On an EdgeRouter running EdgeOS, disable the SIP conntrack module, review the pending change, commit and save. This guide is for EdgeRouter, not UniFi gateways or Dream Machines.
Back up and identify the platform
Record the EdgeRouter model and EdgeOS release. Export its configuration through System before changing a production router. Keep the backup private because it can contain secrets.
Confirm the original fault with an inbound and outbound call. A helper cannot inspect correctly encrypted SIP over TLS; TLS or credential failures need separate diagnosis.
Disable the SIP helper in EdgeOS
Connect using the web interface CLI button or authorised SSH from a trusted management network. Do not expose SSH to the whole internet.
Inspect the current configuration before editing. In configuration mode, review compare before commit; if unrelated pending changes appear, stop and resolve them with the administrator.
show configuration commands | match conntrack
configure
set system conntrack modules sip disable
compare
commit
save
exit
show configuration commands | match conntrackCommit applies the working change. Save makes the active configuration survive a restart. Confirm both succeed. Do not reboot or flush all connections as a routine step.
Alternative: use Config Tree
Where supported by the installed EdgeOS interface, open Config Tree > system > conntrack > modules > sip, set disable and apply. Verify the active and startup configuration using the CLI. If that tree is absent, use the supported CLI or the exact release documentation.
Do not use UniFi controller instructions on EdgeOS. The products have different configuration ownership.
Validate calls and preserve the firewall
- 1Establish fresh sessions
During a change window, restart the affected SIP account or clear only its identified states. Existing calls may otherwise retain earlier helper state.
- 2Test registration and calls
Confirm registration across two refresh cycles, inbound DDI routing, outbound caller ID, two-way audio, DTMF, hold, transfer and a call longer than five minutes.
- 3Keep access restricted
Leave connection tracking, firewall rules and management ACLs enabled. Direct-IP trunks require the issued provider source lists; registered phones do not need unrestricted inbound port forwards.
- 4Roll back only the scoped change
If the change causes a regression, restore the recorded SIP module configuration, compare, commit and save. Do not replace the entire router configuration unless that is the approved recovery plan.