UniFi Talk Network & Firewall Requirements

On a UniFi Cloud Gateway, UniFi Talk works without additional firewall configuration for the majority of deployments. This page covers the few cases that do need attention, and how to keep a locked-down network from blocking calls.

UniFi Talk connects calls in one of two ways: the UniFi Talk Service (UniFi's calling service, available in the United States, Canada, and the UK) or a third-party SIP provider (the only option elsewhere). Either way, Talk is set up through unifi.ui.com, so the Console and the device you configure it from need internet access during setup. Adopting phones happens locally over your LAN.

Do you need to configure the firewall?

For most setups, no. Here's what each one requires:

• UniFi Talk Service — nothing. Behind a UniFi Cloud Gateway, Talk works without additional firewall configuration — whether Talk runs on the Cloud Gateway itself or on a Console (such as a Cloud Key+) behind it.
• Third-party SIP that registers — nothing. The trunk registers outbound to your carrier and refreshes that registration continuously, which holds the return path open. A standard stateful firewall then passes inbound calls automatically. (If your carrier uses more than one signaling server, see [Adding a Third-Party SIP Provider to UniFi Talk] — that case needs the carrier's servers allowed explicitly.)
• Third-party SIP that doesn't register (IP-authenticated trunks) — one step. Enable Static Signaling Port in your Talk settings, then add a port-forward for it in UniFi Network. Read Don't expose SIP signaling to the internet first.
• Networks that block all outbound traffic by default — contact support. If you run a default-deny firewall that drops outbound traffic unless it's explicitly allowed, Talk needs outbound access to UniFi and to your carrier. This is uncommon, and the exact destinations depend on your deployment and region, so support can provide the current list for your setup.

If you use a third-party SIP trunk

Static Signaling Port (for non-registering trunks)

IP-authenticated trunks don't register, so there's no outbound connection holding a return path open — the carrier's calls arrive as unsolicited inbound traffic. Enable Static Signaling Port in Talk and add a port-forward for it in UniFi Network. Only the UniFi Talk Service and registering trunks work without this — don't enable it unless your carrier requires it.

Don't expose SIP signaling to the internet

When you forward a port for a carrier, scope the rule to the carrier's IP addresses — never open it to the whole internet. A SIP port open to any source is constantly scanned and is a common target for toll fraud. (Talk's Static Signaling Port defaults to 6767, not 5060, so a generic "open 5060" rule wouldn't help anyway.)

One-way audio

If you have one-way audio on a third-party SIP trunk, enable symmetric RTP (sometimes called comedia) on your provider's trunk so it returns audio to the address it received audio from.

Disable SIP ALG on upstream routers

SIP ALG ("Application Layer Gateway", sometimes called SIP transformations or SIP helper) is a router feature that tries to rewrite SIP traffic as it passes through. In practice it almost always corrupts that traffic, producing symptoms like:

• calls that connect but have one-way or no audio,
• calls that drop after about 30 seconds, or
• phones that fail to register intermittently.

UniFi Cloud Gateways do not apply SIP ALG. But if your Console sits behind another router or ISP modem (a double-NAT setup), that upstream device may have SIP ALG enabled by default. Disable SIP ALG on that device — the setting name varies by manufacturer (look for "SIP ALG", "SIP Transformations", or "SIP Helper").

Behind CGNAT, double NAT, or Dual WAN

Double NAT (behind an ISP modem/router). If your Console's WAN shows a private IP address (for example 192.168.x.x or 10.x.x.x) instead of a public one, it's sitting behind another router doing its own NAT. What this affects depends on your setup:

• UniFi Talk Service: works with Advanced Call Routing enabled.
• Registering third-party trunk: works without changes — the trunk's registration holds the path open.
• Non-registering third-party trunk: forward the Static Signaling Port on both routers (the ISP device and the UniFi gateway). Alternatively, put the ISP device into bridge mode ("IP passthrough" or "modem mode") so the Console gets the public IP directly and only one forward is needed.

CGNAT (carrier-grade NAT). If your internet service places you behind CGNAT — common on cellular/5G, Starlink, and some fiber — your Console has no public IP of its own. With the UniFi Talk Service, enable Advanced Call Routing, which routes calls through UniFi's cloud instead of relying on a reachable public IP. Advanced Call Routing is a Talk Service feature — third-party SIP trunks can't use it. Behind CGNAT, a registering third-party trunk can still work (its continuous registration holds the path open), but a non-registering trunk needs a routable public IP that CGNAT can't provide — ask your ISP for one.

Dual WAN. With the UniFi Talk Service, enable Advanced Call Routing; with third-party SIP, use Failover mode rather than Load Balancing. Both keep a changing public IP from disrupting calls.

UniFi Talk phones on a separate VLAN

Isolating Talk phones on their own VLAN is good practice, but the phones themselves then need outbound access — a VLAN locked down too tightly is a common cause of phones that won't adopt or update. From the phone VLAN, allow:

• Reachability to the Console for adoption, management, and calls.
• The destinations in Talk phone network requirements below.

Confirm calls are working

1. In UniFi Talk, confirm your phones show as connected.
2. Place a test inbound call from an outside line — confirm the assigned phone rings.
3. Place a test outbound call to an external number.

Talk phone network requirements

Talk phones need access to these destinations, regardless of which network they're on: