A PBX vendor like 3CX may tell you to disable SIP ALG on your router.
I’m running Tomato on my router, specifically Tomato Firmware 1.28.0000 MIPSR2-132 K26 Max. With the help of this thread, I checked and disabled SIP ALG.
Under Advanced > Conntrack/Netfilter, in the Tracking/NAT Helpers section, if SIP is checked, SIP ALG is enabled:
You can confirm this from Tools > System Commands by running lsmod. If you see nf_conntrack_sip or nf_nat_sip, SIP ALG is enabled:
And the _sip modules go away: