We’re integrating Retell with our telephony provider via elastic SIP trunking (custom telephony). We’re based in the UAE, so we’ve excluded the US-specific blocks (143.223.88.0/21 and 161.115.160.0/19) and are only whitelisting the all-regions block 18.98.16.120/30. The provider’s network team is configuring firewall whitelisting and needs the following confirmed please:
Does Retell use the same IP range for RTP media as for SIP signaling (18.98.16.120/30), or is RTP sent from a separate range? If separate, where can we find the RTP IP blocks? I couldn’t find them documented anywhere, so I’m not sure they are publicly provided.
What UDP port range does Retell use for RTP media?
Please confirm the above applies to both inbound (provider → Retell) and outbound (Retell → provider) call flows, and that for UAE routing the 18.98.16.120/30 block alone is sufficient.
Please do not exclude the US-labeled blocks, even for UAE routing. The “certain US traffic” label describes where traffic often originates, not a guaranteed regional pin — Retell does not currently offer per-region or per-workspace egress-IP pinning, so calls for a UAE tenant can still egress from those ranges. Whitelisting only 18.98.16.120/30 will cause intermittent SIP rejects and/or one-way audio when a call happens to egress from another block.
RTP UDP port range: Retell does not publish a fixed RTP port range on its side. On your provider’s side, we recommend leaving the standard RTP ephemeral UDP range (10000–60000) open toward the Retell CIDRs above; narrower ranges are not supported/guaranteed.
Direction: Yes, the same four CIDRs apply to both inbound (your provider → Retell) and outbound (Retell → your provider) — allowlist bidirectionally on your SBC/firewall for both SIP and RTP.
Transport: TCP is recommended for SIP signaling to avoid MTU/fragmentation issues on international paths sip:sip.retellai.com;transport=tcp).
Thanks for the detailed answer, very helpful, especially confirming SIP and RTP share the same ranges.
One blocker remains: our telephony provider’s security team refused to whitelist the US-labeled blocks. Their concern is that 143.223.88.0/21 and 161.115.160.0/19 together are around 10k IPs, which they consider too broad for security reasons, and they asked for specific IPs instead.
Since the whitelisting on their side has to be IP based, is there any way to make this work while sticking to IP addresses? For example a smaller set of specific IPs we can share with them instead of the full ranges?
Front Retell with an SBC in your own network. If the security team truly can’t accept the CIDRs on their carrier edge, you can deploy an SBC (or a small SIP proxy) inside your trusted zone that:
Terminates traffic from the four Retell CIDRs on its public interface, and
Relays to your telephony provider from a single fixed internal IP that they can allowlist.
That shifts the CIDR allowlist to the SBC, which you control, and gives your provider the single-IP posture they want.