The Two Biggest FreePBX Problems
After analyzing thousands of threads on the FreePBX Community Forum, two issues dominate the support requests by a wide margin:
#1 Registration Failures
Extensions refuse to register, SIP trunks show "Unavailable," and phones can't connect to FreePBX. The #1 most viewed issue on the forum with over 200,000 combined views across related threads.
#2 One-Way Audio
Calls connect but audio only flows in one direction, or there is no audio at all. Sangoma's own documentation states that 99% of one-way audio cases are caused by NAT/firewall misconfiguration.
Good news: Both problems share the same root cause in most cases: NAT and firewall misconfiguration. Fix the network, and both issues typically disappear. This guide walks you through every step.
Understanding Registration Failures
When an extension or SIP trunk fails to register, FreePBX cannot route calls to or from that device. Understanding the symptoms helps you pinpoint the cause quickly.
Common Symptoms
Check via Admin > Asterisk Info > Peers or run asterisk -rx "pjsip show endpoints" on the CLI.
Usually indicates incorrect credentials, wrong SIP server address, or the extension is not configured in FreePBX.
Means FreePBX cannot reach the SIP provider. Often a firewall issue blocking outbound UDP 5060.
NAT keep-alive failures or aggressive router timeout settings. Registration expires before the next keep-alive.
Root Causes
| Cause | Frequency | Typical Error |
|---|---|---|
| Firewall blocking UDP 5060 | Very Common | Retransmission timeout, no response |
| Wrong credentials (user/pass) | Common | 401 Unauthorized, 403 Forbidden |
| FreePBX Firewall blocking IP | Common | Connection refused, no response |
| NAT not configured properly | Common | Intermittent registration drops |
| SIP ALG enabled on router | Moderate | Random failures, corrupted SIP headers |
| Wrong SIP port or transport | Less Common | Connection refused |
Fixing Registration Failures
Work through these steps in order. Most registration problems are resolved by step 3.
Verify Credentials
The most overlooked step. Log in to FreePBX and confirm the extension exists and the password matches exactly.
In FreePBX GUI: Applications > Extensions > click the extension > verify the Secret field matches what is configured on the phone.
Check the FreePBX Firewall
FreePBX has a built-in firewall module that blocks IPs not in its trusted zones. This is the most common cause of remote phone registration failures.
In FreePBX GUI: Connectivity > Firewall > Status. Make sure remote phone IPs are in the "External" or "Other" zone with SIP access enabled.
Open Required Ports on Your Router/Firewall
FreePBX needs these ports open and forwarded if behind NAT:
| Port | Protocol | Purpose |
|---|---|---|
| 5060 | UDP | SIP signaling (default) |
| 5061 | TCP/TLS | SIP over TLS (encrypted) |
| 10000-20000 | UDP | RTP media (voice audio) |
| 8089 | TCP | WebSocket (WebRTC/UCP) |
Critical: Do NOT change the SIP port to something non-standard thinking it will improve security. It breaks more than it helps. Instead, use the FreePBX Firewall module and fail2ban for protection.
Disable SIP ALG on Your Router
SIP Application Layer Gateway (ALG) is a "helpful" router feature that rewrites SIP packets. In practice, it breaks SIP almost every time. Disable it on every router between your phones and FreePBX.
Verify DNS and Network Connectivity
Make sure FreePBX can resolve DNS and reach your SIP provider.
Understanding One-Way Audio
One-way audio is when a call connects successfully but audio only flows in one direction: you can hear the other party but they can't hear you, or vice versa. Sometimes there is no audio in either direction.
Why This Happens
VoIP calls use two separate protocols:
SIP (Signaling)
Handles call setup, teardown, and routing. Uses port 5060 (UDP). If SIP works, the call connects - you hear ringing and an answer.
RTP (Media)
Carries the actual voice audio. Uses ports 10000-20000 (UDP). If RTP is blocked, the call connects but you hear silence.
The most common scenario: SIP signaling passes through the firewall, so the call connects. But RTP packets are blocked or misrouted, so there is no audio. This is almost always a NAT problem.
Quick Diagnostic
they don't hear you
RTP from your side is not reaching the far end. Your router/NAT is not forwarding outbound RTP correctly, or FreePBX does not know its external IP.
you don't hear them
RTP from the far end is not reaching your phone. Inbound RTP ports (10000-20000) are blocked on your firewall, or NAT is not forwarding them to FreePBX.
at all
RTP is completely blocked in both directions. Often caused by SIP ALG rewriting the SDP with wrong IP addresses, or all RTP ports are firewalled.
then drops
NAT connection tracking timeout. The router forgets the UDP session after a period of silence. Fix by reducing RTP timeout or enabling keep-alive.
Fixing One-Way Audio
These steps resolve one-way audio in the vast majority of cases. Apply them in order.
