In short
A VoIP router is either a router with built-in phone ports, which acts as an adapter for analogue phones, or any business router set up for voice. For a VoIP phone system, the settings matter more than the label: SIP ALG off, voice prioritised and shaped, the platform's traffic allowed, stable NAT, and failover to a second connection.
Want help with VoIP router set-up?
We can plan it with you or do it for you. Tell us where you are up to.
What a VoIP router means
The term is used in two ways, and it helps to know which one you are looking at.
| Type | What it is | Typical use |
|---|---|---|
| Router with phone ports | A router with one or more analogue phone sockets and a built-in adapter (ATA) that turns them into VoIP lines | A digital landline at a small site: plug an ordinary phone into the router |
| Ordinary business router or firewall | No phone ports; IP phones, apps and the phone system pass through it as data | A VoIP phone system with IP desk phones, softphones and mobile apps |
| Router plus separate adapter | Any router with a stand-alone analogue telephone adapter behind it | Keeping analogue phones, door entry or franking machines on a VoIP system |
When traditional lines go digital, Openreach notes that digital phone lines usually work through a broadband router rather than a wall socket. That is the first type, often called a VoIP landline. A business VoIP phone system usually uses the second: the phones are IP devices, so the router needs no phone ports at all, just the right settings. For analogue devices, see VoIP adapters.
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
VoIP router settings that matter
Whichever router you have, these are the settings to check before a VoIP phone system goes live:
| Setting | What to do | What goes wrong if it is missed |
|---|---|---|
| SIP ALG (SIP helper) | Turn it off, or use a router where it can be turned off | Phones fail to register, one-way audio, calls that drop or will not transfer |
| QoS and shaping | Prioritise DSCP EF (46) voice and shape upload just below the real line speed | Choppy or robotic audio whenever the line is busy |
| Firewall rules | Allow the platform's published ports and addresses; restrict anything inbound to trusted sources | Calls fail to connect, or the system is exposed to scanning |
| NAT | Keep UDP mappings stable for the life of a session | Audio stops mid-call or calls drop |
| Session timers | Keep firewall UDP timeouts longer than the phones' re-registration interval | Phones go unregistered and miss incoming calls |
| Packet inspection and acceleration | Exclude voice from features that rewrite or delay packets, if they cause problems | Intermittent one-way audio or dropped calls |
The details vary by platform, so we can confirm them for yours. The full background on prioritising voice is in VoIP QoS settings.
SIP ALG: should it be on or off?
SIP ALG (application layer gateway) is a router feature that rewrites the addresses inside SIP messages as they cross NAT. The idea was to help older phones work behind a router. In practice, modern VoIP platforms and phones handle NAT themselves, and a router rewriting their messages tends to break things.
The vendors are clear. 3CX advises using a router or firewall without a SIP helper or SIP ALG, or one on which it can be disabled. Cisco recommends turning SIP ALG off for Webex Calling, noting that some implementations cause problems with firewall traversal even though Webex Calling traffic is encrypted.
Some routers re-enable SIP ALG after a firmware update or a factory reset, so it is worth checking again whenever calls suddenly start misbehaving.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Firewall rules, ports and NAT by platform
Each platform publishes the traffic it needs. A few examples from the vendors' own documents:
- 3CX on premise: SIP on port 5060 (UDP) and 5060 to 5061 (TCP), RTP audio on UDP ports 9000 to 10999 with two ports per simultaneous call, and port 5090 for the tunnel the 3CX apps use remotely. 3CX recommends running its Firewall Checker after configuring the firewall, and an SBC or the apps' tunnel for remote IP phones
- Microsoft Teams: allow the Teams addresses and ports Microsoft lists in its Microsoft 365 URLs and IP ranges, make sure the firewall does not change NAT addresses or ports for UDP, and size the NAT pool so ports do not run out
- Webex Calling: allow the ports in Cisco's Webex Calling port reference. Cisco prefers UDP for media and recommends SRTP over UDP only
Allowing a platform's traffic is not the same as opening the network up. The NCSC advises locking inbound and outbound PBX traffic down to trusted addresses such as your SIP trunk provider. See VoIP security for the rest of the controls.
