ZEN FritzBox 7530AX in a DMZ on a Unifi Gateway

I need to move away from TalkTalk (Poor value for money) but also keep my landline number. I already have a Unifi based network and, having spoken to ZEN sales, they do not support VOIP over 3rd party gateways. I could in theory just stick the FB on the FTTP service and put my UDM Gateway on a LAN port on the WAN side and double NAT or potentially disable NAT on the UDM WAN side, but I'd much rather have my UDM as my primary gateway. Has anyone put their FB in a DMZ on another gateway effectively bypassing the firewall and allowing digital voice to carry on working as normal.

Edited by mrwrighty (Thu 03-Jul-25 14:12:46)

Port your landline number to the VoIP provider of your choice, Sipgate for example. Put the Sipgate settings into the Zen supplied FritzBox and Bob’s your uncle.

As a bonus the FritzBox is also a DECT base so you can get your calls over your current cordless phones. It also has a voice mail service and a load of other exciting features.

But I don’t know why you might want to use the Unifi…

Sipgate probably no longer the best example for newbies as basic/starter has been withdrawn for new sign ups, but other providers exist 😀

I'm a long-time Zen client; I want to see them live up to their heritage reputation of giving great support and give reliable basic help for VOIP that isn't tied exclusively to their router.

Zen does not support third-party SIP hardware, but they will give you the account details at your own risk - if you bring the hardware, you are responsible for configuring and supporting it. I have Zen Digital Voice working on Gigaset DECT equipment; I don't have a Zen router.

However, Zen's SIP service is a very stripped-down offering; it lacks network voicemail or any network divert functionality - Zen expects you to do everything on the router they supply. Zen don't have a STUN server, and they tell you to use a B2BUA to get around any NAT issues. Zen's Digital Voice is IPv4-only and is offered on a single-line-per-broadband-connection basis. SIP is NAT-hostile without STUN or similar.

Give a choice, I would use Andrews and Arnold for VoIP over Zen. A&A offers network voicemail and STUN, and supports IPv6 if you have suitable hardware (though I cannot find anyone that currently offers a European DECT base with IPv6 and PoE support). I am in the process of porting my second line from analogue to A&A. My primary line is with Zen Digital Voice, and Zen are claiming that the minimum contract period was reset on this line following our recent FTTP upgrade; I will dispute this minimum contract period and try to port the line out to A&A in the future, but Zen support is rather swamped at the moment with IPv4 address changes.

In reply to a post by David_W2:

SIP is NAT-hostile without STUN or similar.

Its interesting you say this, I have been using SIP (from one standalone provider) for around 8 years now across multiple ISPs via NAT, different ISP routers and even on O2 Mobile broadband via CGNAT and I have never yet had to configure the SIP for a STUN server. Appreciate I may have to in the future but not so far.

I've also had the same experience. I've never done anything to configure SIP beyond installing a SIP client app on two iPhones and entering the SIP account details in the app.

That was on both EE and Starlink, both with CGNAT. First with a pfSense router, now with a Unifi Cloud Gateway Ultra (it is possible I might have toggled on a SIP setting in pfSense, too long ago now that I can't remember).

This is with the AAISP service, I don't know if they are doing any extra magic to make it easy. Or maybe it is easy because we are only using iPhone apps rather than dedicated SIP enabled devices ?

I've always been told "SIP + NAT is a nightmare", ironically by Adrian from AAISP, so I assumed there would be hassle. But there has been zero problems over the last five years or so.

In reply to a post by andynormancx:

But there has been zero problems over the last five years or so.

I've experienced some of the NAT nightmare with old generic physical handsets about 10 years ago, and where the discovery of STUN really helped.

Things appear to have vastly moved on, even today AAISP document their STUN server, they don't seem to think it is needed; but perhaps because they assume everyone uses AAISP broadband and assigned a public IPv4 to ever device and uses firewalls.

My parents have a Grandstream ATA which just works behind NAT from a Virgin Media coax cable hub/router.

Routers may have a SIP ALG (application layer gateway) that tries to modify packets as they go through, but I assume TLS has stopped that sort of thing, and I always disable it on my ASUS.

In reply to a post by jchamier:

Routers may have a SIP ALG (application layer gateway) that tries to modify packets as they go through

I've always turned off SIP ALG, not sure but think I remember something about it being a security risk.