Firewalls often block SIP registration because they prevent the incoming traffic required by the SIP registration process. SIP registration involves a series of requests and challenges between your device and SIPcity to authenticate credentials and store your IP address and port. Without successful registration, incoming calls cannot be routed to your device.
How registration works
SIPcity authenticates your credentials and stores your IP address and port during registration. When an incoming call arrives, we redirect it to your last registered address. If your router blocks our incoming traffic, the call fails.
Registration for inbound calls only
Registration is only needed to receive incoming calls. Outbound calls do not require registration because we verify your credentials on each call. Registration lets us direct inbound calls through your firewall to your device.
SIP keep-alive
Routers regularly close open ports for security reasons, which prevents SIPcity from routing calls to your device. Set your phone’s keep-alive interval to 180 seconds so it updates our registration server every 3 minutes with your latest IP address and port. This ensures we can successfully redirect incoming calls.
Recommendations
-
SIP ALG: Disable SIP ALG on your router. Most implementations (except Juniper and Cisco) incorrectly modify SIP packets, causing registration and incoming call failures.
-
TLS: Use TLS (port 5061) as a workaround. TLS encrypts traffic, preventing SIP ALG from corrupting packets.
-
Port forwarding: Forward UDP port 5060 to your device. We recommend restricting this traffic to our trunking IP address 27.111.13.68 or subnet 27.111.13.0/24. We also listen on port 50600 for SIP traffic.