Calltok Basic Recommendations for Any Router Used in a VoIP Implementation
This summarizes firewall configuration for VoIP Implementation with Calltok
- Disable ‘SIP ALG’ (Application Layer Gateway) functions.
- Disable ‘DMZ’ and ‘Port Forwarding’ options (Unless using advanced pre-tested configurations)
- Disable SPI (Stateful Packet Inspection) settings.
- Set UDP Port Timeout values to 120 seconds.
- Ensure the Router’s WAN is assigned a public IP (Static or Dynamic).
Note: Most DSL/Cable Modems are configured as routers not bridges. This means your router will be assigned a private or NAT’ed IP resulting in double NAT which almost always causes one way audio and or failed inbound calls. Always double check that your Modem is configured as a Bridge and confirm it yourself.
Firewall Support
Please note that firewalls are not officially supported in VoIP implementations, as such limited assistance is available for these deployments.
In most cases, VoIP services behind a firewall result in several calling issues including but not limited to; failed calls, dropped calls, one way or no audio and more.
VoIP Firewall Best Practices.
- If a firewall is required try to have the VoIP CPE outside of its control.
- If the VoIP CPE is on a Public IP you will need to manually engage the RTP Proxy within the Admin portal to limit the possible IP’s used for “whitelist’ or “allowed’ traffic settings.
- IP’s and Ports used when the RTP Proxy is engaged:
- SIP Signaling: MIA -192.92.8.0/24 DFW - 64.52.82.0/24 SJC - 64.52.83.0/24 UDP/TCP
- SIP Ports: 5060 Inbound Calls, 5061 Outbound Calls
- RTP/Media IP’s: 192.92.8.0/24 and 64.52.82.0/24
- RTP/Media Ports: UDP, Typically 16384 and higher but depends on the VoIP CPE.
VoIP CPE Support
Most VoIP devices will perform properly with basic factory default settings. In addition, if you’re using 3NG’s auto provisioning service any non-factory settings that need to be changed will be automatically adjusted for you.
List of basic settings recommended for all VoIP CPE (IP Phone or IP PBX).
- Do not use any STUN or ICE functions. While there may be valid reasons to do so they are typically not required unless you have a concrete reason and know exactly how to with a pre-tested and pre-approved configuration.
- Enable any available SIP “Keep Alive’ features with a timeout of 30 seconds.