Bypass SIP ALG on a Spectrum Ubee router: home-worker VoIP drops and one-way audio

Router & ISP SIP ALG issuesMANUAL FIX INSIDEFREE — NO SIGNUP
Quick answer. Spectrum's Ubee gateways ship with SIP ALG enabled on 5060/5061 and no reliable way to turn it off on most firmware revisions — the toggle exists on some models and silently re-enables or ignores the setting on others. The ALG rewrites the Via and Contact headers on the worker's signaling, so the ACK confirming each call never reaches the SBC and Timer H tears the call down at exactly 32 seconds (RFC 3261). The dependable fix on Ubee hardware is to move SIP signaling to port 5062, which no residential ALG inspects — after checking and disabling the toggle where the firmware honors it.

The raw code check

Run this before you change anything — it confirms the root cause in one pass:

worker registration through Ubee on 5060FAIL
REGISTER via 5060 → Contact header rewritten
NAT keepalive: mangled — registration flaps
INVITE/200 OK ok — ACK lost
one-way audio @ 32s (Timer H)
worker registration via 5062OK
REGISTER via 5062 → headers untouched
NAT keepalive: clean — registration stable
INVITE / 200 OK / ACK — all legs green
two-way audio, call survives past 32s

The manual fix — 3 steps

  1. Check the Ubee admin for an ALG toggle first. Browse to 192.168.0.1, sign in with the credentials on the gateway label, and look under Voice or Advanced for a "SIP ALG" setting. Disable it and save. Then test a real call — on Ubee firmware that honors the toggle, you're done.
  2. Move the worker's SIP signaling to port 5062. If the drops continue, reconfigure the worker's SIP client (softphone or desk phone SIP settings) to use port 5062 instead of 5060 — on the local SIP listener and the outbound proxy port. Residential ALGs inspect 5060/5061 only, so 5062 passes untouched regardless of firmware behavior.
  3. Confirm with a scan plus a 5-minute call. Scan the worker's public IP with the free SIP ALG Port Scanner (5060 should show rewriting, 5062 clean), then hold a five-minute test call. Surviving past 32 seconds with two-way audio is the pass condition.

The automated alternative

If you'd rather never do this again: VoipFlow runs this whole class of maintenance as software — certificate issue-and-bind in about 12 seconds, signaling on port 5062 so SIP ALG rewriting never engages, per-tenant isolation, flat $399/mo. The 14-day sandbox is free, no credit card, and no sales follow-up unless you ask for one.

Deploy Free 14-Day Sandbox — No Credit Card Required

Related