fix: correct EU SIP allowlist docs #1068
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,7 @@ When you integrate a SIP trunk with Vapi, your firewall and network infrastructu | |
| **In this reference, you'll find:** | ||
|
|
||
| - All IP addresses and ports used by Vapi for SIP signalling | ||
| - RTP media port ranges, directionality details, and regional IP behavior | ||
| - Recommended firewall rules for inbound and outbound traffic | ||
|
|
||
| <Note> | ||
|
|
@@ -25,47 +25,55 @@ The table below summarizes every IP address, port, and protocol you need to allo | |
| | Traffic type | Region | Hostname | IP addresses | Ports | Protocol | Direction | | ||
| | --- | --- | --- | --- | --- | --- | --- | | ||
| | SIP signalling | US | `sip.vapi.ai` | `44.229.228.186`, `44.238.177.138` | `5060` | UDP | Bidirectional | | ||
| | SIP signalling | EU | `sip.eu.vapi.ai` | `63.182.83.170` | `5060` | UDP/TCP | Bidirectional | | ||
| | SIP signalling (TLS) | US | `sip.vapi.ai` | `44.229.228.186`, `44.238.177.138` | `5061` | TLS | Bidirectional | | ||
| | SIP signalling (TLS) | EU | `sip.eu.vapi.ai` | `63.182.83.170` | `5061` | TLS | Bidirectional | | ||
| | RTP media | US | N/A | No static IPs (dynamic) | `40000`-`60000` | UDP | Bidirectional | | ||
| | RTP media | EU | N/A | `63.182.83.170` | `40000`-`60000` | UDP | Bidirectional | | ||
|
|
||
| Use your region's SIP hostname when configuring SIP URIs or SIP peers. If your firewall or SIP provider requires IP-based allowlisting, add the static signalling IP addresses for your region. For media, EU traffic can be allowlisted to `63.182.83.170`; US media uses dynamic source IPs and should be allowed by UDP port range. | ||
|
|
||
| ## SIP signalling | ||
|
|
||
| Vapi's SIP infrastructure uses static IP addresses for signalling traffic in each region: | ||
|
|
||
| | Region | Hostname | IP addresses | | ||
| | --- | --- | --- | | ||
| | US | `sip.vapi.ai` | `44.229.228.186/32`, `44.238.177.138/32` | | ||
| | EU | `sip.eu.vapi.ai` | `63.182.83.170/32` | | ||
|
|
||
| These are the public IPs of Vapi's SBC (Session Border Controller) nodes. All SIP `INVITE`, `REGISTER`, `BYE`, and other signalling messages originate from and are received at the addresses for your region. | ||
|
|
||
| ### Ports | ||
|
|
||
| | Port | Protocol | Use case | | ||
| | --- | --- | --- | | ||
| | **5060** | UDP/TCP | Default SIP signalling. EU traffic may use TCP on this port. | | ||
| | **5061** | TLS | SIP over TLS (SIPS) signalling. | | ||
|
|
||
| Use port **5060** unless your provider or security requirements mandate encrypted signalling. For TLS/SIPS in either region, use port **5061** with TLS. | ||
|
|
||
| ### Hostnames and allowlisting | ||
|
|
||
| Configure your SIP client or PBX to point to the hostname for your region. For firewall rules and carrier allowlists, use the static IP addresses listed for your region. In the EU, `sip.eu.vapi.ai` currently resolves to `63.182.83.170`. | ||
|
|
||
| <Tip> | ||
| Allowlist every IP address for your region explicitly. DNS A records may not match every static IP that Vapi can use for carrier or firewall allowlisting. | ||
| </Tip> | ||
|
|
||
| <Warning> | ||
| Do not use `sip-web.eu.vapi.ai` for SIP signalling or media. It is used for portal and API traffic and resolves through Cloudflare/WAF, not to Vapi's SIP infrastructure. | ||
| </Warning> | ||
|
|
||
| ## SIP media (RTP) | ||
|
|
||
| RTP media IP behavior depends on your region: | ||
|
|
||
| - **US:** Vapi does not use static IP addresses for RTP media. Media source IPs are dynamically assigned and may change between calls. | ||
| - **EU:** RTP media uses the same static public IP as SIP signalling: `63.182.83.170`. | ||
|
|
||
| <Warning> | ||
| For US RTP media, allow traffic based on port ranges rather than specific source IPs. For EU RTP media, allowlist `63.182.83.170` with the full UDP port range. | ||
| </Warning> | ||
|
|
||
| ### Port range | ||
|
|
@@ -86,7 +94,7 @@ Vapi uses **UDP ports 40000 through 60000** for RTP media traffic. | |
|
|
||
| ## Firewall rules | ||
|
|
||
| Configure your firewall to allow the following traffic. Every SIP signalling IP address for your region must be allowlisted. For RTP media, allow traffic on the full port range. US media uses dynamic IPs; EU media uses `63.182.83.170`. | ||
|
|
||
| ### Inbound rules (traffic from Vapi to your network) | ||
|
|
||
|
|
@@ -95,10 +103,11 @@ Allow these if your SIP provider or PBX needs to receive traffic from Vapi: | |
| | Rule | Region | Source IP | Destination | Port(s) | Protocol | | ||
| | --- | --- | --- | --- | --- | --- | | ||
| | SIP signalling | US | `44.229.228.186`, `44.238.177.138` | Your SIP server | `5060` | UDP | | ||
| | SIP signalling | EU | `63.182.83.170` | Your SIP server | `5060` | UDP/TCP | | ||
| | SIP signalling (TLS) | US | `44.229.228.186`, `44.238.177.138` | Your SIP server | `5061` | TLS | | ||
| | SIP signalling (TLS) | EU | `63.182.83.170` | Your SIP server | `5061` | TLS | | ||
| | RTP media | US | Any (dynamic) | Your media server | `40000`-`60000` | UDP | | ||
| | RTP media | EU | `63.182.83.170` | Your media server | `40000`-`60000` | UDP | | ||
|
|
||
| ### Outbound rules (traffic from your network to Vapi) | ||
|
|
||
|
|
@@ -107,29 +116,33 @@ Allow these if your firewall restricts outbound connections: | |
| | Rule | Region | Source | Destination IP | Port(s) | Protocol | | ||
| | --- | --- | --- | --- | --- | --- | | ||
| | SIP signalling | US | Your SIP server | `44.229.228.186`, `44.238.177.138` | `5060` | UDP | | ||
| | SIP signalling | EU | Your SIP server | `63.182.83.170` | `5060` | UDP/TCP | | ||
| | SIP signalling (TLS) | US | Your SIP server | `44.229.228.186`, `44.238.177.138` | `5061` | TLS | | ||
| | SIP signalling (TLS) | EU | Your SIP server | `63.182.83.170` | `5061` | TLS | | ||
| | RTP media | US | Your media server | Any (dynamic) | `40000`-`60000` | UDP | | ||
| | RTP media | EU | Your media server | `63.182.83.170` | `40000`-`60000` | UDP | | ||
|
|
||
| <Warning> | ||
| Allow every SIP signalling IP address for your region in your firewall rules. For RTP media, configure your firewall to allow the full port range (`40000`-`60000` UDP). US RTP media uses dynamic IPs. EU RTP media uses `63.182.83.170`. Contact support if you need a stricter media firewall policy. | ||
| </Warning> | ||
|
|
||
| ## FAQ | ||
|
|
||
| <AccordionGroup> | ||
| <Accordion title="Can I use DNS instead of IP addresses in my firewall rules?"> | ||
| Use your region's hostname for SIP URI and peer configuration. For IP-based firewall rules, add the static IP addresses for your region explicitly. DNS-based firewall rules depend on TTL and caching behavior, and DNS A records may not match every static IP that Vapi can use for allowlisting. US RTP media uses dynamic IPs that cannot be resolved via DNS. EU RTP media uses `63.182.83.170`. | ||
| </Accordion> | ||
| <Accordion title="Do I need to open the full 40000-60000 port range?"> | ||
| Yes. Vapi's RTP stack dynamically allocates ports within this range for each call. You cannot predict which specific port a given call will use, so the entire range must be open for reliable media flow. | ||
| </Accordion> | ||
| <Accordion title="Are the signalling and media IPs the same?"> | ||
| It depends on the region. In the EU, SIP signalling and RTP media both use `63.182.83.170`. In the US, SIP signalling uses static IP addresses, but RTP media source IPs are dynamically assigned and may vary between calls. | ||
| </Accordion> | ||
| <Accordion title="Does Vapi support SRTP (encrypted media)?"> | ||
| Vapi supports TLS for SIP signalling on port 5061 in both US and EU regions. For encrypted media (SRTP), configure your SIP trunk gateway with the `tls/srtp` outbound protocol option. See the [gateway configuration reference](/advanced/sip/troubleshoot-sip-trunk-credential-errors#gateway-configuration-reference) for details. | ||
| </Accordion> | ||
| <Accordion title="What do SIP 403 and 404 responses mean?"> | ||
| A `403 Forbidden` response with `X-Reason: Invalid credentials` usually means IP allowlisting or authentication failed. A `404 Not Found` response usually means Vapi could not find a matching account or called number for the request. | ||
|
Contributor
There was a problem hiding this comment.
The 403/404 meanings are fine as generic SIP guidance, but please remove the invented header. One caveat worth a second look: the 403/404 you can actually observe in our infra are HTTP-edge (apoxy/Envoy) router replies —
Contributor
Author
There was a problem hiding this comment. Confirmed and fixed in #1072. Verified |
||
| </Accordion> | ||
| </AccordionGroup> | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
TCP on 5060 isn't EU-specific. A live SIP
OPTIONSprobe returns200 OKon TCP/5060 for bothsip.vapi.ai(US) andsip.eu.vapi.ai(EU), and the SBC security group opens TCP/5060 region-agnostically. "EU traffic may use TCP on this port" implies a regional difference that doesn't exist, and could lead a US customer to believe TCP signalling isn't available to them.Suggest: "Default SIP signalling. UDP and TCP are both supported in US and EU."
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Confirmed and fixed in #1072.
infra/aws/cloudFormations/jambonz-large.ymlopens tcp 5060-5061 plus udp 5060 fromAllowedSipCidrin a single region-agnostic template (noCondition/!Ifgating, no separate EU template), so TCP/5060 is not EU-specific. I used your suggested wording for the port note, and also flipped the US signalling rows to UDP/TCP across the quick-reference and firewall tables so the protocol columns are consistent across regions.