Firewall configuration

By not restricting your firewall to a specific list of IPs, you ensure that your telephony remains active even when we:

• Deploy security patches.
• Spin up new capacity during high-traffic periods.
• Route traffic to a failover node during a regional outage.

Security Advice

If your IT policy requires some form of restriction, we recommend filtering by traffic type (UDP) and Service Quality (QoS) rather than specific destination IPs. This allows your voice traffic to remain fluid and prioritised without the risk of a total service blackout during a system update.

To prevent dropped calls or "one-way audio" issues, we recommend the following approach for your office router or firewall:

1. Connection Essentials

Following these three rules resolves 90% of all VoIP issues in South Africa.

• Hostnames over IPs: Always use hostnames for registration. Our platform supports SRV records, allowing your system to automatically find the best available node. Do not hard-code IP addresses, as these may change without notice.
• Disable SIP ALG: This function in your router/firewall must be switched OFF. It interferes with SIP headers and causes dropped calls.
• Keep-Alive: Enable "Keep-Alive" on all handsets or PBX systems. We recommend an interval of 10 to 30 seconds to maintain an open path through your firewall.

2. Network & Firewall Strategy

3. Bandwidth & Audio Quality

To guarantee "crystal clear" audio, ensure your data line is dimensioned correctly.

• Capacity: Budget 0.1 Mbps per concurrent call (up/down) for high-quality audio.
• Preferred Codec: G.711 A-law (PCMA) with a packet size of 20ms.
• Low Bandwidth: If bandwidth is limited, G.729a may be used (0.033 Mbps per call).
• DTMF: Support is based on RFC2833.
• MTU: Ensure the MTU (Maximum Transmission Unit) is correctly set for your specific data line to avoid packet fragmentation.

4. Hardware Specifics

For Hosted PBX Users

• Local Ports: Use a unique local listen port for each SIP device (e.g., 5061, 5062, etc.) to avoid NAT conflicts.
• Recommended Routers: For the best experience, we recommend business-grade hardware such as MikroTik (Router Board) or Cisco 800/1800 series.

For Your Own IP-PBX (On-site)

• NAT 1:1: If your PBX must be behind NAT, use a 1:1 NAT with a dedicated public IP address. Avoid dynamic NAT.
• Authentication: Set your PBX to authenticate/match on account_id, not on hostname. Incoming traffic may originate from multiple hosts within our cluster.
• Caller ID: By default, DDI is set to the full international format (e.g. +27210123456). Ensure your PBX is configured to handle the '+' prefix.