Skip to main content
If you need to whitelist Cekura’s IP addresses for infrastructure access, you should use the static IP addresses provided below.

​
Production Environment

The following IP is used for outbound requests from Cekura production services:
  • 32.184.152.201
All outbound traffic from Cekura production egresses through a single NAT gateway, so only this one IP needs to be whitelisted.

​
Use Cases

You should whitelist this IP when:
  • Providing presigned URLs for audio files or recordings
  • Exposing webhook endpoints with IP restrictions
  • Configuring firewall rules for API integrations
  • Setting up private API access

​
Region

This IP is designated for the US-WEST-2 region where Cekura production services are hosted.

​
SIP Calls

Cekura places SIP calls through Twilio, in Twilio’s North America Virginia (us1) region. The SIP INVITE and the call audio reach your SIP endpoint from Twilio’s network. If your SIP endpoint, SBC, or PBX sits behind a firewall, allow both of the following, or calls will fail to connect, or connect with no audio. Twilio publishes the authoritative list at Twilio SIP IP addresses. The same list applies to Cekura’s SIP calls, which use Twilio’s SIP Interface.

​
1. Global media IP range (RTP audio)

Twilio uses one global media range for every region and edge location. This is required: without it, calls connect and then have no audio, or audio in only one direction. Allow the full UDP port range, in both directions. Twilio picks a port from this range for each call, so allowing only some ports makes calls fail at random.

​
2. Signaling IP ranges (SIP)

Cekura’s calls come from Twilio’s Virginia region. Allow the Virginia range, and the Oregon range as well so calls keep working if Twilio fails over from Virginia to Oregon: Allow each whole /30 range, not a single address. Twilio can send a call from any IP in it. Twilio may change these ranges; see Twilio SIP IP addresses for the current list, including its other regions.

​
Checklist

  • Allow RTP to and from the global media range 168.86.128.0/18 on UDP ports 10000 – 60000.
  • Allow inbound SIP from the Twilio signaling ranges (Virginia required, Oregon recommended) on the port your endpoint listens on (5060 for UDP/TCP, 5061 for TLS).
  • If your endpoint is behind NAT, make sure the SDP it sends advertises its public IP and port, so Twilio’s audio can reach it.
  • Your endpoint must accept the G.711 codecs, μ-law (PCMU) or A-law (PCMA). DTMF is sent as RFC 2833 events.
  • For encrypted signaling, add ;transport=tls to your SIP endpoint (for example sip:agent@yourdomain.com;transport=tls). Twilio then connects on port 5061.
  • To restrict who can call your endpoint beyond IP rules, set a username and password on the agent’s SIP settings. Twilio answers your server’s digest authentication challenge with them.

​
Twilio references