diff --git a/resources/templates/conf/sip_profiles/external-ipv6.xml.noload b/resources/templates/conf/sip_profiles/external-ipv6.xml.noload
index 0f4e69774d..14b48cf5bb 100644
--- a/resources/templates/conf/sip_profiles/external-ipv6.xml.noload
+++ b/resources/templates/conf/sip_profiles/external-ipv6.xml.noload
@@ -54,6 +54,11 @@
 		<param name="inbound-codec-negotiation" value="generous"/>
 		<param name="nonce-ttl" value="60"/>
 		<param name="auth-calls" value="true"/>
+		<!-- on authed calls, authenticate *all* the packets not just invite -->
+		<param name="auth-all-packets" value="false"/>
+		<param name="apply-inbound-acl" value="providers"/>
+		<param name="apply-register-acl" value="providers" enabled="false"/>
+		<param name="dtmf-type" value="rfc2833"/>
 		<param name="auth-subscriptions" value="true"/>
 		<param name="inbound-late-negotiation" value="true"/>
 		<param name="inbound-zrtp-passthru" value="true"/> <!-- (also enables late negotiation) -->
@@ -107,8 +112,6 @@
 		<!--If you have ODBC support and a working dsn you can use it instead of SQLite-->
 		<param name="odbc-dsn" value="$${dsn}" enabled="false"/>
 
-		<param name="dtmf-type" value="rfc2833"/>
-
 		<!-- save session in the database for option to restore SIP UDP calls -->
 		<param name="track-calls" value="false"/>
 	</settings>