Overview
This guide explains how to configure pfSense firewall for SIP-based VoIP.
pfSense is very capable, but defaults like SIP helpers, NAT reflection, and state handling can cause issues if left enabled.
Before you start
You’ll need:
- Web UI access to the firewall
- Basic understanding of NAT and firewall rules
- SIP provider info
Ports used by VoIP
- SIP: 5060 (UDP/TCP), optionally 5061
- RTP: typically UDP 10000–20000
Configuration
1. Disable SIP ALG / helper
Go to:
System → Advanced → Firewall & NAT
Disable:
- SIP Helper
2. Outbound NAT
Go to:
Firewall → NAT → Outbound
Set mode to:
- Hybrid or Manual
Ensure:
- LAN traffic is NAT’d out via WAN
- No unusual port rewriting
3. Firewall rules
Go to:
Firewall → Rules → LAN
Ensure outbound traffic is allowed for:
- UDP 5060
- UDP 10000–20000
4. Disable NAT reflection
Go to:
System → Advanced
Disable:
- NAT Reflection
SIP generally doesn’t behave well with it enabled.
5. Traffic shaping
Use the wizard:
Firewall → Traffic Shaper
- Select VoIP preset
- Prioritise RTP
Good practice
- Keep NAT simple
- Avoid unnecessary floating rules
- Use aliases for provider IPs
Troubleshooting
One-way audio
Check:
- RTP ports
- NAT behaviour
- SIP helper is off
Calls dropping
Check:
- Firewall states
- Session timeouts
- NAT consistency
Phones not registering
Check:
- Firewall rules
- DNS
- Default gateway
Quality issues
Check:
- Traffic shaping
- WAN utilisation