Why VoIP struggles with NAT
Almost every office uses NAT (Network Address Translation): phones and computers have private addresses, such as 192.168.1.20, and the router sends them all out to the internet under a single public address. For web browsing it works without anyone noticing, because the computer always starts the connection and the router remembers who to hand the reply to.
SIP is more complicated for two reasons. First, it writes addresses inside its messages: the phone tells the server "reach me at this address and this port", but the address it knows is the private one, which cannot be reached from the internet. Second, the voice does not travel in the same connection as the SIP messages: it uses separate streams (RTP) on other ports, chosen call by call.
The typical result, if nobody corrects these addresses, is a call that connects but where the voice only flows in one direction, or a phone that stops receiving calls after a few minutes. If you need a refresher on how a call works, the guide to VoIP for business starts from the basics.
The ports Vohippo uses
To make a phone or PBX work with Vohippo you need two kinds of traffic.
| Traffic | Protocol | Server ports | What it is for |
|---|---|---|---|
| SIP signalling | UDP | 5060 | Registration, setting up and ending calls |
| Voice (RTP) | UDP | 10000-20000 | Call audio, in both directions |
The server is sip.vohippo.com, port 5060 UDP. The transport to set on phones, softphones and PBXs is UDP.
Do I need to open ports on the router?
In most cases no. The phone registers outwards and the router, which is almost always a stateful firewall, lets replies and incoming calls back in on the same connection. Rules are only needed if the office has a firewall that also blocks outbound traffic: in that case allow UDP to sip.vohippo.com on port 5060 and on ports 10000-20000, plus the related replies.
SIP ALG: why you should switch it off
Many routers have a feature called SIP ALG (Application Layer Gateway), sometimes labelled "SIP helper", "SIP passthrough" or simply "SIP". The idea is good: the router reads the SIP messages passing through and rewrites private addresses with the public one.
The problem is that it often does it badly: it rewrites only some fields, gets the ports wrong, and interferes with the corrections the phone or server already make on their own. The symptoms are one-way audio, calls that drop after 30 seconds, phones that show as registered but do not ring, or registrations that drop at regular intervals.
The advice, valid for Vohippo and almost every operator, is to switch off SIP ALG on the router. Where to find it depends on the model: usually in the advanced, firewall or NAT settings. On some routers supplied by the operator it is not visible in the interface and you have to ask their support. After switching it off, restart the router and the phones so the old mappings are cleared.
What the Vohippo server already does
The good news is that most of the NAT work is done by the server. These corrections are active on every account:
- force_rport: the server replies to the address and port the message actually came from, not those written inside the message
- rewrite_contact: the address the phone registers with is replaced by the public one seen by the server, so incoming calls find their way
- rtp_symmetric: audio is sent back to the address and port it comes from, even if the phone announced a private address
- RTP keepalive every 30 seconds: during a call the audio stream is kept open even in moments of silence, so the router does not close it
That is why, with an ordinary router and SIP ALG switched off, you do not need to configure STUN or enter the public address on the phone. In fact, wrong manual NAT settings on the phone are a frequent cause of one-way audio: if you added them in the past without a specific reason, try removing them.
Keepalive and registration expiry
The router keeps the mapping between the phone and the server in memory for a limited time. If no traffic passes during that time, it forgets it. From then on the server keeps sending calls to the address it knows, but the router no longer knows who to deliver them to: the phone shows as registered and does not ring.
There are two ways to prevent this, and it is best to use them together.
Registration expiry
Each phone registers for a certain time, after which it renews the registration. On Vohippo the default expiry is 600 seconds; the advice is to set it between 300 and 600 seconds. Very high values, such as an hour, leave the phone unreachable for too long if something changes; very low values, under a minute, generate pointless traffic with no benefit.
The phone's keepalive
Almost all phones and softphones have a NAT keepalive option: they send a small packet to the server at regular intervals, only to keep the mapping in the router open. If your phone has it, switch it on with an interval between 15 and 30 seconds: that copes even with routers that forget UDP connections quickly.
Several devices on the same account
Each account can register up to 5 devices at once: for example the phone in the office and the app on your mobile. Each keeps its own registration and keepalive. If a device is no longer in use you do not need to do anything: its registration expires on its own.
Fail2ban and blocked IP addresses
The server protects accounts from people trying to guess passwords. The system is called fail2ban: if 5 authentication errors in 10 minutes arrive from the same IP address, that address is blocked for a while. Anyone who keeps getting it wrong is blocked for progressively longer periods.
