The two most common FreePBX problems solved. Step-by-step fixes for extensions that won't register and calls with missing audio, based on real issues from the FreePBX community forum.
After analyzing thousands of threads on the FreePBX Community Forum, two issues dominate the support requests by a wide margin:
#1 Registration Failures
Extensions refuse to register, SIP trunks show "Unavailable," and phones can't connect to FreePBX. The #1 most viewed issue on the forum with over 200,000 combined views across related threads.
#2 One-Way Audio
Calls connect but audio only flows in one direction, or there is no audio at all. Sangoma's own documentation states that 99% of one-way audio cases are caused by NAT/firewall misconfiguration.
Understanding Registration Failures
When an extension or SIP trunk fails to register, FreePBX cannot route calls to or from that device. Understanding the symptoms helps you pinpoint the cause quickly.
Common Symptoms
Extension shows "UNREACHABLE" in FreePBX
Check via Admin > Asterisk Info > Peers or run asterisk -rx "pjsip show endpoints" on the CLI.
Phone displays "Registration Failed" or "403 Forbidden"
Usually indicates incorrect credentials, wrong SIP server address, or the extension is not configured in FreePBX.
SIP trunk status shows "UNAVAILABLE" or "Retransmission timeout"
Means FreePBX cannot reach the SIP provider. Often a firewall issue blocking outbound UDP 5060.
Phones register intermittently then drop
NAT keep-alive failures or aggressive router timeout settings. Registration expires before the next keep-alive.
Root Causes
Cause
Frequency
Typical Error
Firewall blocking UDP 5060
Very Common
Retransmission timeout, no response
Wrong credentials (user/pass)
Common
401 Unauthorized, 403 Forbidden
FreePBX Firewall blocking IP
Common
Connection refused, no response
NAT not configured properly
Common
Intermittent registration drops
SIP ALG enabled on router
Moderate
Random failures, corrupted SIP headers
Wrong SIP port or transport
Less Common
Connection refused
Fixing Registration Failures
Work through these steps in order. Most registration problems are resolved by step 3.
1
Verify Credentials
The most overlooked step. Log in to FreePBX and confirm the extension exists and the password matches exactly.
# Check extension status from the Asterisk CLI
asterisk -rx "pjsip show endpoints"
# For chan_sip (legacy)
asterisk -rx "sip show peers"
In FreePBX GUI: Applications > Extensions > click the extension > verify the Secret field matches what is configured on the phone.
2
Check the FreePBX Firewall
FreePBX has a built-in firewall module that blocks IPs not in its trusted zones. This is the most common cause of remote phone registration failures.
# Check if your IP is blocked
fwconsole firewall list
# Check fail2ban for blocked IPs
fail2ban-client status asterisk
# Unban a specific IP
fail2ban-client set asterisk unbanip 203.0.113.50
In FreePBX GUI: Connectivity > Firewall > Status. Make sure remote phone IPs are in the "External" or "Other" zone with SIP access enabled.
3
Open Required Ports on Your Router/Firewall
FreePBX needs these ports open and forwarded if behind NAT:
Port
Protocol
Purpose
5060
UDP
SIP signaling (default)
5061
TCP/TLS
SIP over TLS (encrypted)
10000-20000
UDP
RTP media (voice audio)
8089
TCP
WebSocket (WebRTC/UCP)
4
Disable SIP ALG on Your Router
SIP Application Layer Gateway (ALG) is a "helpful" router feature that rewrites SIP packets. In practice, it breaks SIP almost every time. Disable it on every router between your phones and FreePBX.
Make sure FreePBX can resolve DNS and reach your SIP provider.
# Test DNS resolution
nslookup sip.ipcomms.net
# Test SIP connectivity to provider
nc -zvu sip.ipcomms.net 5060
# Check if SIP port is listening locally
ss -ulnp | grep 5060
Building this? Your PBX will need a number
Find a phone number for your trunk
Local numbers $1.50 a month, toll-free $2.00, $1.00 one-time setup. Pick one here and it carries into signup.
Enter an area code, or wait a moment for numbers near you.
One-way audio is when a call connects successfully but audio only flows in one direction: you can hear the other party but they can't hear you, or vice versa. Sometimes there is no audio in either direction.
Why This Happens
VoIP calls use two separate protocols:
SIP (Signaling)
Handles call setup, teardown, and routing. Uses port 5060 (UDP). If SIP works, the call connects - you hear ringing and an answer.
RTP (Media)
Carries the actual voice audio. Uses ports 10000-20000 (UDP). If RTP is blocked, the call connects but you hear silence.
The most common scenario: SIP signaling passes through the firewall, so the call connects. But RTP packets are blocked or misrouted, so there is no audio. This is almost always a NAT problem.
Quick Diagnostic
You hear them, they don't hear you
RTP from your side is not reaching the far end. Your router/NAT is not forwarding outbound RTP correctly, or FreePBX does not know its external IP.
They hear you, you don't hear them
RTP from the far end is not reaching your phone. Inbound RTP ports (10000-20000) are blocked on your firewall, or NAT is not forwarding them to FreePBX.
No audio at all
RTP is completely blocked in both directions. Often caused by SIP ALG rewriting the SDP with wrong IP addresses, or all RTP ports are firewalled.
Audio works then drops
NAT connection tracking timeout. The router forgets the UDP session after a period of silence. Fix by reducing RTP timeout or enabling keep-alive.
