Telecoms glossary • F
Firewall
The device that decides what reaches your network. On a voice site it is also the most common reason a call connects and carries no sound.
What is a firewall?in VoIP and business telephony
1. A firewall is a network security control that inspects traffic entering and leaving a network and permits or blocks it against a set of rules. Those rules test source and destination address, port number and protocol, and on a business network the firewall sits between the internal LAN and the internet as the boundary everything crosses.
2. For voice it has a second job it is rarely configured for. Signalling and audio travel on different ports, so a rule set that lets a handset register successfully can still discard every packet of the conversation.
How a firewall decides
Every packet attempting to cross the boundary is checked against an ordered rule set and then allowed, denied or silently dropped. The decision is made on source and destination IP address, port number and protocol, and it happens in real time for every connection attempt.
A stateful firewall goes further and tracks conversations rather than individual packets. Once your handset has opened an outbound connection, the return traffic on that connection is recognised as belonging to it and admitted without a separate inbound rule. That behaviour is what makes most VoIP work at all on a default configuration, and it is also why voice faults are so often intermittent: the firewall’s memory of a conversation expires, and a stream that was flowing stops.
Firewalls log what they allowed and what they refused. On a voice fault that log is the fastest route to an answer, and it is the first thing worth asking an IT provider to export before anyone starts changing settings.
The port reality for voice
Voice is unusual in splitting itself across two channels. SIP sets the call up on a well-known port; RTP then carries the audio on a dynamically chosen port in a range. Both have to pass.
- SIP signalling
- UDP 5060 and TCP 5060, with 5061 used for TLS-encrypted signalling. This is the port that has to be open for a phone to register and for a call to ring. It is also the port that gets scanned constantly from the internet.
- RTP media
- A UDP range, chosen by the platform rather than by a standard. 3CX defaults to 9000 to 10999; other systems commonly use 10000 to 20000. Get the exact range from your provider rather than assuming, because this is the rule that is usually missing.
- Provisioning and portals
- TCP 443 for HTTPS, used for configuration, presence and firmware. Rarely the problem, occasionally the reason a new handset never picks up its settings.
Why a call can register perfectly and still be silent
Because the two channels are independent, the symptom tells you which one failed. Registration succeeding while audio is missing in one direction is a media path problem, and it is either a firewall rule or NAT. It is almost never the provider, and it will not be fixed by adding bandwidth.
Then there is SIP ALG. An application layer gateway is a router feature that rewrites the addresses inside SIP messages, intending to help traffic cross NAT. In practice it is implemented badly on most consumer and small-business routers, and it causes incoming calls to fail, phones to unregister themselves, and calls to connect to dead air. 3CX’s own guidance is to use a router without a SIP helper, or one on which the feature can be switched off. If you take one instruction from this entry, that is it.
Types of firewall, and which one a voice site needs
The taxonomy matters less than the capability. What a voice site actually needs is a device you can write explicit UDP rules on, that can be told not to touch SIP, and that logs what it drops.
| Type | What it does | Fit for a voice site |
|---|---|---|
| Packet filtering | Checks each packet’s addresses, ports and protocol against static rules, with no memory between packets. | Workable but blunt. Every return path needs an explicit rule. |
| Stateful inspection | Tracks active connections and judges packets in the context of the conversation they belong to. | The practical minimum, and what most business routers already do. |
| Next generation | Adds deep packet inspection, application awareness, intrusion prevention and threat feeds. | Best fit where security matters, provided SIP inspection can be disabled. |
| Proxy | Terminates the connection and inspects at the application layer before forwarding it. | Useful for web traffic. Adds delay that voice does not tolerate well. |
Deployment is a separate axis. A hardware appliance at the perimeter protects everything behind it and is the norm in an office. Software firewalls on individual machines protect that machine only, and are what a softphone on a laptop has to get past. Cloud-delivered firewalling suits a workforce with no single perimeter to defend.
Telling a firewall fault from a line fault
Audio in one direction only, or phones that register and then drop, is the firewall or NAT. Choppy audio in both directions is packet loss. A delay that has both parties talking over each other is latency. Establishing which of the three you have takes two minutes and saves a support call that opens with someone asking you to reboot the router.
The security half is real too. An internet-facing phone system is scanned within hours of going live, and a compromised extension is used to place expensive international calls, usually over a weekend. Restrict international dialling to the extensions that need it, set a spend limit with your provider, ask for alerting on unusual call patterns, and confine SIP access to the provider’s published address ranges rather than leaving 5060 open to the world.
About this entry
Definitions are written for South African business buyers and checked against primary sources – provider documentation, standards bodies and ICASA – not vendor marketing. Reviews are independent and sponsors are always disclosed. Read our editorial policy and scoring methodology.
Spotted something out of date, or think we have this wrong? Tell the editors and we will re-check it.