VoIP.info Guide

Firewall rules for VoIP

Define management, signaling and media access separately using actual deployment requirements.

Reviewed 2026-10-30Foundational

Start with traffic roles

The administration interface is not the SIP listener, and the SIP listener is not the RTP media range. Build an inventory of each required service, its source, destination, protocol and purpose. A generic instruction to open VoIP ports is too imprecise for a secure deployment.

Separate administration, signaling and media
An administration network accesses management interfaces. Allowed signaling peers and media peers use separate defined policies to reach the PBX. Arbitrary internet traffic is not a management path.

Example defensive architecture. Source restrictions, authentication, update policy and call permissions work together.

Use the actual configuration

Read the PBX's configured listeners and media range and the carrier's documented signaling and media networks. Defaults in another tutorial may not match your installation. Remote phones can have a different access design from a fixed-address carrier.

Diagnose with observations

Review relevant allow/deny counters and a bounded packet trace around one failed call. Confirm whether traffic reaches the boundary and whether the return path is valid. A lack of replies can also involve routing, DNS or a service that is not listening.

Keep management restricted

Do not expose administrative services just because phones need to register. Apply the smallest justified change and test the intended call flow. Remove temporary diagnostic rules afterward and retain the reason for each permanent rule in the operating record.

Verify negotiated UDPTL addresses before changing rules

The T38Fax diagnostic compares the re-INVITE SDP, NAT state, provider and customer port ranges, ALG behavior and packets in both directions.

Use current VoIPstudio destinations and the built-in test together

VoIPstudio’s current network guide separates signaling and media destinations, while the desktop client exposes a per-port WebRTC Test. The client diagnostic records the live documentation, test result and actual call flow rather than turning a static address list into permanent policy.

Constrain VoIP Much network changes to observed flows

VoIP Much documents server-port and source-blocking behavior, but not a universal customer RTP rule in the reviewed pages. The provider profile keeps local source ports, provider destination, registration responses, SDP and media flows distinct.

Use the selected VoIPline interconnect boundary

VoIPline supports public-internet and ordered private-IP delivery. The provider profile avoids inventing one universal customer firewall or RTP policy.

Use Webex Health Checker as bounded evidence

Cisco states that Health Checker cloud results show cloud status rather than the client connection to the cloud. The Webex App diagnostic pairs it with the assigned service and observed call.

Allow for Twilio edge movement without calling the path proven

Twilio advises allowing all published origination signaling and media ranges because traffic may move between edges. Pair firewall evidence with the Twilio diagnostic.

Correlate Plivo URI reachability with the observed packet source

Pair current Plivo address ranges, destination URI, firewall decision and packet arrival with the Plivo inbound diagnostic.

Correlate the selected Vonage URI with packet arrival

Pair URI destination, transport, current service-address evidence, firewall decision and observed packet source with the Vonage inbound diagnostic.

Keep Voxtelesys registration ACL and Customer IP distinct

A registration ACL controls which sources may register; a Customer IP is an inbound route destination. The Voxtelesys diagnostic checks each control without broadening both.

Scope Amazon Chime firewall evidence to the selected Region and IP family

Use the current AWS signaling and media ranges, actual connector Region, IPv4 or dual-stack behavior and DNS TTL. The diagnostic avoids broadening unrelated paths.

Anveo Direct signaling addresses are not an RTP inventory

Anveo Direct says media is sent directly by the underlying carrier. The diagnostic derives bounded signaling and media rules from current SDP and observed packets.

Do not diagnose CarrierX routing from firewall state alone

The CarrierX diagnostic pairs provider attempt and response with customer-edge packets, PBX handling, SDP and observed media.

Use current AVOXI data-center evidence

Pair the selected AVOXI data center and provider attempt with customer-edge packets before changing rules. The diagnostic keeps signaling, PBX handling and media distinct.

Correlate Easybell address or FQDN with packets

Pair the effective Easybell inbound target with customer-edge evidence before changing rules. The diagnostic keeps DNS, transport, PBX and media distinct.

