Configure Your Unifi Firewall for VoIP

Create a Smart Queue

A Smart Queue option is available with UniFi Security Gateway that prioritizes traffic and minimizes delays when the router/bandwidth becomes overloaded. Activating this option will prioritize all traffic coming in and out of Aircall over other applications traversing the network.

To activate this option…

1. Log into your UniFi controller.
2. Navigate to Settings → Networks.
   
3. In the Networks list, select the WAN network that your VoIP devices will use.
4. In the COMMON SETTINGS section, select Enable Smart Queues.
   

   ✔ Selecting Enable Smart Queues will show the Up Rate and Down Rate fields.

   

    
5. Click PRE-POPULATE to automatically have the Up Rate and Down Rate set to 80%.
6. Click the SAVE button.
   

   ✔ QoS should now be configured on your Security Gateway.

    

Open Ports

In order to make sure that traffic used by your VoIP devices is not blocked, your USG may need certain ports opened.

To do this…

1. Access your UniFi dashboard.
2. Navigate to Settings → Routing & Firewall → Firewall → LAN IN.
3. Click + Create a new rule
   
4. Set the settings for the new rule to:
   • Enabled - ON
   • Action - Accept
   • Protocol - TCP and UDP
5. In the ADVANCED section, leave the default settings unaltered.
6. In the SOURCE section, adjust the following settings:
   1. Source type - Address/Port Group
   2. Address Group - Create a new address group with these parameters:
      1. Name the new group VoIP.
      2. Set the Type to Address.
      3. In the Address boxes, type in this list of IP addresses:
         • 199.71.209.0/24
         • 24.227.249.0/25
         • 72.249.136.32/28
         • 206.123.122.32/27
         • 212.69.157.32/27
         • 40.143.31.64/27
      4. Click the SAVE button.
7. Click the SAVE button.
8. Port Group - Create a new port group with these parameters:
   
   1. Name the new group VoIP Port.
   2. Set the Type to Port.
   3. Add a list of the following ports and IP addresses:
      • Main Utilized Ports
        • 5060-5062 UDP - SIP
        • 20,000-40,000 UDP - RTP
        • 80, 443 TCP - HTTP/HTTPS
      • Portal Dynamic Updates
        • 8001 - TCP
      • Google's Firebase Cloud Messaging (FCM)
        • 443, 5228, 5229, 5230 - TCP
      • Apple's Push Notification Service (APNs)
        • 5223, 443, 2197 - TCP
      • Text To Speech Services - TCP and UDP
        • 54.149.243.27:8000
        • 35.175.185.150:8000
        • 54.149.243.27:3001
        • 35.175.185.150:3001
      • StratusMEETING - TCP and UDP
        • 54.188.133.147:3443
        • 3.130.158.184:3443
        • 35.183.150.146:3443
      • StratusWEB PHONE
        • 9002 - TCP - websockets
   4. Click the SAVE button.
9. In the DESTINATION section, adjust the following settings:
   • Destination Type -  Address/port group
   • Address group - VoIP
   • Port group - VoIP Port
10. Click the SAVE button.

UniFi Access Points and Switches

By default, The UniFi access points and switches will automatically map the DSCP value to a Wi-Fi Multimedia (WMM) priority. Voice is then automatically given highest priority on these devices, so no further changes are needed.