Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found out my ISP is blocking outgoing SIP port (5060) at home. I have a remote Linux server that I can use to listen on different port than 5060 and do the forwarding for the traffic. Not sure what iptables rules needs to be applied to make things work.

Is there a need to do the forwarding for RTP ports (10000-20000)?

Your help is appreciated.


share|improve this question
You could always switch to an ISP which doesn't block SIP connections. – kaerast Jun 21 '10 at 20:45

Can you run a SIP proxy on your remote machine, say on 15060? Then you can set up your local SIP user agent to use that machine. Signalling traffic from your SIP UA goes out on 15060, and incoming calls will route through your proxy.

You wouldn't have any additional need to forward RTP with the above setup, but you might still need to work around your NAT if you have one.

share|improve this answer
I would believe this to be the best solution out of those posted. High latency = high jitter = bad phone calls, so piping through a VPN or SSH tunnel or other "firewall defeaters" is probably a bad idea. You would have to pry around and then how to expect incoming on this port without PAT? Maybe use SRV record for SIP? But, also, you might just want to get your client to upgrade to a business level ISP plan, as they likely will allow traffic over this port. – mbrownnyc Oct 28 '11 at 12:34

Many VOIP carriers listen on other ports besides 5060. (Typical ranges to listen on are like 5060-5080.) I had periodic problems when I was with Comcast with 5060 getting blocked; I'd need to change my VOIP ATA to 5060, 5062, etc., periodically.

I never figured out why the port would get blocked, although I assume it was some sort of spam filtering or abuse prevention. It didn't seem to be an attempt to block SIP outright, since it was easy to get around; if your ISP is honestly trying to prevent you from using VOIP, then the workaround might not be quite so trivial.

But I would "try before you pry" and just go up to 5061 or something else in the listening range before you get started with forwarding through a remote server.

share|improve this answer

If your ISP has told you they are blocking port 5060 and won't help you reconfigure your client to use VOIP (in which case they mean to block SIP) then you should vote with your feet and switch to an ISP that supports the functions you need.

Otherwise you will just be playing whackamole with your ISP as they tighten their anti-SIP policy. But talk to them in case they aren't trying to block SIP - they might be able to help you.

share|improve this answer

One more complicated solution is to use a VPN. You will want a low encryption VPN over a UDP transport protocol or else you can expect bad latency.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.