Pair SIP.US portal state with packets

Retain identity mode, current gateway, DID assignment and the provider attempt, then pair them with bounded edge evidence. The diagnostic separates firewall, PBX and media results.

Flowroute Direct Media is not limited to signaling proxy ranges

The current provider page says RTP can arrive from any source IP to the PBX public media range. Use the focused diagnostic to scope destination ports and confirm observed traffic.

Pair Bulk Solutions provider attempts with the customer edge

The Bulk Solutions diagnostic separates current signaling sources, destination reachability, listener, PBX match and negotiated media ports.

Compare Yay.com published ranges with the actual call boundary

The Yay.com diagnostic joins dated source guidance, destination resolution, edge receipt, signaling response and negotiated media.

Simwood address lists are service- and date-scoped

The Simwood guide distinguishes the current Partner and Direct page from the older Asterisk 16 sample and requires current Hosted policy.

Sinch address ranges are regional and date-scoped

The Sinch guide treats the current SIP and RTP tables as change-controlled inputs rather than permanent copied facts.

Treat dialplan HTTP as explicit egress

The Asterisk CURL guide requires an approved destination and bounded outbound policy while keeping DNS, connect, TLS, HTTP and body evidence separate.

Scope SIPTRUNK gateway rules and direct-media policy separately

The SIPTRUNK guide preserves signaling allowlists while treating varied RTP sources as a local security-design decision.

Prove where Blink registration traffic stops

The Blink registration diagnostic separates host policy, network policy, registrar silence and an explicit SIP response.

Allow the evidenced Commio path without inventing success

The Commio provider guide treats current signaling evidence, negotiated SDP and local stateful policy separately from broad provider media guidance.

Do not use 8x8 endpoint port tables as a trunk rule set

The 8x8 X Series diagnostic applies only current SOW peers, transport and media evidence.

Do not turn Nextiva phone guidance into a trunk rule set

The Nextiva diagnostic verifies account domain, resolved targets, transport and media instead of copying every endpoint port.

Do not convert Intermedia multi-service ports into one trunk policy

The Intermedia provider guide requires the current trunk peers, transport, certificate and media profile before changing firewall scope.

Time the Infobip connection attempt before widening policy

The Infobip route diagnostic compares OPTIONS state, socket timing, edge receipt and SIP response instead of treating every delay as a blocked port.

Retain the selected IntelePeer signaling address

The IntelePeer route diagnostic compares the selected trunk and edge packet evidence instead of widening policy for every listed route.

Scope BCM One policy to the assigned service evidence

The BCM One route diagnostic compares the assigned proxy or Contact with packet arrival instead of opening policy for remembered legacy hostnames.

Scope Cox policy to the assigned E-SBC handoff

The Cox inbound diagnostic uses the current worksheet and observed source instead of copying legacy lab addresses.

Scope Comcast policy to the current handoff

The Comcast provider guide requires the implementation record and observed peers rather than an inferred generic source list.

Scope Lumen edge policy to the exact service handoff

The Lumen provider guide requires the account implementation record and observed peers rather than a generic source list inferred from product labels.

Scope AT&T edge policy to the ordered handoff

The AT&T provider guide requires the implementation record and observed peers instead of a generic policy inferred from ADI, AVPN or SIP labels.

Use the Verizon technical letter for edge policy

The Verizon guide binds signaling and media addresses and ports to the final implementation record rather than a generic SIP template.

Match Bell provider reporting to the customer edge

The Bell diagnostic treats a provider report as correlation evidence until an authorized edge trace confirms receipt.

Match Rogers provider evidence to the customer edge

The Rogers diagnostic treats CDR and provider state as correlation until an authorized edge trace confirms receipt.

Keep ThinkTel proxy families and bindings explicit

The ThinkTel guide avoids mixing current Perimeta, legacy and OCS signaling or media requirements.

Treat an Iristel portal IP as configuration evidence

The Iristel diagnostic requires edge traffic before calling a configured connectivity IP active.

Separate TELUS routability from delivery

The TELUS diagnostic treats required-IP reachability as a prerequisite, not proof of provider selection or INVITE delivery.

Separate SaskTel access suitability from call delivery

The SaskTel guide treats the assessed customer network and required bandwidth as prerequisites, not proof of provider selection or INVITE delivery.

Keep Cogeco access and eSBC evidence separate

The Cogeco diagnostic treats interface reachability, eSBC receipt and PBX delivery as distinct observations.

Do not reuse Flowroute signaling ranges as a media allowlist

The Flowroute guide applies current PoP ranges to signaling while preserving Direct Media from potentially any source IP to the configured public RTP range.

Scope AireSpring peers to the accepted implementation

The AireSpring diagnostic uses the assigned peer set and observed transaction instead of a guessed universal allowlist.

Prove the OnSIP transaction before widening firewall rules

The OnSIP diagnostic correlates registration, provider attempt, edge receipt and PBX identification.

Allow the current DIDforSale gateway set narrowly

The DIDforSale diagnostic correlates each provider source with edge receipt before any scoped rule change.

Allow current Zadarma sources narrowly and verify the actual packet

The Zadarma diagnostic separates provider publication, edge acceptance and PBX matching.

Reconcile Voxbeam published ingress addresses with actual packets

The Voxbeam diagnostic requires current provider publication, narrow policy and edge evidence.

Bind GoTrunk rules to current endpoint and observed traffic

The GoTrunk diagnostic proves POP, address, direction and packets before changing a firewall.

Scope DIDWW rules to current signaling and RTP evidence

The DIDWW guide uses current provider addresses and observed traffic rather than a permanently broad allowlist.

Separate Exotel signaling and media rules

The Exotel guide scopes TLS 443 or TCP 5070 signaling and UDP 10000–40000 media to current first-party endpoints and traces.

Use Voximplant packet and event evidence together

The Voximplant guide does not treat an allowlist, Connected event or bridge request as two-way media proof.

Use Commio signaling and observed SDP as separate firewall evidence

The Commio diagnostic distinguishes SIP proxy addresses from direct carrier media.

Build LES.NET rules from the observed handoff

The LES.NET diagnostic requires signaling, SDP and bidirectional packet evidence before changing firewall policy.

Build Wavix rules from the current handoff and packets

The Wavix diagnostic requires the actual regional proxy, transport, SDP and bidirectional packet evidence.

Limit a Jitsi Desktop firewall exception to the proven flow

An operating-system prompt does not prove safe scope or inbound reachability. Use the Jitsi Desktop diagnostic to identify the exact blocked signaling or media path.

Scope phone time rules to the observed flow

The wrong-time diagnostic requires the effective server and actual exchange before changing firewall policy.

Scope Allstream rules to current SBC evidence

The Allstream guide uses the current provider-issued SBC ranges and selected signaling and media profile rather than exposing the PBX broadly from a generic port table.

Scope Cloudli rules to current peer evidence

The Cloudli guide treats firewall and port documentation as a starting boundary, not permission to expose a PBX or reuse old babyTEL infrastructure.

Scope Orange flows to the current project record

The Orange Business Talk diagnostic rejects broad rules copied from historical guides and correlates the exact signaling and media tuples.

Scope Vodafone rules to current Evolved evidence

The Vodafone Evolved Voice diagnostic rejects broad rules copied from Hybrid, GSIP or storm records and follows exact tuples.

Respect the Swisscom access and firewall boundary

The Swisscom Enterprise SIP diagnostic scopes rules to the actual variant, service access point, SBC and PBX rather than Enterprise Connect examples.

Respect the Sunrise package and firewall boundary

The Sunrise Business Voice SIP diagnostic scopes rules to the ordered package, actual access, peer and PBX.

Scope rules to the Proximus demarcation

The Proximus Business Trunking diagnostic follows the ordered access, CPE, SBC, PBX and media tuples.

Scope Crazytel rules to one authentication path

The Crazytel SIP trunk diagnostic follows public-IP trust or registration plus signaling and both media directions.

Scope MaxoTel allowlisting to observed and current sources

The MaxoTel SIP trunk diagnostic avoids turning historical 3CX addresses into an evergreen unrestricted firewall range.

