Overview: Firewall Guide and Requirements

Why this matters

Your Crexendo phones, mobile app, and web phone all make calls over your internet connection. Your firewall (usually built into your router) decides which internet traffic is allowed in and out of your office. Most firewalls are designed for web browsing and email, not live voice calls, so their default settings often get in the way.

When the firewall isn't set up for voice, you'll typically see problems like:

• Calls that drop after a few seconds or minutes
• One-way audio, where you can hear the caller but they can't hear you (or the reverse)
• Choppy, robotic, or delayed audio
• Phones that show "No Service" or stop receiving calls
• The mobile app or web phone not ringing
• Voicemail or fax emails that never arrive

Almost all of these are caused by a firewall setting, not by the phones or the Crexendo service. Following this guide before your phones are installed, and keeping it in place afterward, prevents most call quality issues and saves you from troubleshooting later.

Quick checklist

Hand this list to your IT person. Each item is explained step by step in Parts 1 to 5 below.

1. Make sure you have enough upload speed, about 100 to 120 kbps for each call happening at the same time. (Part 1)
2. Remove anything that hands out phone settings, such as DHCP Option 66, PXE boot, or an old on-site phone system. (Part 2)
3. Turn off SIP ALG on the firewall or router. (Part 3)
4. Set the UDP timeout to 80 seconds (anything above 60 seconds). (Part 3)
5. Allow Crexendo's servers and ports through the firewall. (Parts 3 and 5)
6. Give voice traffic priority (QoS) so calls stay clear when the internet is busy. (Part 3)
7. Exclude voice traffic from security scanning such as antivirus, deep packet inspection, intrusion prevention, and content filtering. (Part 3)
8. Allow Crexendo's email server so voicemail and fax emails are delivered. (Part 4)

How to use this guide: Work through Parts 1 to 5 in order. Together they are Crexendo's recommended setup for clear, reliable calls. Most of these changes should be made by your IT person, managed service provider, or equipment vendor.

Part 1: Internet connection

Internet provider equipment

In plain terms: Your internet provider's modem should pass the internet straight through to your own firewall, without trying to manage phone calls itself.

• Cable or broadband: use a modem that can be put into bridge or pass-through mode.
• Fiber: an Ethernet handoff directly to your firewall.
• DHCP or static IP: either works. The firewall's internet (WAN) connection should have a public IP address.
• Provider equipment with phone jacks: if your provider's modem has telephone (RJ-11) ports for their own phone service, it needs to be replaced, or the provider needs to turn that phone service off so it doesn't interfere with Crexendo.

Internet speed (bandwidth)

In plain terms: Every call uses a small, steady slice of your internet. If the connection is maxed out by downloads, video, or backups, calls are the first thing to suffer.

• Each active call uses about 100 to 120 kbps of both download and upload.
• Upload speed is usually the limit for voice, so check it specifically.
• Plan for your busiest time of day, with calls and normal computer use happening together.

This is in addition to what your computers and other devices already use.

Part 2: Network equipment

Business-class firewall and switch

In plain terms: Your firewall and network switch are the two boxes every call passes through. Consumer equipment is built for web browsing; business-class equipment is built to keep live voice calls clear and reliable.

Examples of business-class firewalls: SonicWall TZ/NSA, WatchGuard, Sophos, and Fortinet. Basic consumer and internet-provider routers often can't handle the settings in Part 3 reliably.

Separating voice and data (VLANs)

In plain terms: Putting phones on their own lane of your network keeps calls clear even when computers are busy.

• Create separate VLANs for voice and data traffic.
• A phone and computer can share one network cable: voice traffic is tagged to the voice VLAN and computer traffic stays on the data (or native) VLAN.
• Alternatively, use separate network jacks for phones (voice VLAN) and computers (data VLAN).

Remove anything that hands out phone settings

In plain terms: Crexendo phones get their setup from Crexendo. If something else on your network tries to give them settings, the phones get confused.

Remove or turn off:

• Any old on-site phone system (PBX)
• DHCP Option 66 on your router or server
• PXE boot settings on servers or routers

Part 3: Firewall settings

These are the key settings for clear, reliable calls. For the exact steps on your specific firewall, your IT person may need the manufacturer's documentation.

1. Turn off SIP ALG

In plain terms: SIP ALG is a feature that tries to "help" phone calls by rewriting them as they pass through the firewall. It works like a bad translator, turning English into Greek and back again, and the call setup often comes out garbled. It is the single most common cause of dropped calls and one-way audio.

• Disable SIP ALG on most firewalls and routers.
• Cisco ASA exception: on IOS versions 8.2 to 9.3, keep SIP ALG enabled. On IOS 9.4 and above, disable it (no sip-inspect within the global policy-map).

2. Raise the UDP timeout

In plain terms: Phones check in with Crexendo regularly to stay connected. If the firewall "forgets" the phone too quickly between check-ins, incoming calls can't reach it.

