Hello VAPI Support team, We’ve allowlisted the VAPI public IPs you provided (44.229.228.186 and 44.238.177.138) and opened the following on our firewall for inbound/outbound traffic to those IPs: - SIP signaling: UDP 5060 - Media (RTP / SRTP): UDP 10000–60000 Despite this, we are failing to receive any media packets on live calls — SIP signaling (INVITE → 200 OK → ACK) completes fine, but no RTP/SRTP packets arrive at our dialer server. Packet captures show SDP negotiation completes and the ACK is sent from our Asterisk instance, but media never shows up from the allowlisted VAPI IP addresses. We previously reviewed support tickets that referenced Jambonz in your stack. We operate in a highly restricted environment and cannot open broad or wildcard internet ranges — we need explicit IP addresses/CIDR blocks and exact port ranges that VAPI (or any upstream media infrastructure you use) will originate media from so we can whitelist them on our firewall and security groups. Please provide the following as a matter of urgency so we can restore media (audio): - Canonical list of public IP addresses / CIDR ranges that VAPI will use to send RTP/SRTP (media). If media may originate from additional pools (SBCs, media servers, CDNs), please enumerate them all. - Confirmation whether media will ever originate from IPs other than the signaling IPs (44.229.228.186, 44.238.177.138). If yes, provide the full list. Why this matters for us - We operate in a highly restricted, allowlist-only environment. Opening broad port/IP ranges is unacceptable for us. We require exact IPs/CIDR blocks + port ranges to ensure both security and call media functionality. Best regards, Amin Rane

Hi there, Thank you for your message. Our team is currently out of the office. We operate Monday through Friday, from 9:00 AM to 8:00 PM Pacific Standard Time (PST). We’ll get back to you as soon as possible during our normal business hours. If your message is urgent, please mark it accordingly or include “URGENT” in the subject line, and we’ll do our best to respond promptly. Warm regards, Vapi Customer Support Team

@Amin Rane The media (RTP/SRTP) that returns from VAPI may return from other IP addresses, not the ones listed.

Thanks @Nir Simionovich (CEO@Cloudonix) for your response. I have limited knowledge in networking, so I’m not sure how to handle media flowing from multiple/unlisted IPs in such a restricted environment. Has anyone here run into this issue before and found a workable solution? Any guidance would be really helpful

Technically speaking, media (RTP/STRP) is completely dynamic all over the internet, and will use dynamic ports for each call that is made. Normally, RTP/SRTP ports are using 10,000 to 30,000 with dynamic allocation. If you are using BYO SIP trunking, you should simply enable inbound traffic to these ports, over UDP - and hope that your PBX is smart enough to open/close the releveant UDP ports as required.

Thanks @Nir Simionovich (CEO@Cloudonix) for the clarification

I believe you can do that, but i believe thats a pointless exercise. I would simply use and SBC in your network DMZ, and will provide you with the pin-pointing you need. Feel free to DM me and I'll explain in more detail.