MikroTik exposes its SIP NAT helper under IP > Firewall > Service Ports. Disable only the sip entry, verify disabled=yes and test fresh SIP sessions while keeping connection tracking and normal firewall protections enabled.
Record and protect the current configuration
Record the RouterOS version and affected voice hosts. Save an authorised configuration backup and export before changing the router, protecting both as sensitive files. Use a maintenance window and trusted management access.
IP > Services controls management services such as SSH and WinBox. It is not the SIP helper menu. Do not disable management access while following this guide.
Disable SIP helper in WinBox or WebFig
- 1Open Service Ports
Navigate to IP > Firewall > Service Ports. Locate the entry named sip, not a numbered firewall rule.
- 2Record then disable
Record its original enabled state and options. Select sip and choose Disable, or open it and set Disabled, depending on the interface version.
- 3Verify
Confirm the entry is disabled. Menu styling differs between WinBox and WebFig; terminal output below provides a direct check.
Alternative: disable by name in terminal
Verify disabled=yes or the disabled flag in the final output. RouterOS applies and persists ordinary configuration changes immediately; it does not use EdgeOS commit/save commands.
Setting sip-direct-media=no is not the same as disabling the helper. Leave unrelated service helpers and the firewall connection-tracking facility unchanged.
/ip firewall service-port print detail where name="sip"
/ip firewall service-port set [find where name="sip"] disabled=yes
/ip firewall service-port print detail where name="sip"Create fresh sessions and retest
- 1Refresh only affected state
Restart the test phone registration or, during the maintenance window, remove only positively identified voice connections. Do not run an unfiltered connection-table removal command.
- 2Validate calls
Test registration refresh, exact inbound DDI, approved outbound identity, two-way audio, DTMF, hold, transfer and a call lasting more than five minutes.
- 3Investigate remaining faults
Check double NAT, public/private SDP addresses, provider media allowlists and state timeouts. Do not change FastTrack, queues or global UDP timeouts without evidence and a separate change plan.
- 4Restore if needed
If a regression is proven and the entry was originally enabled, use /ip firewall service-port set [find where name="sip"] disabled=no. Retest with fresh state. Do not re-enable it if it was already disabled before the test.
Keep input-chain management protection and forward-chain traffic policy intact. Direct-IP SIP requires the account allowlists; a registered handset normally creates outbound state itself.