--- title: Network & Firewall Configuration slug: dynamic-sip-trunking/network-and-firewall-configuration docTags: createdAt: 2026-01-24T09:07:37.914Z --- This page explains exactly what needs to be configured on your firewall so your SIP system can: - Make outbound calls (SIP → PSTN) - Receive inbound calls (PSTN → SIP) ## 1) Ports to Open ### SIP signalling (call control) | **Transport** | **Port** | **Protocol** | **When to use** | | ----------------- | -------- | ------------ | -------------------------------------------- | | TLS (recommended) | 443 | TLS | Production use (secure, enterprise friendly) | | TCP | 5070 | TCP | Use only if TLS is not enabled | ### Media (audio / RTP) | **Type** | **Port Range** | **Protocol** | **Purpose** | | ---------- | -------------- | ------------ | ------------------- | | RTP / SRTP | 10000–40000 | UDP | Voice media (audio) | **Important:** If calls connect but audio is missing or one-way, this port range is usually blocked. ## 2) Exotel Connectivity Model Exotel connectivity has **two independent paths**: 1. **Signaling** – SIP INVITE / 100 Trying / 200 OK 2. **Media** – RTP audio packets Both must be allowed for calls to work correctly. ## 3) Signaling Endpoints (SIP Proxy) ### A) Outbound calling (SIP → PSTN) Your SIP system sends SIP requests to Exotel. Use these FQDNs in your trunk / peer configuration: | **Use case** | **Primary FQDN** | **Secondary FQDN** | **Notes** | | --------------------------- | ---------------------- | ---------------------- | ----------------------------------------------------------------- | | Domestic India | edge.mum.in.exotel.com | edge.hyd.in.exotel.com | Configure both for failover | | Domestic India (single DNS) | edge.in.exotel.com | — | DNS resolution and retry required | | Domestic India (single DNS) | in.voip.exotel.com | | DNS resolution and retry required(Specifically used for SIP Auth) | **Failover note:** Your SIP system should retry the secondary FQDN if the primary is unreachable. ### B) Inbound calling (PSTN → SIP) Exotel sends SIP INVITEs to your SIP server. Allow inbound signaling from the following **Exotel signaling source IPs**: | **Source IP** | **Data Center** | | --------------- | ------------------------- | | 35.154.174.161 | AWS Mumbai | | 98.130.5.99 | AWS Hyderabad | | 129.154.231.198 | OCI(Legacy- Signaling IP) | ## 4) Media IPs (RTP Audio) These IPs send and receive RTP audio during calls. Media Pool | **Region / POP** | **Media IPs** | **DC / Provider** | | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | | India | 3.6.59.115, 13.127.39.217, 43.205.221.135, 13.203.184.147, 13.203.182.84, 13.203.81.133, 3.7.34.113, 13.126.206.147, 35.154.177.121, 13.205.31.133, 35.154.118.78

40.192.25.80, 98.130.133.120, 16.112.157.119, 16.112.117.9, 18.61.59.229, 18.61.247.215 | AWS(Mum/Hyd) | ### Legacy / Other Media Pools | **Region / POP** | **Media IPs** | **DC / Provider** | | -------------------------------------------- | ----------------------------------------------------------------------------- | ----------------- | | West Bengal / TN / KA / Delhi / Gujarat / AP | 141.148.205.58, 144.24.101.99, 80.225.231.27, 140.245.21.212, 141.148.216.227 | OCI | | Karnataka | 14.194.10.247, 61.246.82.75, 141.148.205.58, 144.24.101.99, 80.225.231.27 | KA DC | | Mumbai DC | 14.142.38.122, 182.76.143.61 | MUM DC | | Madhya Pradesh DC | 121.242.97.185, 182.73.254.178 | MP DC | | Pune | 13.203.182.84, 13.203.81.133 | AWS MUM | ## 5) Firewall Rules (What to Allow) ### A) Inbound calls (PSTN → SIP) Allow inbound traffic **to your SIP server**: | **Traffic** | **Source** | **Destination** | **Port / Protocol** | | ------------- | -------------------- | --------------- | ------------------- | | SIP signaling | Exotel signaling IPs | Your SIP server | 443/TLS or 5070/TCP | | RTP media | Exotel media IPs | Your RTP ports | 10000–40000/UDP | ### B) Outbound calls (SIP → PSTN) Allow outbound traffic **from your SIP system**: | **Traffic** | **Source** | **Destination** | **Port / Protocol** | | ------------- | --------------- | ----------------- | ------------------- | | SIP signaling | Your SIP server | Exotel edge FQDNs | 443/TLS or 5070/TCP | | RTP media | Your RTP ports | Exotel media IPs | 10000–40000/UDP | ## 6) Important: How Inbound Firewalling Works For inbound calls, **source ports are dynamic** and **must not be fixed**. ### What you must configure - Fixed destination port on your SIP server: 443 or 5070 - UDP media port range: 10000–40000 - Allow Exotel IPs as source ### What you must NOT configure - Do **not** restrict source ports - Do **not** expect a single fixed port from Exotel ### Required behavior (Inbound Signaling) | **Item** | **Value** | | ---------------- | --------------------- | | Destination IP | Your SIP server | | Destination port | 443 or 5070 | | Source IP | Exotel signalling IPs | | Source port | ANY | | Protocol | TCP | **Example firewall rule (signaling):** ALLOW TCP SRC IP: Exotel signaling IPs SRC PORT: ANY DST IP: Your SIP server DST PORT: 443 ### Required behavior (Inbound Media) | **Item** | **Value** | | ----------------- | ---------------- | | Protocol | UDP | | Destination ports | 10000–40000 | | Source IPs | Exotel media IPs | | Source ports | ANY | **Example firewall rule (media):** ALLOW UDP SRC IP: Exotel media IPs SRC PORT: ANY DST IP: Your SIP server DST PORT: 10000–40000 ## 7) Which IP List Should You Use? ### If you only do India domestic calling Use: - **Signaling:** edge.mum.in.exotel.com + edge.hyd.in.exotel.com (or edge.in.exotel.com) - **Media:** India proposed media IP pool (Circle Specific) ### If you are unsure Allow: - Exotel signaling IPs (for inbound) - India proposed media pool - Any additional country media pool you actively use - Reachout to support for updated IPs