SIP trunk network requirements
If your firewall or SBC accepts traffic only from listed addresses, allow the Bird addresses on this page for your trunk's region. Missing signalling addresses stop calls from reaching your equipment, and missing media addresses leave calls without audio, or with audio in one direction only, even though they connect.
Which region applies
Allow the addresses of your trunk's region: the region in its SIP domain, <trunk-id>.trunk.<region>.sip.bird.com, which is your workspace's region. Bird delivers calls to your numbers, and sends their audio, from that region's addresses, whichever country the number belongs to.
A gateway whose Exit data center is set to the other region receives its calls from that region's trunk edge addresses, and their audio from that region's media addresses. Allow those addresses for that gateway.
Signalling addresses
Allow SIP from and to the four addresses of your region. Bird sends SIP from the same address it receives on.
| Region | Edge | Host name | Addresses | Carries |
|---|---|---|---|---|
Europe (eu1) | Inbound edge | did.eu1.sip.bird.com | 18.202.63.25, 40.180.83.92 | The calls Bird delivers to your gateways |
Europe (eu1) | Trunk edge | trunk.eu1.sip.bird.com | 52.30.150.219, 63.35.77.164 | The calls your equipment sends through the trunk |
United States (us1) | Inbound edge | did.us1.sip.bird.com | 35.163.113.80, 54.148.250.26 | The calls Bird delivers to your gateways |
United States (us1) | Trunk edge | trunk.us1.sip.bird.com | 34.214.231.219, 52.38.96.162 | The calls your equipment sends through the trunk |
Build your allow list from this table rather than from DNS lookups of the host names.
Send your outgoing calls to your trunk's SIP domain, copied whole from the trunk page, not to these addresses or host names directly. The SIP domain identifies your trunk: a call whose Request-URI names another host is refused with 403 Forbidden.
| Direction | Ports |
|---|---|
| Calls your equipment sends to Bird | 5060 over UDP or TCP, 5061 over TLS |
| Calls Bird delivers to your gateways | The port and transport you set on each gateway in Inbound routing > Gateways |
Media addresses
Allow RTP on UDP ports 2500 to 32499 from and to the ten media addresses of your region. Some of them carry no traffic yet; allowing all ten keeps your audio working when Bird adds media capacity.
With Direct audio on for the trunk, the audio of incoming calls flows between your equipment and the network that delivered the call instead of these addresses, so your equipment has to accept audio from outside them.
| Region | Media addresses |
|---|---|
Europe (eu1) | 40.180.165.35, 52.17.18.149, 52.31.151.186, 52.48.123.9, 52.213.113.60, 52.214.183.204, 54.76.111.244, 54.77.249.231, 54.155.191.8, 54.246.111.12 |
United States (us1) | 32.189.119.37, 35.162.12.185, 35.165.86.198, 35.167.33.5, 35.167.126.199, 44.227.8.88, 44.253.239.124, 52.35.78.221, 100.21.152.215, 100.22.136.208 |
TLS on port 5061
The trunk edge presents a certificate from a public certificate authority for trunk.<region>.sip.bird.com and *.trunk.<region>.sip.bird.com, so it also covers your trunk's SIP domain. The certificate renews automatically every few months and its issuing authority can change, so have your equipment trust the public root certificates rather than pin the certificate or its issuer.
Host names in SIP headers
Within a call, Bird's Contact and Record-Route headers can name a single address through a host name such as ip-52-30-150-219.trunk.eu1.sip.bird.com, which resolves to that address. Each of these is one of the signalling addresses above, so an allow list built from the table already covers them.
Troubleshooting
| What you see | What to check |
|---|---|
| Calls connect but there is no audio, or audio in one direction | The ten media addresses of your region on UDP ports 2500 to 32499 |
| Your gateway never sees the calls Bird delivers | The inbound edge addresses of your region, on the port and transport set on the gateway |
Outgoing calls get 403 Forbidden and leave no call record | The Request-URI host is your trunk's SIP domain, and your public address is in the trunk's Allowed IP addresses |
Voice troubleshooting covers the other symptoms.
Next steps
| Page | What it covers |
|---|---|
| Set up a SIP trunk | A whole trunk setup in order, from creation to a test call |
| SIP trunks | Every trunk setting, authentication, and Digest |
| Placing calls | What Bird expects on the INVITE, codecs and media |
Related resources
Continue with the documentation, guides and examples for this topic.