In short: BT Cloud Voice firewall settings come down to a few rules: switch off SIP ALG on any non-BT router, allow outbound traffic to BT's Cloud Voice service (no inbound ports are needed), prioritise voice with quality of service, set the NAT refresh timer to the 300 seconds BT's guide asks for, and give phones reliable power, cabling and Wi-Fi.
Start with BT's LAN and Firewall Guide
BT publishes a LAN and Firewall Guide for BT Cloud Voice, and a separate one for BT Cloud Voice SIP. They list the exact destinations, protocols and ports your phones, apps and add-ons use. We do not repeat those lists here because BT updates them; get the current version from BT's LAN and firewall help page.
Many sites need no changes at all. BT says that with its Business Hub on default settings and no second firewall, BT Cloud Voice works without extra configuration, and that phones may register without any changes on other set-ups too. The settings below matter when you have your own router, a separate firewall, a managed network or an IT provider who locks things down. BT recommends talking to your firewall provider before changing anything, so you do not open up a security risk by mistake.
Make any changes before BT Cloud Voice is installed, and if an engineer is installing your phones, have your LAN or firewall provider available on the day. BT also asks you to reboot all related devices after any change.
Turn off SIP ALG
SIP ALG (application layer gateway) is a router feature that tries to help phone traffic through the firewall by rewriting it. With a hosted phone system it usually does the opposite. BT's guidance is that SIP ALG, sometimes called SIP transformations or a SIP-aware firewall, must be switched off.
Signs that SIP ALG is still on:
- Phones will not register on the service
- Incoming or internal calls fail
- Poor voice quality, or one-way audio
BT says SIP ALG is disabled on its Business Hub 5 and Business Smart Hubs, but that if a BT Business Hub is reset, SIP ALG is switched back on automatically, so check it again after any reset. BT's help article shows where the setting sits in the hub's advanced firewall settings. On a non-BT router you will need to find the setting yourself, or ask whoever supplied it. When you order over non-BT access, BT's connectivity check tells you whether SIP ALG is on.
If you still get one-way audio, BT's guide also suggests disabling any packet acceleration feature on the router.
Firewall rules: outbound only
BT Cloud Voice phones and apps start their connections from inside your network, out to BT's service. That shapes the firewall rules:
- No inbound ports need opening. BT says there should be no reason to open inbound ports on the firewall for BT Cloud Voice.
- Allow outbound traffic to the BT Cloud Voice destinations in BT's guide, for call signalling, call audio, phone configuration downloads, the apps, add-ons such as the reception console and CRM tools, the call recording portal and the network assessment tool.
- Allow DNS and time (NTP) from the phones. BT notes that some phones look up time servers after a factory reset, before they download their BT configuration.
- Set the NAT refresh (UDP timeout) to 300 seconds, as BT's guide asks. If it is not set correctly you can have problems making and receiving calls, or calls can cut off after five minutes.
- Do not add a STUN server. BT Cloud Voice has no STUN server integration and does not need one.
If your firewall inspects encrypted web traffic or filters by category, check that it is not blocking the BT Cloud Voice destinations, so the apps and portal work cleanly. Talk to whoever manages your firewall before changing rules, so a change for voice does not open up something else. Our colleagues at Forever Group can help if your firewall is part of a wider security review.
Quality of service and voice VLANs
Voice traffic needs to go first when the network is busy. BT's own business internet access prioritises SIP signalling and voice traffic; on a non-BT connection, check that your access provider does the same. Either way, BT asks for voice to take priority through the firewall and over any competing traffic in your LAN.
| Traffic | What it carries | BT's suggested marking |
|---|---|---|
| SIP signalling | Setting up, transferring and ending calls | DSCP AF31 |
| RTP media | The audio of the call itself | DSCP EF (46) |
Many organisations also put phones on their own voice VLAN, a separate virtual network on the same switches. That keeps call traffic away from busy PCs and makes quality of service easier to apply. If you use one, make sure phones on it can still get an address, reach DNS and get out to the internet, and test a phone on the VLAN before rolling it out across the building. We agree the VLAN plan with your IT provider during set-up.
Switches, PoE, cabling and Wi-Fi
- Power over Ethernet (PoE). BT Cloud Voice desk phones run on PoE or a separate power supply. A PoE switch avoids a power adapter on every desk. BT can supply LAN switches in several port counts, set up for quality of service with PoE on every port, and quote for cabling.
- Enough PoE budget. Check the switch can power every phone at once, including any expansion modules or conference phones.
- Cabling. BT asks for at least CAT5e structured cabling. Damaged patch leads and old cabling cause errors that sound like poor broadband.
- Daisy-chained PCs. If a PC plugs in through the phone, make sure the PC traffic is not starving the phone, and use quality of service on the switch port.
- Wi-Fi phones. BT recommends a good to excellent Wi-Fi signal where Wi-Fi desk phones will sit. Before you buy, check the signal strength with a mobile connected to the same Wi-Fi network.
- The right router port. BT's troubleshooting guide notes that on a BT Business Hub, phones or base stations must plug into one of the numbered Ethernet ports, not the red WAN port.
See BT Cloud Voice handsets for device options, and desk phones for PoE and Wi-Fi models.
How we help with your network
Forever Communications Limited, a BT Business Partner, reviews your router, firewall and switches as part of every BT Cloud Voice project. We run the network assessment with you, list the changes your IT provider needs to make, and test before go-live. If calls still sound poor afterwards, start with our call quality guide.
Contact us to book a pre-installation network review.
Why buy BT Cloud Voice from Forever Communications Limited
Forever Communications Limited is part of Forever Group and a BT Business Partner. We supply, set up and support BT Cloud Voice for UK businesses, schools, charities and public sector organisations, from a handful of users to multi-site teams.
- A named partner who plans your numbers, call flows, user feature packs and handsets with you
- Number porting managed for you, timed to avoid downtime
- Connectivity checked first, so call quality is right from day one, with BT business broadband and BTnet available if you need it
- Help with the digital switchover, including alarms, lifts, card terminals and other analogue lines
- Training and ongoing support for the apps, Microsoft Teams integration, moves, adds, changes and faults
BT Cloud Voice is a business service. We do not sell consumer or home phone products.
Want a BT Cloud Voice quote for your business?
Tell Forever Communications what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does BT Cloud Voice need any inbound firewall ports?
No. BT says there should be no reason to open inbound ports. Phones and apps connect outbound to BT's service, so you only need to allow the outbound destinations listed in BT's LAN and Firewall Guide.
Should SIP ALG be on or off for BT Cloud Voice?
Off. SIP ALG can stop phones registering, break incoming and internal calls and cause poor audio. BT's Business Hub 5 and Smart Hubs have it off, but resetting the hub switches it back on.
Why do my BT Cloud Voice calls drop after five minutes?
BT's guide says that if the router's NAT refresh (UDP timeout) is not set correctly, calls may disconnect after five minutes. Set it to 300 seconds and check SIP ALG is off.
What QoS settings does BT Cloud Voice use?
BT suggests marking SIP signalling as DSCP AF31 and call audio (RTP) as DSCP EF (46), and giving that traffic priority through your firewall and LAN.
Where can I find the BT Cloud Voice IP addresses and ports?
In BT's current LAN and Firewall Guide, linked from BT's help pages. We do not reproduce the list because BT updates it.