• Set the UDP timeout (sometimes called the UDP inactivity timer) to above 60 seconds. Crexendo uses 80 seconds as the standard.

Cisco ASA and ISR example commands:

timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 1:10:00 sip_media 0:10:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

3. Allow Crexendo traffic (access rules)

In plain terms: Access rules (ACLs) are the firewall's guest list. Crexendo's servers need to be on it, both going out and coming in.

• Outbound: allow voice traffic to the Crexendo ports and IP addresses listed in Part 5. Also allow NTP (time) and DNS lookups for the phones.
• Inbound: allow traffic from the Crexendo IP addresses in Part 5 to the network your phones are on.

4. Give voice priority (QoS)

In plain terms: QoS tells the firewall to let calls go first, like an express lane, so a big download doesn't make calls choppy.

• Mark voice traffic as priority. It can be identified by its DiffServ tag (EF 46), by port, or by the Crexendo IP addresses in Part 5.
• On many firewalls this is done in the access rules by placing voice rules at the top of the list.

Note: you can usually only control priority for outbound traffic.

5. Reserve bandwidth for calls (traffic shaping)

In plain terms: Set aside a guaranteed slice of your internet for calls so they always have room.

• Reserve a minimum for at least half your phones being on calls at once, and allow up to the amount needed if every phone were in use.
• Example: with 10 phones, set a minimum of about 500 kbps (5 calls × 100 kbps) and a maximum of 1 to 1.5 Mbps.
• Some firewalls use a percentage instead. Calculate it the same way, based on your upload speed.

6. Exclude voice from security scanning

In plain terms: Business firewalls inspect traffic for threats. That inspection adds tiny delays that are harmless for web pages but noticeable on calls. Voice traffic to and from Crexendo should skip it.

Whitelist or exclude Crexendo voice traffic from:

• Antivirus
• DPI (deep packet inspection)
• Intrusion prevention
• Content filtering

Part 4: Voicemail and fax emails

In plain terms: Crexendo sends voicemail-to-email and fax-to-email messages through the mail server below. If your email security blocks it, those messages never reach your inbox.

Part 5: Servers and ports

Use these lists when creating the firewall rules in Part 3. Each address is on its own line so it's easy to copy.

Ports to allow

Voice servers

Portal, phone setup, and call recording

Fax and video

Phone makers and partner services

Copy-ready list of all Crexendo IP addresses

# Voice servers
132.226.159.170
141.148.178.111
131.186.0.38
64.181.221.247
132.226.57.124
129.213.215.42

# Portal
144.24.35.213
193.122.179.160
164.152.19.130

# Phone setup (provisioning)
132.226.116.51
141.148.29.139

# Call recording
129.153.206.129
129.80.72.153

# Enterprise Fax
54.219.249.208
52.32.130.83

# Video Meetings
184.169.150.184
52.52.95.56

# CrexendoHD video conferencing
3.130.158.184
18.130.7.254
35.183.150.146
35.175.185.150
52.34.73.65
54.188.133.147
54.153.249.187

# Grandstream provisioning (GAPS)
35.82.75.208

Troubleshooting

If something still isn't working, find the problem that matches what you're seeing and double-check these settings, in this order.

Phones say "No Service" or won't connect

1. Crexendo servers and ports are allowed through the firewall. (Part 3, step 3, and the tables in Part 5)
2. UDP timeout is above 60 seconds, ideally 80. (Part 3, step 2)
3. SIP ALG is turned off. (Part 3, step 1)
4. Nothing else is handing out phone settings: DHCP Option 66, PXE boot, or an old on-site phone system. (Part 2)

You can hear them, but they can't hear you (one-way audio)

1. SIP ALG is turned off. (Part 3, step 1)
2. Call audio ports 20000–60000 are allowed. (Part 5, Ports)
3. Both inbound and outbound rules allow Crexendo traffic. (Part 3, step 3)

Calls are choppy, robotic, or cut out

1. Enough internet speed, about 100 to 120 kbps for each call at the same time. (Part 1, Internet speed)
2. Voice traffic is set as priority. (Part 3, step 4)
3. Bandwidth is reserved for calls. (Part 3, step 5)
4. Security scanning skips voice traffic. (Part 3, step 6)

Phones ring late, miss calls, or disconnect now and then

1. UDP timeout is above 60 seconds. Crexendo recommends 80 seconds. (Part 3, step 2)
2. The firewall isn't closing the phones' connection early. Your IT person can check the firewall's session or connection timeout settings.

Voicemail or fax emails aren't arriving

1. Crexendo's email server, mail.smtp2go.com, is allowed by your email security and spam filters. (Part 4)
2. Check the junk or spam folder, and add the sender to your safe senders list.

Related articles

• Problem: Desk Phone - Choppy Audio Troubleshooting
• Problem: Web Phone - Won't Connect or Register
• FAQs: Why Do I Need to Dial 10 Digits?

Change log