How do I need to configure my firewall for easybell VoIP and SIP trunking?

It is important that the ports and protocols suitable for your product are enabled in the firewall.

For unencrypted telephony, the UDP protocol is always used; the ports can be found in the following table:

Please note that the Cloud Telefonanlage also requires access to the domain ctad.easybell.de. If you want to use the automatic configuration of devices, please also ensure that port 443 is enabled for https.

In most cases, the enabled SIP port and the registrar must be changed in order to encrypt telephony. The protocol is then TLS, the ports can be found in the following table.

Please note that connections with DNS-SRV and the VoIP to go app cannot be encrypted yet.

In 95% of use cases, it makes more sense to use NAT as an additional security feature than to adjust the firewall configuration and risk blocking any necessary connections in the process.

NAT stands for "Network Address Translation" and is a function integrated in most routers. For connections to the Internet, a different public address is communicated instead of the local network address (LAN). Replies are accepted under this public "identity" and forwarded to the local network device. The router stores the assignment of local address to WAN address in the so-called NAT table.

The special feature is that the data is only forwarded to the device if an outgoing connection had previously been established. This mode of operation usually complements IP telephony perfectly. This is because with Voice over IP, a connection is always first established from the local network to the Internet, either when a device is registered or when an outgoing call is made. With NAT, the router will then provide a WAN address and then forward responses from this public (WAN) to the local address (LAN). The exchange of data packets is therefore ensured in both directions.

At the same time, all unauthorized access from outside is blocked - NAT thus acts like a rudimentary firewall.

The more you restrict the shares in the firewall, the more secure the infrastructure behind it. However, proceed with caution to prevent desired connections from being blocked.

• Always use the desired server address (FQDN), e.g. voip.easybell.de for shares. The IP addresses behind this can change at any time.
• For outgoing connections, you can restrict the shares to the internal IPs of the PBX/phones.
• For incoming connections, you can restrict the shares to the registrar used (e.g. sip.easybell.de). However, you must then ensure that the telephones in the local network are assigned fixed IP addresses, which is not the case with a default setting to DHCP.

Hardware and firewalls can differ greatly. Therefore, be sure to also pay attention to additional instructions from the manufacturers.

Regardless of the installation variant, it is always advantageous to prioritize voice-over-IP data traffic in the network. Many routers and firewall solutions offer the QoS (Quality of Service) function for this purpose, which should be activated if possible and configured for SIP and RTP data.

The following services can have a negative impact on IP telephony and should therefore be disabled as far as possible:

• SIP-ALG (SIP application layer gateway)
• IGMP snooping (Internet Group Management Protocol monitoring)
• ICMP (Internet Control Message Protocol)

In more complex installations, additional network hardware is often used to extend the range or to connect more devices. However, this also makes it more difficult to identify (interference) influences. If, for example, a subnet is managed by an active switch, the services mentioned above may be activated there unnoticed and affect IP telephony in the network.

The use of these techniques is of course possible, but requires advanced knowledge of network technology and configuration of internal routings. If in doubt, the above services should therefore be deactivated on all devices or telephones should not be connected via these subnets.

In addition, you will find detailed explanations of the individual application areas here:

Single telephone number with one device

Telephone system with call number block/blocks

Call number blocks without telephone system

Cloud Telefonanlage

VoIP to go app

The easiest variant is the one for home and small installations. If at home or in the office only a single phone is registered to a single phone number, only a few points need to be taken into account.

SIP registration is done by default on most IP phones using SIP port 5060 with UDP or TCP protocol, alternatively you can set your device to SIP port 5064. A port range of 20000-50000 (UDP or TCP) is used here for audio transmission.

Furthermore, you only have to make sure that the services SIP-ALG and IGMP snooping are deactivated for these installations, which most routers for home and small installations come with out of the box.

If you want to be on the safe side and your firewall allows it, you can limit the port shares to the local IP address of the phone and the hostname of our registrar (sip.easybell.de). To do this, the phone must be assigned a fixed IP address in the local network. By default, the phones are configured to DHCP, where the IP address in the local network changes regularly. In this case, IP restriction naturally leads to problems.

In the business sector, telephone systems with one or more SIP trunks (connection with number block) are often used.

SIP registration usually takes place by default via SIP port 5060 with the UDP or TCP protocol, alternatively you can set your system to port 5064. A port range of 20000-50000 (UDP or TCP) is used here for audio transmission.

It should only be noted that many system manufacturers still require specific settings for the function and accessibility of the telephone system. These can be found in the documentation of your selected PBX.

Furthermore, it is often the case that in larger, more complex networks, of course, more hardware is used, which influences the infrastructure with active elements. For example, it is not uncommon for active switches and/or additional routers that manage subnets to provide the services SIP-ALG, IGMP snooping, ICMP, etc. or to have them activated by default. These are factors that can influence or even disrupt the functions of IP telephony in the network. Care must therefore be taken here to ensure that these additional devices also have the aforementioned services and functions disabled.

It is also important to note that complex network constructions with subnets and/or VLANs can impair the functionalities. The use of these techniques is of course possible, but requires advanced knowledge of network technology and configuration of internal routings.

If you use a redundant Internet connection or DNS-SRV, please register your devices on the voip.easybell.de registrar and adjust the firewall rules accordingly to avoid registration problems or audio problems.

The Cloud Telefonanlage from easybell offers numerous business functions such as call pickup, busy lamp fields, speed dialing, etc. If you can do without these, easybell gives you the option of registering multiple devices on a SIP trunk without a telephone system. To do this, you first need to set up virtual extensions in the customer portal in order to generate separate registration data for each individual device.

The necessary settings in the firewall are identical to those for individual phone numbers.

If you use a Cloud Telefonanlage, your devices must be able to connect to our infrastructure. The Cloud Telefonanlage has a separate SIP registrar: pbx.easybell.de. To ensure the functionality of the web interface and a smooth process, the domain ctad.easybell.de must also be released.

The Cloud Telefonanlage uses SIP port 5060. In the Cloud Telefonanlage, audio transmission takes place in the port range 10000 - 50000UDP or TCP is used as the protocol.

When using the easybell Cloud Telefonanlage, care should also be taken to ensure that no additional services such as SIP ALG etc. are active in the local network(s) in which the telephones are registered.

For automatic provisioning of the phones in the Cloud Telefonanlage, only port 443 for HTTPs is required. This is usually already enabled in each router.

Whether in the Cloud Telefonanlage or with a SIP Trunk, with a single phone number or a virtual extension, with the free Easybell app you can turn any smartphone with iOS or Android into an IP phone.

For the Easybell app, ports 4998, 5000, 4210 and 4280 (TCP in each case) must be enabled for SIP traffic. In addition, ports 4998, 10000-20000 (UDP) for the application's RTP packets. The hosts to which the application logs on are webrtc2.easybell.de and webrtc.easybell.de .

Of course, the settings are only necessary if the Easybell app is used in the respective local WLAN. Use via the phone's mobile data does not require any adjustments to the local network. With more complex firewall solutions, it should be noted that there are often separate rules for the LAN and WLAN interfaces.

Encryption of telephony via the Easybell app is not yet technically possible.