VICIfast Firewall vs the ViciBox Dynamic Portal

VICIfast Firewall vs the ViciBox Dynamic Portal: which should you use?

Keep the Dynamic Portal if you run your own ViciBox server, you are comfortable on the command line, and all you need is for agents to whitelist themselves. It is free, it is already on the box, and it works. Use the VICIfast Firewall if you want to run the whole firewall from a web dashboard - per-person access, rules that expire on their own, country rules, automatic carrier rules and a portal on your own domain - without editing config files over SSH.

Both solve the same everyday problem. A VICIdial server should only answer the people who work on it, but home and mobile agents get a new IP address whenever their connection changes. Both products let the agent fix that themselves, by signing in with the VICIdial username and password they already have.

Quick summary

ViciBox details are from the ViciBox 11.0 and 12.0 documentation at docs.vicibox.com, checked September 2026. VICIfast details describe the firewall as it runs today.

What the Dynamic Portal actually is

The ViciBox documentation describes the Dynamic Portal as a way for remote and work-from-home agents to authenticate on a separate, standalone web page, outside VICIdial's normal login, that "restricts how fast authentication attempts can be made". The page is at https://your.server.com:446/valid8.php, with a plain HTTP version on port 81, and agents sign in with their normal VICIdial user and password.

When the login succeeds, the agent's current address goes into an ipset called dynamiclist, which feeds firewalld's External zone - the zone ViciBox fills with the services VICIdial agents need. A cron job, /usr/bin/VB-firewall --white --dynamic --quiet, rebuilds the allowed lists every minute. The documentation notes that the White List "is only compatible with the Dynamic Portal": they are designed to be used together.

Around it, the ViciBox firewall has three zones - Trusted for your LAN, Public for the open internet with only call audio and a few base services, and External for allowed addresses - plus two blocking mechanisms: the VoIP Black List from voipbl.org, which is the default, and a static ViciBlack list you maintain in VICIdial admin.

Where the Dynamic Portal wins

• It is free and already there. If you installed ViciBox, you have it. Nothing to buy and nothing to migrate.
• Its VoIPBL list refreshes more often. ViciBox pulls VoIPBL every 6 hours. VICIfast rebuilds its combined list once a day.
• You own every moving part. The config files, the cron jobs and the firewalld zones are yours to change however you like, on your own hardware.
• It has been around a long time. The portal first shipped as an add-on in ViciBox 8.1 and is documented through ViciBox 12.0, so plenty of people have run it and written about it.

Where the VICIfast Firewall wins

• It is run from a dashboard, not a shell. Rules, settings, countries and the agent portal are all managed from the server's page in the VICIfast dashboard, by you and the members you give the firewall permission. No SSH, no config files, no cron.
• Per-person access. Every allowed address gets a profile: Agent (the web pages on 443, SIP on 5060 and 5070, the webphone on 8089), Carrier (SIP on 5060 only) or Admin (everything an agent gets, plus SSH and the server's private admin port).
• Rules end on their own. Each rule is one address, with a reason, and it is permanent or ends after 24 hours, 48 hours, 72 hours or 7 days. You pick how long agent self-serve access lasts, from the same choices.
• Four blocklist sources. VoIPBL plus FireHOL Level 1 and Spamhaus DROP/EDROP - 104,872 entries in September 2026 - rebuilt nightly, and only a complete rebuild ships.
• Countries. Block up to 250 countries, or open the agent screen to a country only during the hours you choose.
• Carriers are handled for you. The platform reads the carriers configured on the dialer every 5 minutes and allows their addresses automatically.
• A portal with guard rails. A CAPTCHA after 5 failures, a lockout at 100 failures an hour, optional TOTP, an email to you when one agent keeps failing, and a 7-day log of every attempt with its city, country and network.
• Your brand on it. On plans that include your own domain the portal moves to firewall.your-domain.com, and with whitelabelling it carries no VICIfast branding at all.
• An audit trail. Every rule and setting change is logged with who made it.

When an agent's IP changes

On ViciBox, the agent goes back to the portal on port 446 and signs in again, and the next one-minute cron run lets them in.

On VICIfast, the agent opens the portal link and signs in with the same VICIdial login. The new address is pushed to the server straight away and usually works within seconds, then the portal forwards them to the agent screen. Agents using the VICIfast mobile app skip the portal entirely: signing in to the app allows the phone, and the rule follows it when its address changes. For floors where addresses change all day - mobile data, shared networks - a scheduled country allow can open the agent screen and webphone to a whole country during working hours, with SIP and SSH still closed.

