Firewall Configuration Guide -- Phoneware Edge

Phoneware Edge — Firewall Configuration Guide for IT Administrators

This page lists the hostnames, protocols, and ports required to allow Phoneware Edge voice service through your network firewall. All rules are outbound from your local network. No inbound rules are required.

Where IP addresses are not listed, allow rules should be configured by hostname (FQDN) rather than IP. Cloud-hosted services use dynamic or load-balanced IPs that change without notice — IP-based rules for these services will break intermittently.

Voice — SIP signaling

All SIP signaling from phones on your network travels to the Phoneware Edge core servers. Both servers should be allowed — core2 is the failover and phones will attempt it automatically if core1 is unreachable. These are Phoneware-operated servers with static IPs.

Hostname	IP address	Protocol	Ports	Direction
core1-phx.phoneware.zone Primary — Phoenix, AZ	132.226.76.53	TCP and UDP	5060, 5061	Outbound
core2-ord.phoneware.zone Backup — Chicago, IL	170.9.227.213	TCP and UDP	5060, 5061	Outbound

Voice — RTP media (audio)

Audio streams (RTP) travel on dynamically assigned UDP ports in the range 10000—65535. If your firewall is stateful and tracks SIP sessions, it may open media ports automatically — however, we strongly recommend disabling SIP ALG and allowing the UDP range explicitly. SIP ALG is a common cause of one-way audio and registration failures.

Hostname	IP address	Protocol	Port range	Direction
core1-phx.phoneware.zone	132.226.76.53	UDP	10000—65535	Outbound
core2-ord.phoneware.zone	170.9.227.213	UDP	10000—65535	Outbound

WebPhone — WebSocket signaling (WebRTC)

The Phoneware WebPhone is a browser-based WebRTC softphone. Unlike desk phones, it does not use SIP over UDP — instead it connects to the core servers using secure WebSocket (WSS) for signaling. The WebPhone will attempt connections on multiple ports and fall back automatically if a port is unreachable.

Port 443 is the primary connection path. Ports 8001, 9001, and 9002 are fallback WebSocket ports used when 443 is restricted or blocked by intermediate network devices. Environments with strict outbound filtering — such as university or corporate networks — must allow all three ports or the WebPhone may fail to connect or behave unreliably.

Hostname	IP address	Protocol	Ports	Direction
core1-phx.phoneware.zone Primary — Phoenix, AZ	132.226.76.53	TCP	443, 8001, 9001, 9002	Outbound
core2-ord.phoneware.zone Backup — Chicago, IL	170.9.227.213	TCP	443, 8001, 9001, 9002	Outbound

Device provisioning — Phoneware

Phones contact these servers at boot and periodically to receive their configuration. All three hostnames should be allowed by FQDN. prov.phoneware.zone is a dynamic hostname that resolves to one of the two endpoint servers depending on availability.

Hostname	Protocol	Ports	Direction
prov.phoneware.zone Dynamic — resolves to either endpoint below	TCP	80, 443	Outbound
endpoints1-phx.phoneware.zone Primary — Phoenix, AZ	TCP	80, 443	Outbound
endpoints2-ord.phoneware.zone Backup — Chicago, IL	TCP	80, 443	Outbound

Device management — Yealink YMCS / RPS

Required if deploying Yealink phones. These are Yealink-operated cloud services for remote provisioning (RPS) and ongoing device management (YMCS). IPs are hosted on cloud infrastructure and subject to change — allow by hostname.

Hostname	Protocol	Ports	Direction
rps.yealink.com	TCP	80, 443	Outbound
dm.yealink.com	TCP	80, 443	Outbound
dmtcp.yealink.com	TCP	80, 443	Outbound
us-ybfe.ymcs.yealink.com Alias: us.ymcs.yealink.com	TCP	80, 443	Outbound

Device management — Grandstream GDMS

Required if deploying Grandstream phones. GDMS uses multiple subdomains across its platform. Allow all subdomains under gdms.cloud if your firewall supports wildcard FQDN rules, or add each hostname individually. IPs are cloud-hosted and subject to change — allow by hostname.

Hostname	Protocol	Ports	Direction
gdms.cloud Main portal / device check-in	TCP	80, 443	Outbound
dm.gdms.cloud Device management	TCP	80, 443	Outbound
api.gdms.cloud API / provisioning	TCP	80, 443	Outbound
provision.gdms.cloud Configuration file delivery	TCP	80, 443	Outbound

Device management — Poly ZTP

Required if deploying Poly phones. Devices contact ztp.poly.com at boot for zero-touch provisioning. IPs are cloud-hosted and subject to change — allow by hostname.

Hostname	Protocol	Ports	Direction
ztp.poly.com Device zero-touch provisioning	TCP	80, 443	Outbound

Network time (NTP)

Phones synchronize their clocks using NTP. Accurate time is required for SIP registration and TLS certificate validation. The pool.ntp.org service rotates IPs continuously — allow by hostname or permit all outbound UDP 123 rather than filtering to specific IPs.

Hostname	Protocol	Port	Direction
pool.ntp.org	UDP	123	Outbound

DNS

Phones resolve all hostnames above using DNS. Standard outbound DNS must be permitted from phone IP addresses to your DNS resolver(s). If your environment uses split DNS or restricts outbound DNS, ensure phones can reach a resolver that handles public hostnames.

Destination	Protocol	Port	Direction
Your DNS resolver(s) Environment-specific	UDP and TCP	53	Outbound

Questions? Contact Phoneware support via phone or text at (602) 445-7777, support@phoneware.us, or via web chat at phoneware.us.