Whitelisting IP Addresses and Ports for VanillaSoft Services

Allow the following IPs/ranges to ensure core VanillaSoft services work as expected:

• 23.249.208.0/20
• 23.251.156.253
• 23.251.158.66
• 23.251.224.0/19
• 34.30.31.128
• 34.36.86.221
• 34.54.149.42
• 34.58.92.217
• 34.70.219.215
• 34.85.161.225
• 34.85.163.100
• 34.85.195.195
• 34.85.227.217
• 34.85.240.119
• 34.110.243.255
• 34.132.14.188
• 34.133.142.170
• 34.133.222.22
• 34.150.147.253
• 34.160.11.251
• 34.170.24.243
• 35.186.163.5
• 35.186.186.0
• 35.186.188.38
• 35.192.127.34
• 35.193.117.228
• 35.194.71.131
• 35.194.85.204
• 35.194.86.78
• 35.199.8.57
• 35.199.33.15
• 35.202.40.161
• 35.202.238.243
• 35.223.82.228
• 35.223.230.185
• 35.224.124.87
• 35.224.199.87
• 35.225.158.213
• 35.225.238.124
• 35.227.253.253
• 35.227.254.120
• 35.230.175.155
• 35.230.177.29
• 35.230.183.196
• 35.232.107.96
• 35.239.26.134
• 35.245.4.117
• 35.245.213.62
• 52.82.172.0/22
• 54.240.0.0/18
• 54.240.64.0/19
• 54.240.96.0/19
• 69.169.224.0/20
• 74.125.0.0/16
• 76.223.128.0/19
• 76.223.176.0/20
• 173.194.0.0/16
• 199.127.232.0/22
• 199.255.192.0/22
• 209.85.128.0/17
• 216.58.192.0/19
• 216.239.32.0/19

Using VanillaSoft VoIP (VS Connect)? Be sure to expand the section below for required ports, IPs, and network settings.

To ensure reliable calling with VanillaSoft VoIP (VS Connect), your network must allow the signaling and media traffic listed below. Share this guide with your IT/network team to configure your firewall, router, and switch settings.

Required Ports

Open the following ports outbound and allow return traffic (UDP/TCP as indicated):

IP Addresses to Whitelist

Permit outbound traffic to the following VanillaSoft VoIP service IPs and ranges:

• 40.78.10.175
• 52.183.45.217
• 52.250.216.127
• 69.9.45.128/25
• 168.151.26.0/24
• 198.38.7.0/24
• 198.204.63.15
• 173.244.45.15
• 207.99.114.0/24
• 216.93.246.0/24

Tip: If your environment restricts egress by destination IP, add the ranges above. If policy allows, permitting by domain and required ports is often simpler.

Domain Name Servers to Whitelist

Some VoIP services require domain lookups to function properly. Ensure the following domains are accessible through your firewall or proxy:

• .google.com
• gsbc.ha10.sbcdax.com
• gsbc.ha6.sbcdax.com
• gsbc.udp.ha2.sbcdax.com
• secure-east.softphone.com
• secure-west.counterpath.com
• secure.counterpath.com

Recommended Network Configuration

• Use wired (Ethernet) where possible. Wi-Fi can introduce jitter, packet loss, and QoS issues.
• Separate voice and data. If supported, place phones/softphones on a dedicated VLAN and apply QoS to prioritize RTP.
• Stable bandwidth. Ensure upstream/downstream capacity with low latency and minimal packet loss.

Unsupported Devices

• Load balancers that route VoIP traffic concurrently across multiple WAN links
• WAN accelerators / WAN acceleration

Device Configurations (disable these on routers, firewalls, and switches):

• SIP ALG (Application Layer Gateway)
• Deep Packet Inspection (DPI) applied to VoIP
• Stateful Packet Inspection (SPI) rules that alter SIP/RTP
• SIP Transformation / SIP Helpers
• Power-saving “Green Ethernet” features

Alternate Configuration (Bypass Firewall)

If you prefer not to change your main firewall, an effective alternative is to route VanillaSoft VoIP on a dedicated router (separate from your primary data network). This isolates voice traffic and simplifies allow-listing and QoS.

High-level layout:

• Primary internet modem/router continues to serve your data LAN.
• A separate router handles the voice LAN and connects directly to the internet modem/router.
• Phones/softphones connect to the voice LAN switch; the voice router permits the ports and ranges listed above.

Need help? Your IT or network provider can implement the changes above. If call quality issues persist after configuration, capture the date/time and call examples and share them with VanillaSoft Support so we can assist with next steps.

Some Vanillasoft services rely on Google infrastructure (e.g., APIs, mail transport, and cloud services). Since Google updates these ranges frequently, we recommend you reference the following lists, published directly by Google, to add to your firewall:

• goog.json - Google-wide services (Gmail, APIs, etc.)
• cloud.json - Google Cloud (Compute Engine, Cloud Run, Load Balancers, etc.)

Source: Google IP Address Ranges

How to use:

• Prefer referencing the JSON URLs above as “URL objects” in your firewall so updates are automatic.
• Avoid duplicates: you may already allow common Google ranges listed in “General VanillaSoft IP Addresses” (e.g., 74.125.0.0/16, 173.194.0.0/16, 209.85.128.0/17, 216.58.192.0/19, 216.239.32.0/19).
• If policy requires static entries, export the current prefixes from the JSON files and review them monthly.

Note: Both IPv4 and IPv6 prefixes are included in the JSON files. Only add what your environment needs.

For customers using the HubSpot integration, allow the following HubSpot infrastructure ranges:

• 23.249.208.0/20
• 23.251.224.0/19
• 52.82.172.0/22
• 54.240.0.0/18
• 54.240.64.0/19
• 54.240.96.0/19
• 69.169.224.0/20
• 76.223.128.0/19
• 76.223.176.0/20
• 199.127.232.0/22
• 199.255.192.0/22

Note: HubSpot’s IP ranges can change. Keep your internal allowlist in sync with your HubSpot account documentation.