Repository navigation
NethVoice Proxy: configurable SIP and SIPS ports #8287
Description
Description
NethVoice Proxy accepts SIP from phones, gateways, trunks and the mobile app only on the fixed ports 5060 (UDP/TCP) and 5061 (TLS). The same values are written in several places: the proxy listeners and firewall rules, the gateway provisioning templates, the Tancredi phone templates, the NethVoice wizard and the mobile app provisioning of ctiapp-authproxy.
Some installations need different ports. For example, an on-premise AudioCodes Mediant that must be reached on UDP 5060, while phones keep registering through the proxy. Today the only option is a manual port forward that bypasses the proxy, as described in the proxy bypass guide. The guide also states that 5061 cannot be changed, because phones and the mobile app are provisioned with it.
The SIP and SIPS ports of the proxy become configurable. Every component that provisions devices reads them from the proxy, so devices follow the configured ports.
- NethVoice Proxy
- New optional
sip_portandsips_portoptions ofconfigure-module, default 5060 and 5061, in the Advanced section of the settings page. - The Kamailio listeners on the public (or private, behind NAT) address, the firewall ports and the local networks port forwarding follow them.
- The service network toward NethVoice keeps port 5060, and the local networks listeners keep 6060/6061.
- The ports are published in the service discovery records as
sip_portandsips_port.
- New optional
- NethVoice
- Reads the ports from the proxy into
NETHVOICE_PROXY_SIP_PORTandNETHVOICE_PROXY_SIPS_PORT(5060 and 5061 when the proxy does not publish them). - Gateway templates and the manual device configuration hints of the wizard use them.
- Tancredi receives them as the
sip_udp_portandsip_tls_portdefaults. - When the proxy settings change,
nethcti-serveris restarted too, souser/mereturns the new proxy FQDN and port.
- Reads the ports from the proxy into
- Tancredi: when
outbound_proxy_port_Nis not set, the phone templates usesip_udp_portandsip_tls_portinstead of fixed values. - nethcti-server:
user/mereturnsproxy_tls_portnext toproxy_fqdn. - ctiapp-authproxy: the mobile app gets
<proxy>fqdn:proxy_tls_port</proxy>, with 5061 when NethVoice does not send the port.
With the default ports nothing changes for existing installations, and the components can be updated in any order. When the ports are changed, the old ones are closed at once. Provisioned devices get the new ports at their next provisioning. Trunk providers and devices configured by hand must be updated manually.
Alternative solutions
- Port forward that bypasses the proxy: it works only for UDP 5060 toward one NethVoice instance. It is not visible in the UI and it cannot move the TLS port.
- A port setting per device type: more flexible, but it duplicates the setting in every provisioning path, with no single source of truth.
References
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
edospadoni commentedon Nov 3, 2026
Pull requests:
sip_port/sips_portoptions, settings UI, firewall, listeners and service discoverysip_udp_port/sip_tls_portas defaultsproxy_tls_portinuser/meproxy_tls_port, with 5061 as fallbackAfter merge, ns8-nethvoice needs the new Tancredi release (
TANCREDI_VERSION) and the nethcti-server commit (NETHCTI_SERVER_COMMIT).edospadoni commentedon Nov 3, 2026
How to test
Builds
ghcr.io/nethesis/nethvoice-proxy:pr-242.227-1.c2ee61e(feat: make the SIP and SIPS ports configurable nethesis/ns8-nethvoice-proxy#242)ghcr.io/nethesis/nethvoice:pr-1159.1570-1.fe719fe(feat: provision the SIP ports published by the proxy nethesis/ns8-nethvoice#1159, built with the nethcti-server commit of feat(user): add the proxy TLS port to user/me nethesis/nethcti-server#378)The Tancredi templates of the NethVoice build are still from Tancredi 1.11.0 (nethesis/tancredi#399 is not released yet). Phone provisioning can be tested with Snom and Gigaset P phones; the other brands follow the ports after the Tancredi release.
Install
Run on the cluster leader, replacing the instance names. Update the proxy first, then the NethVoice instances on the same node:
Checks
api-cli run module/nethvoice-proxy1/get-configurationreturns"sip_port": 5060, "sips_port": 5061.NETHVOICE_PROXY_SIP_PORT=5060andNETHVOICE_PROXY_SIPS_PORT=5061.api-cli run module/nethvoice-proxy1/configure-module --data "$(api-cli run module/nethvoice-proxy1/get-configuration | jq -c '.sip_port = 5070 | .sips_port = 5071')"<proxy>…:5071</proxy>after scanning a new QR code (or at the next provisioning, within one hour) and registers.Trunk providers and devices configured by hand must be updated manually when the ports change.