Skip to main content
Bland runs a SIP edge in four regions. Each region has one endpoint, two signaling IPs, and four media IPs, and all of them are static. This page lists them, what to allow on your firewall, and the security requirements every connection must meet.

​
Connection endpoints

Connect to the endpoint closest to your infrastructure. Signaling and media use different IP addresses:
  • Signaling (calls you send to Bland): TLS on TCP port 5061 only. Each region has two signaling IPs, one per availability zone, behind its endpoint. Send SIP to the endpoint and it balances across both.
  • Media: SRTP on a separate set of four media IPs per region, over UDP ports 16384 to 32768.
  • Calls Bland places to you: when Bland sends an INVITE to your SBC, for example for a transfer or a warm transfer consult call, the TLS connection comes from one of the region’s media IPs.
Use the full SIP URI for your region, for example us2.sip.bland.ai:5061;transport=tls.

​
Firewall allow-list

For your region:
  • Allow outbound TLS on port 5061 from your SBC to the signaling IPs.
  • Allow UDP 16384 to 32768 to and from the media IPs, or audio will not flow.
  • Allow inbound SIP over TLS from all six IPs, signaling and media, and configure all six as trusted SIP peers on your SBC. A firewall rule alone is not enough: an SBC that doesn’t recognize the source as a peer rejects the INVITE with 403 Forbidden.
You can also copy the list from the Firewall section of the trunk’s Configure tab, or fetch it with GET /v1/sip/firewall-ips.
Allow-listing is mutual. Bland allow-lists your source IPs, and you allow-list Bland’s.
Match Bland by source IP, not by the Via or Contact header. On an INVITE that Bland sends, those headers carry a signaling IP while the connection itself comes from a media IP.

​
Requirements and security

​
Limits

  • Up to 100 numbers per attach request.
  • Each number has one inbound and one outbound configuration.
  • Test calls are limited to 10 per 15 minutes per organization.
  • One endpoint discovery runs per organization at a time.
  • Health checks probe outbound endpoints with SIP OPTIONS. An inbound-only configuration shows as “unchecked” because there is no outbound endpoint to probe.

​
Next steps

Set up a trunk

Create a trunk with the setup wizard.

Static IPs

Every IP Bland uses, beyond SIP.
Docs for agents: llms.txt