breaks calls shows how to recognize it. And if signaling is clean but the audio itself is choppy or degraded, that is a path-quality problem rather than a NAT one: work it with the packet loss troubleshooting guide.
Frequently asked questions
Does pfSense have a SIP ALG?
No. pfSense has no SIP ALG at all — nothing inspects or rewrites SIP payloads, and there is no checkbox to disable. VoIP problems on pfSense come from source-port rewriting in outbound NAT and short UDP state timeouts, fixed with Static Port rules and the Conservative firewall optimization setting.
What is Static Port in pfSense and why does VoIP need it?
By default, pfSense rewrites the source port of outbound UDP, which causes one-way audio and registration failures because NAT-traversal logic keys off the source port actually received. A Static Port rule under Firewall > NAT > Outbound tells pfSense to leave the source port alone for your phones or PBX.
Should I install siproxd on pfSense to fix VoIP problems?
Almost certainly not. siproxd is an opt-in SIP proxy for one narrow case: a remote PBX that strictly requires every phone to register from source port 5060. Never use it when the PBX is local. If it is installed and calls misbehave, remove it first.
Static Port NAT is all our SIP trunks ask of a pfSense firewall — SIPNEX is an FCC-licensed carrier, and we build for signaling that arrives unmodified. If your capture looks right and calls still fail, send it to us and we will look at the far end.
Keep reading.
The carrier built by operators, for operators.
FCC-licensed carrier with its own STIR/SHAKEN SP certificate. Operator-owned. SIP trunks built for operators who dial at volume.