Server access: IPs, firewall, and SSH

Your VICIfast server is a real machine with a public IP address, an admin login, and a firewall in front of everything. This guide explains what you can touch yourself, what stays locked by design, and how the pieces fit together — no technical knowledge needed.

Your server’s public IP

1. Click Servers in the left sidebar.
2. Click your server’s name in the list.
3. Look at the very top of the page: next to the server name you see its IP address in brackets, for example (178.156.227.252).
4. Click the IP once to copy it.

This is the one address the outside world knows your server by. You need it when you point your own domain at the server, when a SIP carrier asks where calls come from, and when you connect over SSH (below). It is yours alone — one server, one IP.

The hidden admin URL

Still on your server’s page, find the VICIdial admin card ("User 6666 — human admin login"). This is where your dialer’s admin panel lives. Three things to notice:

• The URL is not a normal web address. It carries a random port number (like :25944) and a random word in the path. Guessing it is effectively impossible — that is on purpose.
• The username is 6666. Click Reveal next to Password to see the password, and use the copy icons to avoid typos.
• The Open VICIdial admin button at the top of the page opens this URL in a new tab.

The hidden URL only loads from whitelisted IP addresses. The first time you open your server’s page, VICIfast quietly whitelists the IP you are browsing from — you may see a small "Whitelisted your IP" notification. If the admin URL ever stops loading after your internet connection or office changes, your IP changed: open Manage Firewall and click Whitelist me to let your new IP in.

The firewall in one paragraph

Every VICIfast server runs default-deny: nothing reaches your dialer unless a rule allows it. Call audio and the agent self-serve portal are always open; everything else needs a whitelist rule. Rules come in three access profiles — Agent (web + phone signalling), Carrier (phone signalling only, for your SIP trunks), and Admin (everything, plus SSH and the hidden admin-URL port). The full walkthrough — rules, country blocking, agent self-serve, audit log — is in our article "Manage Firewall — every tab explained".

SSH: your own key, no passwords

SSH is the way to type commands directly on your server, and yes — you get full root access. What you never get is a root password: there isn’t one. Login works with keys only (a cryptographic key pair on your own computer), which is why there is nothing for us to email you and nothing for anyone to guess. Here is the whole setup, once per computer:

1. On your server’s page, click the SSH Access button (next to Open VICIdial admin).
2. Click Manage SSH keys.
3. On the SSH keys page, click Add public key.
4. Give the key a Name (optional) you will recognize, like "Office laptop".
5. Paste your public key into Public key — the contents of your .pub file. The Connect from your terminal card on the same page shows how to generate one. Never paste a private key.
6. Click Add and sync. The key lands on your server within a few seconds.
7. Connect from your terminal with: ssh root@your-server-IP (the exact command is shown on the page).

Two safety nets around SSH. First, the SSH port stays closed to the whole internet except IPs whitelisted with the Admin profile — your key alone is not enough, the firewall must let you in too. Second, the SSH Access dropdown also holds Connect to console (a terminal in your browser, for when SSH itself is stuck) and Replay SSH sessions (recordings of past browser-console sessions, keystroke by keystroke — handy for "who changed what").

What our platform IPs do

In Manage Firewall you may notice allow rules you never created and cannot delete. Those are the VICIfast platform’s own addresses, always allowed on SSH, the web port, and the hidden admin port. They exist so the platform can do its job: push your firewall rules to the box within seconds, sync your settings and recordings, renew your HTTPS certificate, run health checks, and let a support engineer in when you explicitly ask for help. They can never be removed by accident — which also means neither you nor we can ever be locked out of the box.

Good to know

• There is no root password and never will be — SSH is key-only. Anyone who "needs the root password" needs their public key added instead.
• Only the account owner (or a project member with the SSH capability) sees the SSH Access button. Agents never need it — they reach the dialer through the agent portal, not SSH.
• Your IP and your key are two separate locks. New office IP? Whitelist me in Manage Firewall. New laptop? Add its public key on the SSH keys page. Both take seconds.
• Removing a key cuts that computer off at the next sync. If you remove your last key by mistake, Connect to console still gets you in from the browser.
• The hidden admin URL is a strong second lock, not a secret to rely on alone — treat it like a password and share it only with people who administer the dialer.
• The firewall is IPv4-only. If your connection is IPv6-only, whitelist rules will not match you — the agent portal tells affected users to disable IPv6 and retry.