The flip side is that the same mechanism can also block a genuine office. It happens when:
- you changed the password in the portal but not on the phone, which keeps retrying with the old one
- a phone forgotten in a drawer or an old softphone on a laptop retries on its own with credentials that are no longer valid
- you copied the username with an extra space
Since everyone in the office goes out under the same public address, a single misconfigured device blocks the whole office. The symptom is that suddenly no phone registers any more.
How to unblock an address
- Find the device with the wrong credentials and correct them, or switch it off.
- In the portal open the «IP address security» page and check whether your public address is blocked.
- Unblock the address from there.
- Restart the phones, or force a new registration, and check that they show as registered.
If you unblock without fixing the device first, the address is blocked again within minutes. To find out which device is failing, the portal has SIP logs for each extension covering the last 7 days.
Authentication by IP address
If you have a PBX or a dialler with a fixed IP address, you can authenticate the account by «IP address» instead of «Username and password», or with «Username/password and IP», which requires both. You can enter up to 20 IPv4 addresses or networks. It is the typical setup for a SIP trunk to a company PBX.
Quick diagnosis: symptom, cause, fix
| Symptom | Most likely cause | What to do |
|---|---|---|
| You hear the other person but they cannot hear you, or vice versa | SIP ALG or manual NAT settings on the phone | Switch off SIP ALG, remove STUN and public address from the phone |
| The phone shows as registered but does not ring | NAT mapping expired | Registration expiry 300-600 s, keepalive 15-30 s |
| The call always drops after about 30 seconds | SIP acknowledgements do not get back to the phone, often because of SIP ALG | Switch off SIP ALG, check that the transport is UDP |
| Suddenly no phone registers | Address blocked by fail2ban | Fix the credentials, then unblock from «IP address security» |
| Error 403 or 401 on registration | Wrong username or password | Copy the credentials again from the portal, without spaces |
| Choppy audio | Congested Wi-Fi, unstable network, packet loss | Network cable or QoS on the router; see the codec guide |
For audio quality problems that do not depend on NAT, the guide to VoIP codecs G.711 and G.722 explains how to recognise those caused by a wrong negotiation.
VPNs, guest networks and special cases
Some setups need extra attention.
- Company VPN. If the laptop goes out to the internet through a VPN, the softphone registers with the VPN's address. It works, but a password error there blocks the VPN's address, meaning everyone who uses it.
- Guest networks and hotels. Some public Wi-Fi networks block UDP or non-standard ports. If the softphone will not register outside the office, try your mobile's connection: if it works there, the guest network is the problem. When travelling, the Vohippo app for iPhone and Android is often the simplest solution; it is described in the guide on how to set up a softphone.
- 4G and 5G mobile connections. They often use a very aggressive carrier NAT that closes mappings quickly: keep the keepalive on.
If something still does not add up after these checks, write to us from the contact page with the account, the time of a test call and the symptom: from the SIP logs we can see what happened. Settings for individual phones are in the guide on how to configure a VoIP phone; to start from scratch, sign up at https://cloud.vohippo.com/register.
Frequently asked questions
Which ports do I need to open for VoIP?
Usually none inbound: the phone registers outwards and the router lets the replies through. If your firewall blocks outbound traffic, allow UDP to sip.vohippo.com on port 5060 for signalling and on ports 10000-20000 for voice.
Why can I hear the other person but they cannot hear me?
That is one-way audio, almost always caused by NAT. The most common causes are SIP ALG switched on in the router or wrong manual NAT settings on the phone. Switch off SIP ALG, remove STUN and the public address from the phone, and restart the router and devices.
What is SIP ALG and how do I switch it off?
It is a router feature that rewrites SIP messages to work around NAT, but it often breaks them. You switch it off in the router's advanced, firewall or NAT settings; on some operator-supplied routers you have to ask their support.
Why is the phone registered but not receiving calls?
Because the router has forgotten the mapping to the server while the phone was idle. Set the registration expiry between 300 and 600 seconds and, if the phone supports it, a NAT keepalive between 15 and 30 seconds.
My IP address has been blocked: what do I do?
The block is triggered after 5 authentication errors in 10 minutes from the same address. First fix the device that is using the wrong password, then unblock the address from the portal's «IP address security» page: if you do not fix it first, the block comes back.
Do I need STUN to use Vohippo?
Normally no. The server already corrects the addresses in the messages and the audio for anyone behind NAT, so STUN and the public address on the phone should be left empty, except in special cases.