How to run VICIdial on Google Cloud

Google Cloud runs VICIdial on a Compute Engine VM the same way any other cloud does: a Linux machine, a fixed public address, and open media ports. GCP names things its own way. Security groups become VPC firewall rules, and you reserve a static IP instead of an Elastic IP. The Asterisk config underneath is identical to every other deployment.

Choose the machine type

Use an e2-standard or n2-standard machine with at least 4 vCPU for a small floor, and step up before agents outpace cores. Steer clear of the shared-core e2-micro and e2-small tiers for production; telephony hates the throttling. Real CPU keeps audio clean, especially when your Carrier pushes a Codec your agents do not use and Asterisk has to transcode every leg.

Reserve an external static IP

A default Compute Engine VM gets an ephemeral external IP that can change. Reserve a static external IP and assign it to the VM so the address holds across restarts. VICIdial has to sit on a fixed, routable address for SIP (Session Initiation Protocol) to register and for return media to find it. A SIP trunk keyed to your IP will drop the moment that address rotates. The public-IP requirement is the first thing to get right on any cloud.

VPC firewall rules

GCP firewalls live at the VPC network level, not on the instance. Create an ingress rule allowing UDP 5060 for SIP signaling, and a second allowing the RTP range UDP 10000-20000 for audio. Target the rules at the VM with a network tag rather than opening them for the whole network. Restrict the source ranges to your carrier and agent IPs; an open 5060 attracts SIP scanners fast. Both the SIP and RTP rules must exist, or the call connects and then goes silent.

flowchart LR
  Trunk[SIP carrier] --> VPC[VPC firewall rules]
  VPC -->|allow UDP 5060| VM[Compute Engine VM]
  VPC -->|allow UDP 10000-20000| VM
  VM --> PD[Persistent disk]
  VM --> Snap[Disk snapshot]

NAT and audio

Compute Engine maps the external IP to the VM one-to-one; the VM only sees its internal address on the interface. So set externip to your reserved external IP and put the subnet in localnet. This NAT traversal step makes Asterisk advertise the public IP in SDP instead of the internal one. Forget it and the carrier is told to send media to an unreachable internal address, which is the one-way-audio call everyone hits once. We break the fix down in the cloud NAT audio guide.

Persistent disk and backups

Keep VICIdial on a persistent disk and give recordings their own disk so storage scales separately. For backup, take a disk snapshot, which captures the volume like a Server snapshot anywhere else, and schedule one before changes. Snapshots are incremental but the first full one on a large recordings disk still takes minutes, so plan it, do not lean on it mid-shift.

What it actually costs in time

None of these GCP steps is hard, but they stack into a real chunk of work: build the VPS, harden it, install and patch VICIdial, wire the firewall, set up TLS, and test. The cloud fundamentals carry across every provider, which is the whole point of our VICIdial in the cloud guide. If you would rather not hand-roll it on Compute Engine, AWS, or anywhere else, see how the AWS route compares. We provision a hardened, Single tenant box in under 40 seconds, you keep root SSH and bring your own carrier, and pricing is right there when the DIY math stops adding up.