Action required: Allowlist update for Voice 1.0 web calls by November 15, 2026
Retell, the voice provider behind Voice 1.0 web calls, is retiring its previous (v2) web-call technology. After November 15, 2026, Leena AI will move Voice 1.0 web calls to Retell's v3 platform. From then on, browser voice calls connect directly to Retell instead of through LiveKit. This change is not live yet.
This update applies only to Voice 1.0. Voice 2.0, powered by Realtime, does not use Retell or LiveKit, so bots on Voice 2.0 are not affected.
Employees will see no change, and phone (PSTN/SIP) voice calls are not affected. But if your IT team restricts outbound traffic (firewall, proxy, VPN or Zscaler), they must update your network allowlist by November 15, 2026, or Voice 1.0 web calls will fail after the switch.
Action needed by November 15, 2026Share the allowlist below with your IT team, and keep
*.livekit.cloudallowed until the switch is done. Without the update, a voice call on a restricted network will open after the switch, then freeze or drop after a few seconds with no audio. Chat keeps working normally.
Who is affected
- Affected: customers using Voice 1.0 voice calls in the Leena AI web chat. Action is needed only where IT restricts outbound traffic (firewall, proxy, VPN, Zscaler).
- Not affected: Voice 2.0 web calls (powered by Realtime), phone (PSTN/SIP) voice calls, chat, the bot's answers, voice quality and features.
- Employees: nothing to do.
Not sure whether your bots use Voice 1.0 or Voice 2.0? Ask your Leena AI CSM.
Timeline
| When | What happens |
|---|---|
| By November 15, 2026 | Your IT team adds the v3 allowlist below. Keep *.livekit.cloud allowed. |
| After November 15, 2026 | Leena AI switches Voice 1.0 web calls to Retell v3. |
| After Leena AI confirms the switch | You can remove *.livekit.cloud. |
Allowlist for your IT team
All rules are outbound from employees' browsers. Retell has confirmed that the IP range is static.
| Destination | Protocol / port | Purpose | Needed |
|---|---|---|---|
api.retellai.com | TCP 443 (HTTPS), including /webrtc-proxy/* | Call setup | Required |
3.42.144.0/23 | UDP 7000–7500 | Voice audio, preferred path | Required for best quality |
3.42.144.0/23 | TCP 443 and TCP 7881 | Voice audio when UDP is blocked | Required |
turn.retellai.com (by hostname, its IPs can change) | UDP 3478, TCP 443 (TURN over TLS) | Relays audio on restrictive networks | Required |
stun.l.google.com:19302, stun.cloudflare.com:3478 | UDP | Helps the browser find the best path | Optional |
Also:
- Exempt
turn.retellai.comand3.42.144.0/23from SSL/TLS inspection (Zscaler, proxies). Both TCP 443 paths carry live audio and fail if intercepted. - Where possible, bypass VPN or Zscaler tunnels for these destinations to avoid audio delay.
- Keep microphone permission allowed in the browser for the Leena AI site.
- Keep
*.livekit.cloudallowed until Leena AI confirms the switch, then remove it.
What changes from v2
| Part | v2 (being retired) | v3 (new) |
|---|---|---|
| Call setup | Via LiveKit (*.livekit.cloud, WSS on TCP 443) | api.retellai.com, HTTPS on TCP 443 |
| Voice audio | LiveKit media servers under *.livekit.cloud | Retell media gateways in 3.42.144.0/23 |
| Relay when UDP is blocked (TURN) | LiveKit TURN under *.livekit.cloud | turn.retellai.com |
How to test
Voice 1.0 web calls keep using LiveKit until the switch, so a test call before then does not check the new rules. After Leena AI confirms the switch, start a voice call in the Leena AI web chat from a managed laptop and speak. If the assistant replies, the network is set up correctly. If the call freezes or drops within seconds, check the allowlist and SSL/TLS inspection rules.
FAQ
Does this apply to Voice 2.0?
No. Voice 2.0 web calls are powered by Realtime and do not connect to Retell or LiveKit. Only Voice 1.0 web calls are affected.
Can we allowlist by IP instead of hostname?
For 3.42.144.0/23, yes; Retell says it is static. Allow turn.retellai.com by hostname, because its IPs can change, and allow api.retellai.com by hostname too.
Our network blocks UDP. Will calls work?
Yes, through TCP 443 or TCP 7881 to 3.42.144.0/23, or TURN over TLS on turn.retellai.com:443, as long as those are not SSL-inspected.
When can we remove *.livekit.cloud?
*.livekit.cloud?Only after Leena AI confirms your bots have switched to v3, which happens after November 15, 2026. Keep it allowed until then.
Is the audio secure?
Yes. Audio is encrypted between the browser and Retell (DTLS-SRTP), and call setup runs over HTTPS.
Questions? Contact your Leena AI CSM.