Scope Aussie Broadband voice rules to the supplied model

The Aussie Broadband SIP trunk diagnostic establishes registration, source trust, managed equipment and observed traffic before changing firewall policy.

Prove the selected Wave service path before opening ports

The Grandstream Wave diagnostic distinguishes local UCM, RemoteConnect and browser paths before any firewall change.

Apply the RingCentral table for the endpoint actually deployed

The RingCentral App guide separates API, WSS, push, update and media rows instead of treating one open HTTPS path as end-to-end proof.

Treat IAX2 bind, ACL and observed traffic as separate evidence

The IAX2 AMI diagnostic avoids a blanket firewall or ACL bypass.

Scope Symbio rules to the delivered handoff

The Symbio Enterprise SIP trunk diagnostic proves targets, transport, source trust, certificate and observed traffic before changing policy.

Use the current Telstra design at the demarcation

The Telstra SIP Connect diagnostic proves access, CPE, targets and observed traffic before changing policy.

Use the Optus service-delivery point

The Optus Evolve Voice diagnostic proves access, router responsibility, handoff and observed traffic before policy changes.

Start at the One NZ demarcation

The One NZ SIP diagnostic proves the ONT, supplied router or emulator, point of connection and observed traffic before policy changes.

Start at the 2degrees handoff

The 2degrees SIP diagnostic proves both sides of the ordered handoff before firewall or SIP ALG changes.

Start at the Vocus service interface

The Vocus SIP Voice diagnostic proves both sides of the ordered interface before firewall or SIP ALG changes.

Use the issued Superloop edge contract

The Superloop diagnostic verifies both sides of the customer edge before broad firewall changes.

Apply only the current Zoom Phone rows for the selected app and region

The Zoom Workplace diagnostic separates website reachability, sign-in, Phone service connection, call setup and media instead of opening a broad range first.

Start with the exact Enreach product and profile

The Enreach diagnostic establishes access, transport, source trust and whitelisting before firewall changes.

Apply Nextiva network guidance to the exact client path

The NextivaONE diagnostic separates website access, sign-in, SIP service, call setup and RTP rather than opening a broad range first.

Apply network evidence to one Teams client and call

The Teams Phone diagnostic separates connectivity, signaling, packet directions, decoding and audibility.

Apply Dialpad network evidence to one client and call

The Dialpad app diagnostic separates DNS, route, VPN, firewall, signaling, packet directions, decoding and audibility.

Use account-specific MetTel network values

The MetTel SIP trunk diagnostic avoids inventing registrar, source ranges, transports or rules from product copy.

Use account-specific NUSO peers and rules

The NUSO diagnostic avoids inventing registrar, peer, port, transport or allowlist values from product copy.

Use the account-specific Telesystem point of presence

The Telesystem diagnostic avoids copying peers, ports or rules from another tenant or site.

Load TPx network values from the site implementation record

The TPx diagnostic avoids copying addresses, ports or firewall rules from another deployment.

Load Lingo network values from the site record

The Lingo diagnostic avoids copying addresses, ports or firewall rules from another deployment.

Load Voyant network values from the account record

The Voyant diagnostic avoids copying addresses, ports or rules from another deployment.

Apply 8x8 utility results to one host and path

The 8x8 Work diagnostic treats port, NAT, ALG, media and path checks as a bounded snapshot rather than proof of one call.

Apply VBC network records to one product and observation

The VBC diagnostic separates published policy, resolved targets, observed flows and call evidence.

Load Windstream network values from the service record

The Windstream diagnostic avoids copying addresses, ports, certificates or media ranges from another deployment.

Apply Aircall requirements to observed traffic, not assumptions

The Aircall diagnostic separates published requirements, resolved targets, diagnostic completeness and observed flows.

Load Granite network values from the service record

The Granite diagnostic avoids copying addresses, ports, certificates or media ranges from another order.

Load FirstLight network values from the handoff

The FirstLight diagnostic avoids copying addresses, ports, certificates or media ranges from another order.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.