Whitelisting VoiceTel IP addresses.

Customer responsibility

VoiceTel provides the infrastructure IP addresses and subnets used for SIP signaling and media. The customer is responsible for configuring their firewall, PBX, SBC, NAT rules, and access-control lists correctly.

If a customer uses a managed firewall, hosted PBX, or third-party SBC, they should provide this list to the vendor responsible for that equipment.

Firewall requirements

Allow UDP traffic from one or more of the following VoiceTel infrastructure addresses and subnets. Customers should whitelist the ranges that match their selected VoiceTel routing, registration, media, and geographic configuration.

Cloud infrastructure

Colocation facilities

Recommended configuration steps

1. Identify the PBX, SBC, or firewall that receives SIP and RTP traffic from VoiceTel.
2. Open the firewall or access-control configuration for that device.
3. Add UDP allow rules for the VoiceTel infrastructure addresses and subnets used by the deployment.
4. Apply the rules to the interface or policy that handles SIP and RTP traffic.
5. Confirm that NAT, port-forwarding, and SIP helper behavior are configured correctly for the environment.
6. Save and apply the firewall changes.
7. Restart or reload the relevant firewall policy if required by the firewall vendor.
8. Place inbound and outbound test calls.
9. Confirm that calls connect and that audio works in both directions.

PBX and SBC access-control lists

Some PBXs and SBCs maintain their own access-control lists in addition to the network firewall. If the PBX or SBC has a SIP access list, trusted IP list, trunk ACL, or media ACL, add the VoiceTel infrastructure addresses there as well.

After adding the addresses, confirm that the ACL is applied to the active SIP profile, trunk, interface, or listener. Adding addresses to an unused ACL does not allow traffic.

Troubleshooting

If calls still fail after the firewall rules are added, check the following:

• The firewall rules allow UDP traffic.
• The rules are applied to the correct WAN interface or security zone.
• The PBX or SBC is not blocking the same traffic with its own ACL.
• NAT is forwarding traffic to the correct internal PBX or SBC.
• The customer's public IP address matches the IP address configured for any IP-authenticated VoiceTel service.
• The PBX or SBC has been restarted or reloaded if required.
• Test calls are using the expected VoiceTel route, registration domain, or geographic target.