What are the IP and firewall settings for the sipgate app?

IP addresses, ports, and firewall settings for smooth operation of the sipgate app in the company network.

In most cases, the sipgate app will work without any further configuration of routers and firewalls. However, in corporate networks in particular, it may be necessary to make adjustments and configure allow rules. Below we have listed all gateways and ports to which the sipgate app requires a connection.

Regardless of this, the internet connection must meet the following requirements in order to enable uninterrupted telephony:

A bandwidth of at least 100-400 kbit/s in download/upload is required.
The response time should be faster than 270 ms, otherwise you will see an offline message in the client and cannot place calls.
The sipgate app uses QoS via prioritized packet transmission (DSCP 46) (Expedited Forwarding - EF)

For accounts on sipgate classic

Calling - call setup (without audio)

Below is an overview of domain + port + protocol used by the sipgate app for communication:

gateway.clinq.com + Port: 443 + TCP (call setup)
api.q.clinq.com + Port 443 + TCP (negotiate codecs etc. before call acceptance)
socket.clinq.com + Port 443 + TCP (CLINQ client↔Google server connection)
ws-eu.pusher.com + PORT 443 + TCP (CLINQ client↔Pusher server connection)
The Google IP ranges can be found here.

For a typical home router, domains should normally be allowed without additional configuration. However, in especially restrictive corporate networks that block many domains and IPs, it may be necessary to speak with the network admin and ask them to allow certain domains and ports.

Calling - call accepted with audio

IP range + UDP + port range 10,000 - 60,000 (audio)

When using the sipgate app, the IP address of the VoIP device (visible on the web under "My telephony") may differ from the IP address of the desktop on which the app is running. This is because SIP registration does not take place directly through the client on your desktop, but is carried out via the app's backend services.

The following fixed IP addresses can be used:

18.153.199.104
18.192.192.27
18.193.158.169
18.195.254.166
18.196.255.246
18.197.212.58
18.199.119.88
3.125.165.239
3.64.29.229
3.74.37.174
3.75.1.227
3.77.130.221
35.157.146.136
52.29.34.109

Login existing customers and new customers

sipgate app Firebase (all logins): 35.208.0.0 - 35.247.255.255
via Apple: www.apple.com + appleid.apple.com + Port 443 + TLS 1.2
via Microsoft: live.com + microsoftonline.com + microsoft.com + Port 443 + TLS 1.2

sipgate app updates existing customers and new customers

Allow Amazon AWS downloads s3-eu-central-1.amazonaws.com

CRM contacts existing customers and new customers

Integration platform (all contacts) integration.sipgate.cloud

Voice and signal encryption

Signals are encrypted via TLS, while voice encryption is done via SRTP.

sipgate.de App + Sophos Firewall

In connection with the Sophos Firewall, undesirable behavior such as connection drops or one-sided voice transmission can sometimes occur. The cause is often the way an additional module, the SIP Helper, works, which analyzes VoIP traffic in the firewall. To avoid disruptions, this module should be disabled as follows:

1. Disable SIP Helper

Connect to the firewall via SSH
Option 4. Device Console select
Display SIP module status: system system_modules show
Disable SIP module: system system_modules sip unload
If needed, re-enable the SIP module: system system_modules sip load

Important: After disabling the SIP Helper, the VoIP firewall rules must be configured correctly so that communication works smoothly.

2. Increase UDP session timeout

Connect to the firewall via SSH
Option 4. Device Console select
Show current value: show advanced-firewall
Set timeout value (e.g. 180 seconds): set advanced-firewall udp-timeout-stream 180

Note: Values between 30 and 3600 seconds are allowed.

3. Create a specific firewall rule for VoIP

Source Zone: LAN
Source Network: VoIP devices (e.g. IP phones or phone system)
Destination Zone: WAN
Destination Network: IP addresses or hostnames of the VoIP provider
Services: SIP (port 5060), RTP (e.g. ports 10000–20000)

The rule should be placed as high as possible in the policy order and logging should be enabled.

4. Enable Quality of Service (QoS) for VoIP

Go to System Services ➔ Traffic Shaping switch
Create a new policy, e.g. "VoIP Priority"
Policy settings:
- Policy Type: Guarantee
- Priority: High
- Bandwidth Usage: Real-Time
- Guaranteed Bandwidth: depending on codec and number of simultaneous calls
Assign Traffic Shaping Policy to the VoIP firewall rule

5. Monitoring & troubleshooting

Firewall logs (Log Viewer ➔ Firewall)
Live view (Diagnostics > Packet Capture)

sipgate.de App + SecurePoint Firewall

Sometimes the SIP Helper of the SecurePoint Firewall leads to undesirable behavior such as connection drops or one-sided voice transmission. Disabling the SIP Helper can help here.

Detailed information can be found on the manufacturer's help pages:

UTM/FAQ-VoIP