This article is for network administrators at companies using a firewall or a restricted network. It lists the protocols, ports, addresses and DNS records to allow so Onoff calls work.
1. How calls work
A VoIP call consists of signaling and audio data.
| Component | App | Protocol and port |
|---|---|---|
| Signaling | Mobile app | SIP over TLS, TCP 5061 |
| Signaling | Web app | SIP over TLS, TCP 443 |
| Audio | Mobile and web apps | UDP, random port between 10000 and 65535; the second stream uses the next port (for example 20000 and 20001) |
2. Bandwidth
Allow 100 kbps minimum and 200 kbps recommended, upload and download, per active call. Plan bandwidth for the number of simultaneous calls and prefer a wired, stable, low-latency connection.
3. Firewall rules
Recommended: allow all traffic to and from the Onoff server addresses below. If that's not possible, open at least these protocols and ports to these addresses.
| Protocol and port | Onoff server addresses |
|---|---|
| TCP 5061, TCP 443, UDP 10000–65535 | 57.130.42.128/25, 141.94.200.49, 151.80.169.192/27, 141.94.109.186, 151.80.3.96/28, 141.94.132.230, 217.182.219.96/27, 51.210.34.183, 51.254.11.32/27, 141.94.30.226, 178.33.11.64/28, 51.178.176.125, 91.134.149.64/28, 91.134.58.98, 51.254.247.96/28 |
4. STUN servers
Onoff uses STUN to set up audio: traffic to these servers must be allowed. Otherwise, ICE, TURN or STUN errors appear in the browser console (diagnostics: chrome://webrtc-internals in Chrome, about:webrtc in Firefox).
| Server | Ports |
|---|---|
| stun.cloudflare.com | 3478 |
| stun.l.google.com | 19302, 5349 |
| stun1.l.google.com | 3478, 5349 |
| stun2.l.google.com | 19302, 5349 |
| stun3.l.google.com | 3478, 5349 |
| stun4.l.google.com | 19302, 5349 |
5. DNS records
These records must be reachable from your network:
| Type | Record |
|---|---|
| SRV | _sips._tcp.voip.onoffapp.net, _wss._tcp.voip.onoffapp.net, _sips._tcp.voip-prd-paris.onoffapp.net, _wss._tcp.voip-prd-paris.onoffapp.net |
| A | voip.onoffapp.net, ingress-fr-c-1.onoffapp.net, ingress-fr-e-1.onoffapp.net, voip-prd-paris.onoffapp.net, ingress-prd-paris-bd-1.onoffapp.net, ingress-prd-paris-cd-1.onoffapp.net |
6. TURN servers (Cloudflare)
For strict firewalls, allowlist these IPv4 and IPv6 addresses of Cloudflare's TURN service:
| Version | Address |
|---|---|
| IPv4 | 141.101.90.1/32, 162.159.207.1/32 |
| IPv6 | 2a06:98c1:3200::1/128, 2606:4700:48::1/128 |
Important: Cloudflare doesn't guarantee these addresses stay the same. Set up an alert on changes to the DNS response for turn.cloudflare.com (A and AAAA records) and update your rules within 14 days of any change.
Before contacting support
- The firewall allows TCP 5061, TCP 443 and UDP 10000–65535 to the Onoff addresses.
- STUN and TURN servers are reachable, and DNS records aren't blocked.
- Bandwidth is enough for the number of simultaneous calls; latency and packet loss stay low.
Our team can help you validate your configuration: support@onoffbusiness.com.
Related articles
- Improve your call quality
- VoIP and GSM: how your Onoff calls work
Comments
0 comments
Please sign in to leave a comment.