VoIP QoS router settings
The router is the most important QoS point on the network, because it sits where fast office traffic meets the slower internet connection.
- Trust or set DSCP EF (46) on voice traffic coming from the voice VLAN or the platform's known ports
- Create a priority queue for voice, sized for your peak simultaneous calls
- Shape outbound traffic slightly below the line's real upload speed, so packets queue on your router rather than in the provider's network
- Give signalling its own class using the marking your platform documents
- Test at a busy time and check the markings survive to the edge
A router with good QoS cannot make a small line bigger. If your peak calls take a large share of the upload, look at a faster connection; our sister sites cover broadband for VoIP and leased line vs broadband.
Dual WAN and 4G or 5G failover
A cloud phone system depends on the office internet connection. A router with two WAN ports can use a second connection when the first one fails, so calls carry on.
- A second fixed line from a different provider or route, for sites where calls are critical
- 4G or 5G backup through a cellular gateway or a router with a mobile module, which also covers sites waiting for a fixed line
- Failover rules that move voice to the backup link, with QoS applied to it as well
Calls in progress may drop as the link changes, then phones re-register over the new path. Mobile apps give a further fallback, since they can use mobile data directly. For a cloud-managed option, see Meraki MG cellular gateways on our sister site, which hand a 4G or 5G connection to your firewall or router as an ordinary Ethernet uplink.
How we help
Forever Systems can check your current router against the platform you choose, recommend changes or a replacement where one is needed, and set up the settings above, with much of the work done remotely. We can also add a backup connection and test failover before go-live.
Contact us with your router make, your connection and the platform you use or are considering, and we can tell you what to change.
How Forever Systems helps you choose a VoIP phone system
We supply and support several VoIP platforms, so we can recommend the one that fits how your team takes calls rather than fitting your business around one product.
- Platform advice across hosted 3CX, Microsoft Teams Phone, Webex Calling, Forever UC and Forever Teams, with SIP trunks for phone systems you already own
- A requirements check of your broadband, network and routers before anything goes live
- Numbers and porting: we can help you keep your existing business numbers and plan the move away from analogue and ISDN lines
- Handsets and headsets that suit each platform, bought outright or, in some cases, included in your monthly rental, with the options confirmed at quote
- Set-up and changes: call flows, users and devices configured for you, and help with moves, adds and changes afterwards
- For BT Cloud Voice, see our sister site cloudvoice.cloud, and for hosted and cloud platforms in depth, cloudphone.cloud
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
Do I need a special router for VoIP?
Usually not. Most business routers and firewalls work well with a VoIP phone system once SIP ALG is turned off, voice is prioritised and shaped, and the platform's traffic is allowed. A router with phone ports is only needed to plug analogue phones straight in.
What is a VoIP router?
It usually means a router with built-in analogue phone ports and an adapter, so an ordinary phone can make VoIP calls. The term is also used for any router set up for voice traffic. For a business VoIP phone system with IP phones, the settings matter more than phone ports.
Should SIP ALG be on or off for VoIP?
Off, in most cases. 3CX advises a router or firewall without SIP ALG or one where it can be disabled, and Cisco recommends turning it off for Webex Calling. Check it again after firmware updates or resets, which can switch it back on.
Can I plug a VoIP phone into my router?
Yes. An IP desk phone can plug into a spare router or switch port. A PoE switch saves a power adapter at each desk. An analogue phone needs a router with phone ports or a separate VoIP adapter.
What router settings improve VoIP call quality?
Prioritise voice with DSCP EF (46), shape outbound traffic just below the real upload speed, keep NAT mappings stable for UDP, set session timers longer than phone re-registration, and turn SIP ALG off.
Will VoIP keep working if my internet goes down?
Not over that connection, but there are good fallbacks: a router with a second line or 4G or 5G backup, mobile apps on mobile data, and call forwarding rules that send calls to mobiles or another site.
Still have a question about VoIP router set-up?
Ask us and a member of our team will reply by email.