Network & Firewall Configuration
This page explains exactly what needs to be configured on your firewall so your SIP system can:
- Make outbound calls (SIP → PSTN)
- Receive inbound calls (PSTN → SIP)
1) Ports to Open
SIP signalling (call control)
Transport | Port | Protocol | When to use |
|---|---|---|---|
TLS (recommended) | 443 | TLS | Production use (secure, enterprise friendly) |
TCP | 5070 | TCP | Use only if TLS is not enabled |
Media (audio / RTP)
Type | Port Range | Protocol | Purpose |
|---|---|---|---|
RTP / SRTP | 10000–40000 | UDP | Voice media (audio) |
Important: If calls connect but audio is missing or one-way, this port range is usually blocked.
2) Exotel Connectivity Model
Exotel connectivity has two independent paths:
- Signaling – SIP INVITE / 100 Trying / 200 OK
- Media – RTP audio packets
Both must be allowed for calls to work correctly.
3) Signaling Endpoints (SIP Proxy)
A) Outbound calling (SIP → PSTN)
Your SIP system sends SIP requests to Exotel.
Use these FQDNs in your trunk / peer configuration:
Use case | Primary FQDN | Secondary FQDN | Notes |
|---|---|---|---|
Domestic India | edge.mum.in.exotel.com | edge.hyd.in.exotel.com | Configure both for failover |
Domestic India (single DNS) | edge.in.exotel.com | — | DNS resolution and retry required |
Domestic India (single DNS) | in.voip.exotel.com | | DNS resolution and retry required(Specifically used for SIP Auth) |
Failover note: Your SIP system should retry the secondary FQDN if the primary is unreachable.
B) Inbound calling (PSTN → SIP)
Exotel sends SIP INVITEs to your SIP server.
Allow inbound signaling from the following Exotel signaling source IPs:
Source IP | Data Center |
|---|---|
35.154.174.161 | AWS Mumbai |
98.130.5.99 | AWS Hyderabad |
129.154.231.198 | OCI(Legacy- Signaling IP) |
4) Media IPs (RTP Audio)
These IPs send and receive RTP audio during calls.
Media Pool
Region / POP | Media IPs | DC / Provider |
|---|---|---|
India | 3.6.59.115, 13.127.39.217, 43.205.221.135, 13.203.184.147, 13.203.182.84, 13.203.81.133, 3.7.34.113, 13.126.206.147, 35.154.177.121, 13.205.31.133, 35.154.118.78 40.192.25.80, 98.130.133.120, 16.112.157.119, 16.112.117.9, 18.61.59.229, 18.61.247.215 | AWS(Mum/Hyd) |
Legacy / Other Media Pools
Region / POP | Media IPs | DC / Provider |
|---|---|---|
West Bengal / TN / KA / Delhi / Gujarat / AP | 141.148.205.58, 144.24.101.99, 80.225.231.27, 140.245.21.212, 141.148.216.227 | OCI |
Karnataka | 14.194.10.247, 61.246.82.75, 141.148.205.58, 144.24.101.99, 80.225.231.27 | KA DC |
Mumbai DC | 14.142.38.122, 182.76.143.61 | MUM DC |
Madhya Pradesh DC | 121.242.97.185, 182.73.254.178 | MP DC |
Pune | 13.203.182.84, 13.203.81.133 | AWS MUM |
5) Firewall Rules (What to Allow)
A) Inbound calls (PSTN → SIP)
Allow inbound traffic to your SIP server:
Traffic | Source | Destination | Port / Protocol |
|---|---|---|---|
SIP signaling | Exotel signaling IPs | Your SIP server | 443/TLS or 5070/TCP |
RTP media | Exotel media IPs | Your RTP ports | 10000–40000/UDP |
B) Outbound calls (SIP → PSTN)
Allow outbound traffic from your SIP system:
Traffic | Source | Destination | Port / Protocol |
|---|---|---|---|
SIP signaling | Your SIP server | Exotel edge FQDNs | 443/TLS or 5070/TCP |
RTP media | Your RTP ports | Exotel media IPs | 10000–40000/UDP |
6) Important: How Inbound Firewalling Works
For inbound calls, source ports are dynamic and must not be fixed.
What you must configure
- Fixed destination port on your SIP server: 443 or 5070
- UDP media port range: 10000–40000
- Allow Exotel IPs as source
What you must NOT configure
- Do not restrict source ports
- Do not expect a single fixed port from Exotel
Required behavior (Inbound Signaling)
Item | Value |
|---|---|
Destination IP | Your SIP server |
Destination port | 443 or 5070 |
Source IP | Exotel signalling IPs |
Source port | ANY |
Protocol | TCP |
Example firewall rule (signaling):
ALLOW TCP
SRC IP: Exotel signaling IPs
SRC PORT: ANY
DST IP: Your SIP server
DST PORT: 443
Required behavior (Inbound Media)
Item | Value |
|---|---|
Protocol | UDP |
Destination ports | 10000–40000 |
Source IPs | Exotel media IPs |
Source ports | ANY |
Example firewall rule (media):
ALLOW UDP
SRC IP: Exotel media IPs
SRC PORT: ANY
DST IP: Your SIP server
DST PORT: 10000–40000
7) Which IP List Should You Use?
If you only do India domestic calling
Use:
- Signaling: edge.mum.in.exotel.com + edge.hyd.in.exotel.com (or edge.in.exotel.com)
- Media: India proposed media IP pool (Circle Specific)
If you are unsure
Allow:
- Exotel signaling IPs (for inbound)
- India proposed media pool
- Any additional country media pool you actively use
- Reachout to support for updated IPs