To disable SIP ALG on a UniFi gateway, open the UniFi Network application, go to UniFi Devices, select your gateway (UDM, UDM-Pro, UDM-SE, or Cloud Gateway), open Settings → Firewall Connection Tracking, and toggle SIP off. On UniFi, “SIP ALG” is the kernel SIP connection-tracking module running on the gateway — the toggle unloads it so the gateway stops inspecting and rewriting SIP traffic.
UniFi is a special case: the setting has moved between software versions, and recent releases reportedly ship with it off by default. Before you tear the network apart, check the current state — you may have nothing to change.
Where the SIP setting lives in current UniFi releases
In current UniFi Network releases (9.x/10.x):
- Open the UniFi Network application for your site.
- Go to UniFi Devices and select your gateway.
- Open the device’s Settings panel.
- Find Firewall Connection Tracking.
- Toggle SIP off.
The setting has moved between versions — older builds kept it under Settings → Routing → NAT → Firewall Connection Tracking. If you cannot find it, type “sip” into the Settings search bar; that surfaces the toggle regardless of where the current build filed it.
Recent UniFi may already have it off
Recent UniFi Network releases are reported to ship with the SIP connection-tracking module disabled by default on the Cloud Gateway line. Do not assume either way: open the toggle and verify the state. If it already shows off and you still have one-way audio or registration flapping, your problem lives elsewhere — start with the symptom map in what SIP ALG is before changing anything.
Legacy USG and SSH: the conntrack module
On a legacy USG (or an EdgeRouter), the toggle is a CLI operation. SSH to the gateway and run:
configure
set system conntrack modules sip disable
commit ; save ; exitOne important caveat on the USG: changes made over SSH revert when the controller re-provisions the gateway unless you also add the setting to config.gateway.json. Skip that step and the ALG silently comes back on the next provision.
Verifying, and what to do if symptoms persist
The simplest verification is to confirm the SIP toggle still shows off after a gateway restart. If you are comfortable at the CLI, you can also confirm over SSH that the SIP conntrack modules (nf_conntrack_sip / nf_nat_sip) are no longer loaded, using lsmod | grep sip — no output means nothing SIP-related is loaded.
Once the module is confirmed off, restart your phones’ registrations and place a test call along the path that was failing. If calls still fail, work through the SIP trunk configuration guide — registration expiry, codec selection, and firewall state timeouts cause near-identical symptoms. And if you are running Ubiquiti’s own phone system on the same gateway, our UniFi Talk SIP trunk guide covers the trunk side of that setup.
Frequently asked questions
My UniFi gateway already shows SIP conntrack off — is anything left to do?
Two checks are still worth it. Confirm over SSH with lsmod | grep sip that nf_conntrack_sip and nf_nat_sip really are unloaded, and remember that an ISP-supplied modem in front of the gateway can run its own ALG. If the module is genuinely off and symptoms persist, the cause lives elsewhere — start with registration expiry and codec settings on the trunk.
Where is the SIP ALG toggle in the UniFi controller?
In current releases: UniFi Devices → select your gateway → Settings → Firewall Connection Tracking → SIP. Older builds placed it under Settings → Routing → NAT. The location has moved between versions, so the fastest route is typing “sip” into the Settings search bar.
Why did SIP ALG turn itself back on on my USG?
Because the change was made over SSH and the controller re-provisioned the gateway, which rewrites the config. Any SSH-applied setting reverts unless it is also added to config.gateway.json; add the conntrack setting there and the disable survives future provisions.
SIPNEX SIP trunks expect unmodified SIP end to end — when the gateway stops rewriting packets, registration and audio problems usually disappear with it. If yours do not, describe the failure to us and we will help you trace it — SIPNEX is an FCC-licensed carrier, and the carrier side of that trace is ours to run.
Keep reading.
The carrier built by operators, for operators.
FCC-licensed carrier with its own STIR/SHAKEN SP certificate. Operator-owned. SIP trunks built for operators who dial at volume.