PFSense Double-NAT no incomming audio

i have a pfsense router directly behind my ISP router. Currently it is not possible to disable NAT on my ISP router.
I have a Telekom Number connected with my FreePBX-System(PJSIP).
When I connect the FreePBX directly to my ISP´s router, audio is working in both directions. (Tested with Echo *43)
I have no port-Forwarding set up.
But when I connect the FreePBX behind my PFSense, audio is only working in one direction(Outgoing).

My settings (PFSense):

Any ideas?
Thanks in advance.


left: isp router (
right: pfsense (

What type of internet do you have? DSL, Cable, Fiber, etc?

Mainly DSL but my ISP´s router can also load-balance with LTE

I also had a similar problem with Comcast routers. Double NAT just kills SIP.
If you can’t put your router in bridge mode and not have it do NAT, replace it with a third party modem that you can set to bridge mode, if your ISP allows that.

I would try the bridge mode option too. Even if bridge mode isn’t an official option in the webgui of the modem/router combo, a lot of models support pppoe passthrough these days. You can delete your login credentials (if you have access) and then tell pfSense to connect via pppoe with your DSL credentials. You’ll save a lot of headaches with NAT and one-way audio situations.

My “Speedport Hybrid” does not support bridge mode/pppoe passthrough.
This router/modem is the only modem that exists for my DSL/LTE connection.

Can you provide us with the make and model?

Telekom 40275352 Speedport Hybrid

Telekom in Germany?
Routerzwang ist abgeschafft since August 2016, so you should be able to replace it with a third party modem.

Yes thats correct but there is no alternative modem available.
I could use a normal DSL modem but that would disable my “Hybrid” LTE connection

You could disable NAT and packet filtering on the pfSense and make it a routing only platform but again, that is way more work and is going to more or a headache when it comes to troubleshooting other issues. You would have to set up static routes yourself for the devices to communicate. I would buy a cheaper DSL modem-only unit (you don’t have to use the one provided by your ISP) if you’re really intent on using pfSense. If you need the LTE connection for failover then get a usb dongle and pop in the sim card to utilize pfSense’s WAN failover feature.

Now, I connected the freePBX system to both networks, one for internal traffic and one for external traffic
That works.