One-Way Audio: The NAT and Firewall Problem Behind 'Can You Hear Me?'

One-way audio is the signature VoIP malfunction: the call sets up, rings, connects, and then one side hears everything while the other hears silence. It feels impossible, how can half a conversation work?, until you know the secret: a VoIP call is two separate streams. Signaling (SIP) sets the call up; audio (RTP) flows separately, and each direction of audio is its own stream. Setup can succeed while one audio direction dies in transit, which is exactly what happens.

Why NAT is usually the culprit

Office networks use private IP addresses behind a router (NAT). During call setup, each side tells the other "send your audio here", and a device behind NAT naively advertises its private address, which is meaningless to the outside world. The far end dutifully streams audio to an unreachable address; that direction of audio evaporates; the other direction, addressed correctly, flows fine. Result: you hear them, they cannot hear you, or the reverse, depending on which side's advertisement was broken.

SIP ALG: the fix that became the disease

Router vendors "solved" this with SIP ALG (application-layer gateway): the router inspects SIP traffic and rewrites the addresses inside it on the fly. In practice, consumer-router ALG implementations are so reliably buggy, mangling packets modern systems had already fixed properly, that the first commandment of VoIP troubleshooting is: disable SIP ALG. Providers solved NAT correctly on their side years ago (via registration keep-alives and server-side media relays); the router's amateur surgery mostly re-breaks it. If one-way or no audio appears intermittently on an office network, ALG is the prime suspect.

The fix sequence, in order

• Disable SIP ALG on the router (it hides under names like "SIP helper" or "SIP transformations"). This alone resolves the majority of cases.
• Reboot phones/apps after the change so registrations and media paths rebuild cleanly.
• Check double-NAT: a modem-router feeding another router NATs twice and doubles the confusion; bridge the modem or put phones on the outer network.
• Confirm the firewall is not timing out media ports mid-call (symptoms: audio dies after exactly N seconds). Keep-alive settings on the system, or relaxed UDP timeouts, fix this.
• If it persists, capture which direction dies and hand your provider that detail, "audio from us to them fails on external calls", which turns a mystery into a routing lookup on their side.

Why this is rarer than it used to be

Modern hosted systems relay media through their own infrastructure precisely so customer NAT weirdness cannot break the path, one of the quiet advantages of providers running their own session infrastructure. When one-way audio does appear today, it is almost always a local router "helping." Turn off the help, and the problem usually leaves with it.