Fixing One-Way Audio
These steps resolve one-way audio in the vast majority of cases. Apply them in order.
1
Set Your External IP in FreePBX SIP Settings
This is the #1 fix. FreePBX needs to know its public IP so it can include the correct address in SIP/SDP packets.
Go to Settings > Asterisk SIP Settings > General:
Setting
Value
External Address
Your public IP (e.g., 203.0.113.10)
Local Networks
192.168.1.0/24 (your LAN subnet)
NAT
Yes
IP Configuration
Static IP or Dynamic Host
2
Forward RTP Ports on Your Router
Forward UDP ports 10000-20000 to your FreePBX server's internal IP. Without this, inbound audio packets are dropped by NAT.
# Example: iptables rule on a Linux router
iptables -t nat -A PREROUTING -p udp --dport 10000:20000 \
-j DNAT --to-destination 192.168.1.100
# Verify RTP port range in FreePBX
asterisk -rx "rtp show settings"
3
Disable SIP ALG (Again)
SIP ALG is worth mentioning twice because it causes both registration and audio problems. It rewrites the SDP body of SIP packets, changing the IP addresses that tell the far end where to send audio. This directly causes one-way and no-audio issues.
SIP ALG must be disabled. There is no scenario where SIP ALG helps FreePBX. Every major VoIP vendor recommends disabling it. If you cannot find the setting on your router, search for your router model + "disable SIP ALG."
4
Enable NAT on Extensions
For remote phones behind NAT, each extension needs NAT mode enabled.
PJSIP (default): Go to Applications > Extensions > select the extension > Advanced tab:
Setting
Value
NAT
Yes (force_rport, comedia)
Rewrite Contact
Yes
RTP Symmetric
Yes
These settings tell Asterisk to ignore the IP address in the SIP headers and instead send RTP back to wherever the packets actually came from. This is the correct behavior for NAT traversal.
5
Test with a SIP Trace
If audio is still broken, capture a SIP trace to see exactly what is happening:
# Enable SIP debugging
asterisk -rx "pjsip set logger on"
# Make a test call, then check the SDP for IP addresses
# Look for the "c=" line in the SDP body:
c=IN IP4 192.168.1.100 <-- WRONG (private IP leaking)
c=IN IP4 203.0.113.10 <-- CORRECT (public IP)
# Disable when done
asterisk -rx "pjsip set logger off"
If the c= line shows a private IP (192.168.x.x, 10.x.x.x, 172.16-31.x.x), your External Address in SIP Settings is not configured correctly. Go back to Step 1.
FreePBX Firewall Module Best Practices
FreePBX includes a built-in firewall module (the "FreePBX Firewall" or "Responsive Firewall") that is a double-edged sword: it protects your system from SIP attacks but frequently blocks legitimate traffic when misconfigured.
Network Zones
The firewall categorizes traffic into zones. Understanding them is key:
Zone
Access Level
Use For
Trusted
Full access to all services
Your LAN subnet, admin IPs
Local
SIP, PJSIP, and provisioning
Local network phones
Other
SIP and PJSIP only
Remote phones, SIP trunks
External
Blocked by default
Everything else (internet)
Responsive Firewall
The Responsive Firewall feature automatically allows IPs that successfully authenticate. Enable it in Connectivity > Firewall > Services by toggling the Responsive Firewall icon for PJSIP/SIP. This lets remote phones register without manually adding their IPs.
FreePBX SIP Settings Checklist
Use this checklist to verify all the critical settings are correct. These settings are found under Settings > Asterisk SIP Settings in FreePBX.
General SIP Settings
☐
External Address set to your public IP or DDNS hostname
☐
Local Networks includes your LAN subnet (e.g., 192.168.1.0/24)
☐
NAT set to Yes
☐
RTP Port Range set to 10000-20000 (must match router forwarding)
PJSIP Channel Settings
☐
UDP Bind Port is 5060
☐
TLS Bind Port is 5061 (if using TLS)
Router/Network Checklist
☐
SIP ALG disabled on all routers
☐
Port 5060 UDP forwarded to FreePBX server
☐
Ports 10000-20000 UDP forwarded to FreePBX server
☐
FreePBX server has a static internal IP (not DHCP)
☐
DNS resolves correctly from the FreePBX server
Preventing Future Issues
Once you have FreePBX working correctly, follow these practices to avoid recurring problems.
Use a Static Public IP
A dynamic IP that changes will break all SIP trunks and remote extensions until you update the External Address. If a static IP is not available, use DDNS with the Dynamic IP option in SIP Settings.
Keep FreePBX Updated
Run fwconsole ma updateall regularly. Module updates often include fixes for NAT handling and PJSIP improvements. Back up before updating.
Monitor Registrations
Set up email alerts for trunk failures. FreePBX can notify you when a trunk goes down via Settings > Notifications. Catch problems before users report them.
Consider a Hosted SIP Trunk
Using a reliable SIP trunk provider like IPComms eliminates many trunk-side issues. We provide the correct IPs, codecs, and configuration to match your FreePBX setup.
Stop worrying about SIP trunk capacity. We have you covered.
SIP trunking from a US carrier since 2002: $0.009 per minute inbound, $0.010 outbound, numbers from $1.50 a month, $0 per channel, no contracts.
