--- title: "SIP trunk network requirements" description: "The signalling and media addresses, ports and TLS details to allow on your firewall and SBC so Bird can carry calls and audio over your SIP trunk." canonical: "https://bird.com/docs/guides/voice/network-requirements" --- # SIP trunk network requirements If your firewall or SBC accepts traffic only from listed addresses, allow the Bird addresses on this page for your trunk's region. Missing signalling addresses stop calls from reaching your equipment, and missing media addresses leave calls without audio, or with audio in one direction only, even though they connect. ## Which region applies Allow the addresses of your trunk's region: the region in its SIP domain, `.trunk..sip.bird.com`, which is your workspace's region. Bird delivers calls to your numbers, and sends their audio, from that region's addresses, whichever country the number belongs to. A gateway whose **Exit data center** is set to the other region receives its calls from that region's trunk edge addresses, and their audio from that region's media addresses. Allow those addresses for that gateway. ## Signalling addresses Allow SIP from and to the four addresses of your region. Bird sends SIP from the same address it receives on. | Region | Edge | Host name | Addresses | Carries | | --------------------- | ------------ | ------------------------ | -------------------------------- | ------------------------------------------------ | | Europe (`eu1`) | Inbound edge | `did.eu1.sip.bird.com` | `18.202.63.25`, `40.180.83.92` | The calls Bird delivers to your gateways | | Europe (`eu1`) | Trunk edge | `trunk.eu1.sip.bird.com` | `52.30.150.219`, `63.35.77.164` | The calls your equipment sends through the trunk | | United States (`us1`) | Inbound edge | `did.us1.sip.bird.com` | `35.163.113.80`, `54.148.250.26` | The calls Bird delivers to your gateways | | United States (`us1`) | Trunk edge | `trunk.us1.sip.bird.com` | `34.214.231.219`, `52.38.96.162` | The calls your equipment sends through the trunk | Build your allow list from this table rather than from DNS lookups of the host names. Send your outgoing calls to your trunk's SIP domain, copied whole from the trunk page, not to these addresses or host names directly. The SIP domain identifies your trunk: a call whose Request-URI names another host is refused with `403 Forbidden`. | Direction | Ports | | ------------------------------------ | ------------------------------------------------------------------------------------ | | Calls your equipment sends to Bird | `5060` over UDP or TCP, `5061` over TLS | | Calls Bird delivers to your gateways | The port and transport you set on each gateway in **Inbound routing** > **Gateways** | ## Media addresses Allow RTP on UDP ports `2500` to `32499` from and to the ten media addresses of your region. Some of them carry no traffic yet; allowing all ten keeps your audio working when Bird adds media capacity. With **Direct audio** on for the trunk, the audio of incoming calls flows between your equipment and the network that delivered the call instead of these addresses, so your equipment has to accept audio from outside them. | Region | Media addresses | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Europe (`eu1`) | `40.180.165.35`, `52.17.18.149`, `52.31.151.186`, `52.48.123.9`, `52.213.113.60`, `52.214.183.204`, `54.76.111.244`, `54.77.249.231`, `54.155.191.8`, `54.246.111.12` | | United States (`us1`) | `32.189.119.37`, `35.162.12.185`, `35.165.86.198`, `35.167.33.5`, `35.167.126.199`, `44.227.8.88`, `44.253.239.124`, `52.35.78.221`, `100.21.152.215`, `100.22.136.208` | ## TLS on port 5061 The trunk edge presents a certificate from a public certificate authority for `trunk..sip.bird.com` and `*.trunk..sip.bird.com`, so it also covers your trunk's SIP domain. The certificate renews automatically every few months and its issuing authority can change, so have your equipment trust the public root certificates rather than pin the certificate or its issuer. ## Host names in SIP headers Within a call, Bird's `Contact` and `Record-Route` headers can name a single address through a host name such as `ip-52-30-150-219.trunk.eu1.sip.bird.com`, which resolves to that address. Each of these is one of the signalling addresses above, so an allow list built from the table already covers them. ## Troubleshooting | What you see | What to check | | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | Calls connect but there is no audio, or audio in one direction | The ten media addresses of your region on UDP ports `2500` to `32499` | | Your gateway never sees the calls Bird delivers | The inbound edge addresses of your region, on the port and transport set on the gateway | | Outgoing calls get `403 Forbidden` and leave no call record | The Request-URI host is your trunk's SIP domain, and your public address is in the trunk's **Allowed IP addresses** | [Voice troubleshooting](/docs/guides/voice/troubleshooting) covers the other symptoms. ## Next steps | Page | What it covers | | -------------------------------------------------------- | ---------------------------------------------------------- | | [Set up a SIP trunk](/docs/guides/voice/sip-trunk-setup) | A whole trunk setup in order, from creation to a test call | | [SIP trunks](/docs/guides/voice/sip-trunks) | Every trunk setting, authentication, and Digest | | [Placing calls](/docs/guides/voice/placing-calls) | What Bird expects on the `INVITE`, codecs and media | ## Related resources - [What is a voice API?](/explained/voice/what-is-a-voice-api) (answer) - [Voice](/voice-api) (product) - [Voice overview](/docs/guides/voice/overview) (docs) [Get an implementation brief](/learn/workspace?topic=voice)