Allowlist GDMS Outbound Traffic for Grandstream Phones
Review the FQDNs that should be allowlisted for outbound traffic from Grandstream phones so that they can connect to and utilize GDMS services.
Written by Val Campos
Updated at October 21st, 2026
Creating a dedicated VLAN for your different groups of IP devices, such as your Grandstream desk phones, is a great way to simplify managing and troubleshooting future issues with those phones. Usually, Grandstream desk phones will be assigned to a VOIP VLAN for this purpose.
Grandstream desk phones should also be added to a second, dedicated VLAN. Doing so allows you to set up firewall rules to allow the phones to send outbound traffic to the domains of important GDMS services that Grandstream phones need to use. A particularly important service that should be allowlisted for Grandstream devices is GDMS ACS.
NOTE: If the GDMS domains in this guide are not allowlisted, Grandstream phones will not be able to connect to GDMS for provisioning and some features offered by GDMS, such as remotely accessing phones, will be unavailable.
This issue can cause the following issues:
• The phones will show as registered in Stratus but offline in GDMS.
• Phones in GDMS appear as stuck on "provisioning".
• Phones appear as "orange/white" in GDMS.
• Phones do not appear in GDMS at all while showing as registered in Stratus.
• The web UI of phones cannot be remotely accessed through GDMS.
Note: Setting up VLANs on your network equipment will vary by manufacturer. It is recommended to reference resources provided by your equipment's manufacturer to see what features are available.
If you have any questions, you can contact your Installer or our Technical Support team for more information.
| Service | FQDN | Protocol | Ports | Purpose |
|---|---|---|---|---|
| GDMS ACS | acs.gdms.cloud acs-guest-a.gdms.cloud acsguesta.gdms.cloud acsguestb.gdms.cloud |
TCP | 80 443 |
Allows Grandstream devices to connect to GDMS cloud for zero‑touch provisioning (i.e., the TR‑069 option) and config changes. Last three domains are additional load-balancing servers. |
| Web Portal | www.gdms.cloud | TCP | 80 443 |
Facilitates config download from the GDMS web portal. |
| Remote Access to Web UI | *.e.gdms.cloud | TCP | 443 | Allows the web UI of phones to be remotely accessed via GDMS. |
| STUN Keepalive | stun1.gdms.cloud stun-guest-a.gdms.cloud stun-guest-b.gdms.cloud |
UDP | 3478 3479 |
Primary NAT traversal/keepalive server along with two additional load-balancing servers. |
| Firmware Download | us.download.gdms.cloud | TCP | 80 443 |
Allows download of firmware and speed testing from GDMS. |
| Device Tunnel / Relay | nat-e.gdms.cloud | TCP | 443 5061 26222 |
Relays information between devices and GDMS. |
| Syslog | syslog.gdms.cloud | TCP (TLS) | 6514 | Allows device logging by GDMS |
For example… A firewall address object for GDMS ACS would look like the following:
• Name: GDMS ACS
• Source: Grandstream VLAN
• Protocol: TCP
• Port: 80, 443
• Destination (FQDN Object): acs.gdms.cloud
• Action: Allow or Permit
• SSL/TLS Decryption: No-decrypt or Disabled