---
title: Firewall Configuration for WebRTC Calls (End-User Networks)
description: Learn which firewall ports, IPs, and domains must be whitelisted for end-users to make WebRTC voice calls. This guide covers signaling, STUN/TURN, media traffic, and SIP requirements for corporate networks.
---
[ ](https://kb.trueengage.com/?hsLang=en)
[Home](https://trueengage.com/?hsLang=en) [Docs](https://kb.trueengage.com/genesys-cloud?hsLang=en) [Pricing](https://trueengage.com/genesys-cloud/pricing?hsLang=en)
[Sign In](https://management.trueengage.com/login) [Install from AppFoundry](https://appfoundry.genesys.com/filter/genesyscloud/listing/d3d5011e-668b-411c-bc8d-512e3023b359) [Book a Demo](https://trueengage.com/genesys-cloud/demo?hsLang=en)
[Home](https://trueengage.com/?hsLang=en) [Docs](https://kb.trueengage.com/genesys-cloud?hsLang=en) [Pricing](https://trueengage.com/genesys-cloud/pricing?hsLang=en)
[Sign In](https://management.trueengage.com/login) [Install from AppFoundry](https://appfoundry.genesys.com/filter/genesyscloud/listing/d3d5011e-668b-411c-bc8d-512e3023b359) [Book a Demo](https://trueengage.com/genesys-cloud/demo?hsLang=en)
[Skip to content](https://kb.trueengage.com/genesys-cloud/firewall-configuration-for-webrtc-calls-end-user-networks-0#main-content)
- [Tickets](https://support.trueengage.com/tickets-view)
- [Sign out](https://support.trueengage.com/_hcms/mem/logout)
Open main navigation
Close main navigation
- [Tickets](https://support.trueengage.com/tickets-view)
- [Sign out](https://support.trueengage.com/_hcms/mem/logout)
How can we help you?
- There are no suggestions because the search field is empty.
1. [Knowledge Base](https://kb.trueengage.com/genesys-cloud?hsLang=en)
2. [Architecture & Security](https://kb.trueengage.com/genesys-cloud/architecture-security?hsLang=en)
# Firewall Configuration for WebRTC Calls (End-User Networks)
## This article describes the required firewall configuration for end-users who want to make WebRTC voice calls from our web application.
TrueEngage uses **Vonage WebRTC** for real-time audio communication. If users are behind a **corporate firewall**, specific IP addresses, domains, ports, and protocols must be allowed for calls to work correctly.
**⚠️ Important**
- This configuration applies to **end-user networks** (customers, agents, employees).
- This is **NOT a Genesys configuration**.
- These rules are required on the **user's corporate firewall**.
---
#### Symptoms of Missing Firewall Rules
If required firewall rules are blocked, users may experience:
- Calls that connect but **no audio** in either direction
- Calls that never fully connect
- Calls that immediately drop
---
#### **Official Vonage Documentation**
For the **most up-to-date and authoritative requirements**, please refer to Vonage’s official documentation: https://api.support.vonage.com/hc/en-us/articles/11117874324508-What-are-the-Vonage-Video-API-network-connectivity-requirements
---
#### Required Firewall Rules
#### 1. WebRTC Signaling (Call Setup)
Used to establish and control WebRTC calls. This is the absolute minimum — without TCP 443 open, nothing will work.
| Destination | Port | Protocol | Purpose |
| --- | --- | --- | --- |
| `*.vonage.com` | 443 | TCP (WSS / HTTPS) | Signaling & WebSocket connections |
| `*.nexmo.com` | 443 | TCP (WSS / HTTPS) | Signaling & WebSocket connections |
#### 2. STUN / TURN Servers (NAT Traversal and Media Relay)
Required to allow audio to flow through NATs and restrictive firewalls. Vonage uses STUN/TURN for ICE negotiation. All connections are **outbound-initiated** — no ports need to be permanently open inbound, and there are no port-forwarding requirements.
**Minimum**
UDP 3478
TURN relay. Required for restricted networks. Without this, media may fail entirely.
**Recommended**
UDP 3478 + TCP 443
TCP 443 as TURN fallback for environments where UDP is heavily restricted.
**Optimal**
UDP 1025 – 65535
Direct peer connections — lowest latency, no relay needed. Best call quality.
**ℹ️ Note:** The client always favours UDP. Even if UDP is blocked by policy, you can expect UDP traffic to be *attempted* in network traces before falling back to TCP. Opening at least UDP 3478 significantly improves call quality over TCP-only.
