Documentation

Connect 3CX to Open Voice Shield

Add a Generic SIP Trunk (IP Based) in 3CX pointing at sip.ovs.telecomsxchange.com port 5060, whitelist your PBX's public IP on the Network page, and select the new trunk as the first route of an outbound rule: no registration, no credentials, G.711 first. The verdict appears after hang-up.

Before you start#

• An Open Voice Shield account. Signup is self-serve and starts you with US$5 of credit.
• The public IP address your 3CX sends SIP from: the address after NAT for an on-premise install, or the instance's public IP if 3CX hosts it or it runs in a cloud.
• A destination, the carrier your 3CX already sends calls to, by IP. We relay each accepted call on to it.
• Firewall: UDP or TCP 5060 to the ingress, and UDP 30000–40000 open in both directions for RTP. See the firewall rules.

Step 1: whitelist your PBX's IP#

Open the Network page in the portal and add the public address your 3CX sends from as a CIDR entry (a single host is a /32). The whitelist is the authentication: there is no SIP account and no password, and an INVITE from any other address is answered 403.

Step 2: add the trunk#

In the 3CX admin console go to Admin > Voice & Chat and select Add Trunk. Pick the generic template and fill in the fields below. Everything not listed keeps its default.

Field names from the 3CX V20 administration manual and VoIP Provider Checker guide. Older versions place some of them under different tabs.

• G.711 first matters: a call that negotiates a codec we do not decode is relayed but produces no transcript and no verdict.
• The ingress does not take TLS or SRTP: encrypted media cannot be recorded. If your trunk's Options tab offers SRTP, leave it off.
• 3CX keeps the audio on the PBX by default, so the media takes the same path as the signalling. Do not enable any option that sends media straight from the phones.
• The trunk shows no registration status, because nothing registers. That is expected for an IP-based trunk.

Step 3: send calls through the trunk#

Go to Admin > Outbound Rules and add a rule, or edit the one your calls use today. Set Route 1 to the new trunk and Route 2 to the trunk the calls used before. Keep the same strip and prepend values on both routes, so the number we receive is the number your carrier expects.

Rule name                          Via Open Voice Shield
Calls to numbers starting with     (your external-call prefix, or empty)
Calls from extension(s)            (empty: everyone)
Route 1                            Open Voice Shield    strip / prepend as before
Route 2                            your existing trunk  strip / prepend as before

The dialled number and caller ID pass through unchanged, and the call leaves us to your destination. If we answer 403 or are unreachable, 3CX moves on to route 2, so a mistake on our side never stops a call.

Or send a sample#

You do not have to move all your traffic. Sampling is a supported pattern. 3CX outbound rules cannot pick calls at random, so choose them by who calls or by what they dial, and place the rule above your existing one:

• By team: fill in Calls from extension(s) or the group field with, for example, your sales or support team.
• By destination: set Calls to numbers starting with to the country or range you want watched, such as international calls only.

Inbound calls#

Calls to your DIDs can take the same hop. Ask your carrier to send them to sip.ovs.telecomsxchange.com port 5060, whitelist the carrier's signalling addresses on the Network page, and add a prefix rule for your DID range whose destination is your 3CX's public address. We relay those calls from the ingress host, so 3CX matches them to the trunk from Step 2. Add the DIDs on its DID Numbers tab and route them as usual. Allow the ingress address in your 3CX firewall settings and in any network firewall in front of the PBX.

Step 4: place a test call#

Dial a real number from an extension the rule covers and talk on both legs for at least 30 seconds. A leg that never speaks produces a one-sided transcript. After hang-up the call appears in Calls in the console with its recording, per-channel transcript and verdict, usually within a minute.

• No call in the console, but the call connected? 3CX fell back to route 2. Check the 3CX call log: we most likely answered 403 because the source address is not whitelisted.
• One-way audio? A firewall rule on UDP 30000–40000, not a signalling problem.
• A recording but no verdict? The call negotiated a codec we do not decode (G.711, G.722, G.729 and G.723.1 are supported): check the codec order on the trunk's Options tab.

Anything else: Troubleshooting lists every rejection code and the check that clears it.

Frequently asked questions#

Ready to try it? Create an account. Signup is self-serve and comes with US$5 of credit, enough to analyze your first test calls.