Blocklists

ViciBox's default firewall mode is the VoIP Black List: a community list from voipbl.org of 55,000+ known SIP-abuser addresses, according to its documentation, refreshed every 6 hours. You can add your own addresses to the ViciBlack list in VICIdial admin, checked every minute.

VICIfast builds one list every night at 02:00 UTC from four sources - VoIPBL (about 100,000 entries), FireHOL Level 1 (about 4,700) and Spamhaus DROP and EDROP (about 1,700) - and sends it to every server with the blocklist switched on. If a source fails to download, servers keep the previous complete list rather than a partial one. The list applies to the SIP and webphone ports, and allow rules are checked before it, so an address you allowed is never blocked by it. Your own block rules drop an address on every VICIdial, SIP and SSH port.

Countries

On VICIfast you can block up to 250 countries on every VICIdial, SIP and SSH port - call audio is never blocked. The ranges come from ipdeny.com, refresh on the 1st of each month, and are fetched as soon as you add a country. The reverse - a scheduled country allow - opens only the agent screen (443) and webphone (8089) to up to 5 countries, on the days and hours you set in your own time zone, after you tick a warning. Your block rules and blocked countries still win.

Carriers

VICIfast allows your SIP providers without you listing them: every 5 minutes it reads the carriers configured on the dialer, resolves their hostnames and allows the addresses with the Carrier profile, SIP on UDP 5060 only. When a hostname starts pointing somewhere new, the old address is removed. Trunks added from the VICIfast marketplace have their published address lists kept current automatically.

Branding and certificates

The Dynamic Portal is served from the ViciBox server itself, at its own hostname on port 446. By default ViciBox's vicibox-ssl tooling handles the certificate; if you manage certificates yourself, the documentation has you point /etc/apache2/vhosts.d/dynportal-ssl.conf at your certificate and key. Moving the portal off port 446 means editing that file and /etc/apache2/listen.conf, then the firewalld rule.

The VICIfast portal runs on the platform, not on your dialer, so certificates are handled for you. On plans that include your own domain it moves to firewall.your-domain.com with one CNAME and one TXT record, and every server under that domain uses it. A backup portal on each server's port 446 keeps agents working if the main portal cannot be reached.

Managing it day to day

On ViciBox, the firewall is configured from a terminal: the menu-driven vicibox-firewall tool switches modes such as the White List, /usr/bin/VB-firewall does the work on a cron schedule, static entries live in /etc/firewalld/whitelist.conf, and the ViciWhite and ViciBlack lists are VICIdial IP Lists, with ViciWhite switched on under Admin, Settings first.

On VICIfast, the firewall is a set of tabs on the server's page: Rules, Activities, Countries, Agents, Settings and Audit. The owner and members with the firewall permission can change it; a Viewer can look. Changes are pushed when you save and every server is re-checked once a minute.

Worth checking on an existing ViciBox

The ViciBox bug-fix notes for 12.0.0 record that it shipped with firewalld not starting automatically, which leaves the box unfiltered until it is enabled. If you run 12.0.0, confirm with systemctl is-enabled firewalld and, if needed, systemctl enable firewalld.service and a reboot, as the notes describe.

Moving from ViciBox

A ViciBox server moves to VICIfast as the same VICIdial - same campaigns, same leads, same agent logins - so your agents keep their usernames and passwords. What changes is the firewall: there is no valid8.php. Send agents the new portal link (the dashboard gives it to you as a link and a QR code), add your office addresses with the Agent or Admin profile, and your carriers are picked up automatically once their trunks are on the new server.

• Automated ViciBox migration - we copy the source box across while it keeps dialing.
• VICIfast vs ViciBox - the wider comparison: installer ISO versus managed hosting.

Sources

All from the ViciBox documentation at docs.vicibox.com:

• Dynamic Portal
• White List and its cron schedule
• Firewall zones
• VoIP Black List
• Black List
• ViciBox 12.0.0 bug fixes: firewalld not starting

Checked September 2026.

Next steps

• VICIfast Firewall - every part of the firewall, with screenshots.
• VICIfast pricing - the published plan grid, billed per server.
• Automated ViciBox migration - moving an existing ViciBox server across.

Start a 7-day trial → - card validated, no charge until day 7.