> This page is for Voice AI Platform.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.hams.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.hams.ai/_mcp/server.

# IPsec VPN

> Connect your firewall to Hams with an IPsec tunnel, and learn which traffic the tunnel carries.

An IPsec VPN is a private tunnel between your firewall and Hams. Use it to connect a PBX that has no public IP address. Use it also to keep SIP and media traffic off the internet.

> **Note**
>
> Hams support gives you the tunnel values. The values include the peer addresses, the encryption settings, the pre-shared key, and the hosts or subnets on each end. This page does not list them.

## Traffic in the tunnel

Route these SIP and media ports through the tunnel, in both directions.

| Traffic      | Protocol and port                                  |
| ------------ | -------------------------------------------------- |
| SIP          | UDP or TCP `5060`                                  |
| SIP over TLS | TCP `5061`                                         |
| Media (RTP)  | UDP, in the port range that Hams support gives you |

Limit the tunnel to these ports, between the Hams host and your PBX host.

## Bring the tunnel up

#### Ask Hams support for a tunnel

Send the public IP address of your firewall and the address of your PBX to Hams support. Hams support sends you the tunnel values over a secure channel.

#### Set up your side

Create the tunnel on your firewall with the values from Hams support. Add the hosts or subnets from Hams support as the traffic selectors. Open the SIP and media ports in both directions.

#### Wait for Hams support

Hams support sets up the other end of the tunnel. Hams support tells you when the tunnel is ready.

#### Check the tunnel

On your firewall, check that the tunnel is up.

#### Check SIP

Add the trunk in **Settings** › **Trunks** and turn on **Monitor connection (SIP OPTIONS keepalive)**. The **Connection** column shows **Online** when SIP reaches your PBX.

#### Test a call in each direction

Call one of your numbers. Then dial out from an agent. Audio in both directions shows that the media ports are open in the tunnel.

## Related

* [SIP connection](/platform/integration/sip)
* [Trunks](/cloud-call-center/settings/trunks)
* [SIP domains](/cloud-call-center/settings/sip-domains)