What is an Application Layer Gateway (ALG)?

Sometimes called an application-level gateway, an ALG understands the protocols behind services such as SIP, FTP and RTSP, so it can open and close firewall ports dynamically, rewrite embedded IP addresses for NAT traversal and block traffic that does not conform to the protocol.

ALGs are commonly built into firewalls, routers and load balancers, where they act as a protocol-aware intermediary between clients and the servers delivering an application. The Progress^® Kemp^® LoadMaster^® solution applies this same application-layer intelligence to load balancing and application delivery.

How Does an Application Layer Gateway Work?

Standard firewalls filter traffic using IP addresses and port numbers, but many application protocols do not behave predictably at that level.

Protocols such as SIP and FTP negotiate secondary connections on dynamic ports and embed IP address information inside the message payload, which breaks when traffic passes through Network Address Translation (NAT). An ALG solves this by reading the application data itself.

A typical ALG workflow looks like this:

1. 1

   Traffic interception: The ALG sits in the traffic path, usually within a firewall, router or gateway device, and identifies sessions belonging to a supported protocol.

2. 2

   Deep packet inspection: Because the ALG understands the data format of the application, it parses the payload, not just the packet headers.

3. 3

   Dynamic port management: When the application negotiates a new data channel, such as an FTP data transfer or an RTP media stream in a VoIP call, the ALG opens the required firewall pinhole and closes it when the session ends.

4. 4

   NAT rewriting: The ALG rewrites private IP addresses embedded in the payload so sessions survive NAT translation and connect to remote servers on behalf of internal clients.

5. 5

   Protocol validation: Traffic that violates the expected protocol behavior is flagged or rejected, protecting the servers behind the gateway from malformed or malicious requests.

Why Is an Application Layer Gateway Important?

Without an ALG, administrators face an uncomfortable choice: leave wide port ranges open so applications such as VoIP and FTP function, or lock the firewall down and break those applications. An ALG removes that trade-off.

From a security standpoint, an ALG shrinks the attack surface by opening ports only for the duration of a validated session. From an availability standpoint, it keeps latency-sensitive services such as voice and video working reliably across NAT boundaries. From an operational standpoint, it reduces the manual firewall rule maintenance that dynamic-port applications would otherwise require.

For infrastructure teams managing real-time communications, file transfer or streaming services, ALG functionality is often the difference between an application that works and one that generates support tickets.

Key Benefits of an Application Layer Gateway

• Deep protocol awareness: Inspects application payloads, not just headers, catching threats and errors that packet filters miss.
• NAT traversal for complex protocols: Keeps SIP, FTP, RTSP and similar protocols functional across NAT without manual workarounds such as static port forwarding.
• Reduced attack surface: Opens firewall ports dynamically per session instead of leaving broad port ranges permanently exposed.
• Server protection: Validates traffic before it reaches application servers, rejecting suspicious or malformed requests in transit.
• Lower administrative overhead: Automates the connection handling that would otherwise require ongoing firewall rule changes.

Common Use Cases for Application Layer Gateways

• VoIP and unified communications (SIP ALG): The most common ALG use case. A SIP application layer gateway rewrites SIP headers and manages RTP media ports so calls establish correctly through NAT. Poorly implemented SIP ALGs on consumer routers are a frequent cause of dropped calls and one-way audio, which is why some VoIP providers recommend disabling router-based SIP ALG in favor of a properly configured session border controller or load balancer.
• FTP file transfer: FTP negotiates a separate data connection on a dynamic port. An FTP ALG tracks the control channel and opens the data port automatically.
• Streaming media (RTSP ALG): Real-time streaming protocols negotiate media channels that an ALG can track and permit on demand.
• Instant messaging and peer-to-peer file transfer: ALGs manage the ad hoc connections these services create.
• Windows environments (Application Layer Gateway Service): On Windows, the Application Layer Gateway Service (alg.exe) is a legacy operating system component that provided plugin support for Internet Connection Sharing and Windows Firewall. It is a normal system process, not malware, though modern systems rarely depend on it.

How ALGs Relate to Load Balancing and Kemp LoadMaster

Application-layer intelligence is not limited to firewalls.

A load balancer operating at Layer 7 applies the same protocol awareness to application delivery.

The Kemp LoadMaster solution applies Layer 7 intelligence to inspect application traffic and make intelligent routing decisions, supports SIP-aware load balancing for VoIP and unified communications environments, and helps protect published services through its integrated Web Application Firewall (WAF).

For teams evaluating ALG capabilities as part of a broader application delivery strategy, LoadMaster combines Layer 7 inspection, traffic management and security in a single platform.

Application Layer Gateway vs. Related Technologies

FAQs