---
#### 3. Media (RTP Audio Streams)
Actual voice traffic is transmitted using RTP over UDP.
| Protocol | Port Range | Direction |
| --- | --- | --- |
| UDP | 10000 – 50000 | Outbound (inbound after outbound request) |
### Allowed IP Ranges (Primary Subnets)
These subnets cover all Vonage API traffic: HTTP Callbacks, WebHooks, WebSocket connections, SIP, and RTP/Media. Allow both ranges for full coverage.
- 216.147.0.0/18
- 168.100.64.0/18
**❗ Blocking UDP media traffic (ports 10000–50000) will result in connected calls with no audio.**
---
#### 4. SIP Signaling (Used Internally by Vonage)
Even though the application uses WebRTC in the browser, Vonage uses SIP internally for call routing to Genesys Cloud. The primary subnets above cover SIP traffic, but if your firewall requires specific host-level rules, use the addresses below.
| Protocol | Port | Purpose |
| --- | --- | --- |
| UDP | 5060 | SIP signaling |
| TCP | 5060 | SIP signaling |
| TLS | 5061 | Encrypted SIP signaling |
### Specific SIP IP Addresses
Use the primary subnets above where possible. If your platform cannot accept subnet notation, allow the following individual IPs:
- 216.147.0.1
- 216.147.0.2
- 216.147.1.1
- 216.147.1.2
- 216.147.2.1
- 216.147.2.2
- 216.147.3.1
- 216.147.3.2
- 216.147.4.1
- 216.147.4.2
- 216.147.5.1
- 216.147.5.2
**ℹ️** It is strongly recommended to allow the **primary subnets** (`216.147.0.0/18` and `168.100.64.0/18`) rather than individual IPs, to avoid configuration changes if Vonage adds new addresses in the future.
---
#### Quick Reference Summary
| Traffic Type | Destination | Port(s) | Protocol |
| --- | --- | --- | --- |
| WebRTC Signaling | `*.vonage.com`, `*.nexmo.com` | 443 | TCP (WSS) |
| TURN (minimum) | `216.147.0.0/18`, `168.100.64.0/18` | 3478 | UDP |
| TURN (fallback) | `216.147.0.0/18`, `168.100.64.0/18` | 443 | TCP |
| RTP / Media | `216.147.0.0/18`, `168.100.64.0/18` | 10000 – 50000 | UDP |
| SIP Signaling | `216.147.0.0/18`, `168.100.64.0/18` | 5060 / 5061 | UDP / TCP / TLS |
---
#### Important Notes for IT & Security Teams
- IP ranges are maintained by Vonage and **may change over time** — the authoritative list is available at: https://api.support.vonage.com/hc/en-us/articles/360035471331
#### Need Help?
If calls still fail after applying these rules:
1. Verify that **UDP traffic is not blocked or rate-limited**
2. Confirm that **outbound rules** are applied (inbound is not required)
3. Contact your network administrator to review firewall logs for dropped packets on the ports above
If needed, our support team can assist in validating the configuration.
- [Getting Started](https://kb.trueengage.com/genesys-cloud/getting-started?hsLang=en)
- [Installation & Setup](https://kb.trueengage.com/genesys-cloud/installation-setup?hsLang=en)
- [User Guide](https://kb.trueengage.com/genesys-cloud/user-guide?hsLang=en#main-content)
- [Contact Channels](https://kb.trueengage.com/genesys-cloud/user-guide?hsLang=en#contact-channels)
- [Features](https://kb.trueengage.com/genesys-cloud/features?hsLang=en)
- [FAQs](https://kb.trueengage.com/genesys-cloud/faqs?hsLang=en)
- [Troubleshooting](https://kb.trueengage.com/genesys-cloud/troubleshooting?hsLang=en)
- [Administration & Billing](https://kb.trueengage.com/genesys-cloud/administration-billing?hsLang=en)
- [Integrations & API's](https://kb.trueengage.com/genesys-cloud/integrations-apis?hsLang=en)
- [Architecture & Security](https://kb.trueengage.com/genesys-cloud/architecture-security?hsLang=en)
- [Legal](https://kb.trueengage.com/genesys-cloud/legal?hsLang=en)
- [Interaction Routing & Availability](https://kb.trueengage.com/genesys-cloud/interaction-routing-availability?hsLang=en)
[%20copy.png?width=440&height=36&name=logo%20(3)%20copy.png "logo (3) copy")](https://www.trueengage.com?hsLang=en)
[mailto:email@email.com](mailto:email@email.com)