Set Your External IP in FreePBX SIP Settings
This is the #1 fix. FreePBX needs to know its public IP so it can include the correct address in SIP/SDP packets.
Go to Settings > Asterisk SIP Settings > General:
| Setting | Value |
|---|---|
| External Address | Your public IP (e.g., 203.0.113.10) |
| Local Networks | 192.168.1.0/24 (your LAN subnet) |
| NAT | Yes |
| IP Configuration | Static IP or Dynamic Host |
Dynamic IP? If your ISP gives you a dynamic public IP, set IP Configuration to "Dynamic IP" and enter a DDNS hostname (like myfreepbx.dyndns.org) in the External Address field. FreePBX will auto-detect your IP.
Forward RTP Ports on Your Router
Forward UDP ports 10000-20000 to your FreePBX server's internal IP. Without this, inbound audio packets are dropped by NAT.
Disable SIP ALG (Again)
SIP ALG is worth mentioning twice because it causes both registration and audio problems. It rewrites the SDP body of SIP packets, changing the IP addresses that tell the far end where to send audio. This directly causes one-way and no-audio issues.
SIP ALG must be disabled. There is no scenario where SIP ALG helps FreePBX. Every major VoIP vendor recommends disabling it. If you cannot find the setting on your router, search for your router model + "disable SIP ALG."
Enable NAT on Extensions
For remote phones behind NAT, each extension needs NAT mode enabled.
PJSIP (default): Go to Applications > Extensions > select the extension > Advanced tab:
| Setting | Value |
|---|---|
| NAT | Yes (force_rport, comedia) |
| Rewrite Contact | Yes |
| RTP Symmetric | Yes |
These settings tell Asterisk to ignore the IP address in the SIP headers and instead send RTP back to wherever the packets actually came from. This is the correct behavior for NAT traversal.
Test with a SIP Trace
If audio is still broken, capture a SIP trace to see exactly what is happening:
If the c= line shows a private IP (192.168.x.x, 10.x.x.x, 172.16-31.x.x), your External Address in SIP Settings is not configured correctly. Go back to Step 1.
FreePBX Firewall Module Best Practices
FreePBX includes a built-in firewall module (the "FreePBX Firewall" or "Responsive Firewall") that is a double-edged sword: it protects your system from SIP attacks but frequently blocks legitimate traffic when misconfigured.
Network Zones
The firewall categorizes traffic into zones. Understanding them is key:
| Zone | Access Level | Use For |
|---|---|---|
| Trusted | Full access to all services | Your LAN subnet, admin IPs |
| Local | SIP, PJSIP, and provisioning | Local network phones |
| Other | SIP and PJSIP only | Remote phones, SIP trunks |
| External | Blocked by default | Everything else (internet) |
Responsive Firewall
The Responsive Firewall feature automatically allows IPs that successfully authenticate. Enable it in Connectivity > Firewall > Services by toggling the Responsive Firewall icon for PJSIP/SIP. This lets remote phones register without manually adding their IPs.
SIP Trunk Provider IPs: Always add your SIP trunk provider's IP ranges to the Trusted or Other zone. For IPComms, add the IPs provided in your portal to ensure trunks are never blocked. Check Connectivity > Firewall > Networks.
FreePBX SIP Settings Checklist
Use this checklist to verify all the critical settings are correct. These settings are found under Settings > Asterisk SIP Settings in FreePBX.
General SIP Settings
PJSIP Channel Settings
Router/Network Checklist
After making changes: Always click Submit then Apply Config in FreePBX. Some SIP settings require an Asterisk restart: fwconsole restart
Preventing Future Issues
Once you have FreePBX working correctly, follow these practices to avoid recurring problems.
Use a Static Public IP
A dynamic IP that changes will break all SIP trunks and remote extensions until you update the External Address. If a static IP is not available, use DDNS with the Dynamic IP option in SIP Settings.
Keep FreePBX Updated
Run fwconsole ma updateall regularly. Module updates often include fixes for NAT handling and PJSIP improvements. Back up before updating.
Monitor Registrations
Set up email alerts for trunk failures. FreePBX can notify you when a trunk goes down via Settings > Notifications. Catch problems before users report them.
Consider a Hosted SIP Trunk
Using a reliable SIP trunk provider like IPComms eliminates many trunk-side issues. We provide the correct IPs, codecs, and configuration to match your FreePBX setup.
Still stuck? For a deeper dive into one-way audio specifically, see our detailed One-Way Audio Troubleshooting Guide which covers additional scenarios including codec mismatches and network topology issues.
Need a Reliable SIP Trunk for FreePBX?
IPComms provides pre-configured SIP trunks optimized for FreePBX. Get a free test trunk with full support to help you get up and running.