Skip to content

Turris OS has enabled broken SIP ALG by default and cannot be turned off

SIP ALG is software technology broken by design which mangles data part of UDP and TCP SIP packets during IP routing. It has no value, just breaks signalization of VOIP SIP audio calls and in most cases make VOIP calls unstable with poor quality, random hangouts or fully unusable.

Turris OS has this madness enabled by default and it cannot be easily disabled.

Please turn it off and remove it from default installation.

How to detect it on network: Check that data part of TCP stream to port 5060 is not modified when doing routing/NAT from lan to wan.

It is visible here:

# iptables-save | grep 5060
-A zone_guest_turris_helper -p tcp -m comment --comment "!fw3: SIP VoIP connection tracking" -m tcp --dport 5060 -j CT --helper sip
-A zone_guest_turris_helper -p udp -m comment --comment "!fw3: SIP VoIP connection tracking" -m udp --dport 5060 -j CT --helper sip
-A zone_lan_helper -p tcp -m comment --comment "!fw3: SIP VoIP connection tracking" -m tcp --dport 5060 -j CT --helper sip
-A zone_lan_helper -p udp -m comment --comment "!fw3: SIP VoIP connection tracking" -m udp --dport 5060 -j CT --helper sip

Note that this is all about data content of UDP and TCP packets, not IP headers of IP packets.

More details about SIP ALG and what it cause when is enabled: