Firewall Settings

An overview of firewall settings required for your copy of VCC Live to communicate seamlessly with our servers.

Table of Contents

• Settings for VCC Live
• Settings for IP Phone Users
• Settings for VCC Live Archiver
• Data Center IP Ranges
• Example of using hu1 hosting
• Split-Tunnel VPN Setup
• Example (Windows Firewall):

Settings for VCC Live

(1) Use a data center IP range.

Settings for IP Phone Users

(1) Use a data center IP range.
(2) Unsecured SIP communication, use a SIP-TLS instead.
(3) If you use a restricted VoIP connection, the 5061 TCP connections need to be opened.

Settings for VCC Live Archiver

(1) Use a data center IP range.

Data Center IP Ranges

Example of using hu1 hosting

Split-Tunnel VPN Setup

In some customer setups using split-tunnel VPNs, WebRTC media traffic may be incorrectly routed through the VPN. This can cause ICE negotiation delays of several seconds and result in poor call setup performance.
To ensure stable media connections, we recommend blocking STUN traffic inside the VPN tunnel. By doing so, VPN-routed ICE candidates will fail, and direct WAN candidates will be selected instead.

Example (Windows Firewall):

You can add outbound firewall rules to block UDP traffic in the port range 10000–20000 for STUN packets when routed through the VPN. For example:

1. Open Windows Defender Firewall with Advanced Security.
2. Create a new Outbound Rule.
3. Rule type: Port, Protocol: UDP, Ports: 10000–20000.
4. Action: Block the connection.
5. Apply to the relevant profiles (Domain/Private/Public).

This ensures ICE negotiation always succeeds over the direct WAN path instead of the VPN.

Note: While the example above shows Windows, the same principle applies to other platforms (Linux iptables, macOS pf, or network-level firewall rules).