which VOIP provider with SIP TLS and SRTP for a Zyxel DX3301-T0 VOIP PPPoE router?

[#1]

I have a Zyxel DX3301-T0 which I have been using on the Plusnet ADSL product with no issues. I bought that VOIP model in anticipation of the POTS switch-off, but it appears that the decision over choosing a VOIP provider has come early, with the only fibre offer at contract renewal now being FTTP.

My research on how safe VOIP is compared to an analogue phone line has thrown up some worrying things, not least being the apparent lack of any security when sending account credentials from my router as a VOIP client to any providers VOIP server unless the provider supports TLS for the SIP setup transport. The Zyxel service provider setup page defaults to UDP, but TLS is an option.

As many on here default to recommending A&A for VOIP, I looked on their Support Wiki and Web, and found a setup page for the Zyxel OPAL series of VOIP routers, of which mine is an instance.

Sadly, nowhere on their website and nowhere in their setup guide do they mention the two required steps below.

Not supporting them would result in a default insecure unencrypted SIP setup  - where any snooper on the route could grab my account user/password and use them to make calls for themselves at my expense! Or am I missing something?

So really asking whether

- A&A do support both SIP TLS and SRTP for their residential home phone offering but for some odd reason don't mention it

- and if not, who does?

Anyone here got A&A home phone working safely with SIP TLS and SRTP on?

[#2]

Moderator's note:
Thread moved from Everything Else to Tech Help

[#3]

@disfroot 

Unless things have changed recently you should be able to renew your contract "as is" by phoning PN.

Brian

[#4]

@bmc 

Don't quite understand your reply. I was asking about finding a provider of secure VOIP - specifically whether Andrews and Arnold VOIP offers SIP TLS and SRTP - as it is supported by my Zyxel modem, but you answered a different question?

[#5]

@disfroot 

You stated in your opening paragraph that you were only being offered Full Fibre at contract remewal. I replied I thought you could continue "as is " if this is desireable.

Brian

[#6]

@bmc

Ah, I see - I have purchased FTTP from Plusnet - that is the only fibre product they offer at this exchange and it made no sense to renew with ADSL for another 18 months.

So I need a VOIP provider. Many people on here recommend A&A, yet I can see no indication that their VOIP offering supports the necessary credential encryption to make it safe enough for my peace of mind.

So I'm looking for anyone who has direct experience of them offering this level of service, or of other providers who may explicitly support these rather essential features.

Thanks for the reply, anyway

[#7]

@disfroot 

Have you tried asking A&A support?

Brian

[#8]

@disfroot I'm not aware of any voip provider who supports TLS , that's not to say there aren't any!

However, even without TLS, SIP passwords are encrypted using a one-way hash via challenge 'nonce' sent by the SIP server.

[#9]

@bmc 

I just got a reply from them, yes. They offer neither SIP TLS nor SRTP - super broken in 2025

@MisterW 

Further research reveals that the SIP setup isn't as bad as HTTP Basic Auth ( cleartext password sent) as you say, but HTTP Digest Auth is also pretty vile - the threat is that without the TLS transport, the man-in-the-middle can simply force a downgrade of the already poor Digest Auth (even with state of the art SHA256 hashes) to either the ubiquitous broken MD5 hash or even all the way down to Basic Auth, e.g.

https://security.stackexchange.com/a/31398

It's a pain that A&A are so much cheaper than any other provider - I haven't found any other that is less than £5pm, yet A&A PAYG is only £1.42pm

What price peace of mind, eh?

[#10]

@disfroot A & A provide the facility to restrict a voip account to only allowing SIP registration from a single IP. So if you have a static IP then its simple. If not then you could always use A & As L2TP service https://www.aa.net.uk/broadband/l2tp-service/ assuming your router or voip kit is capable. The 'light' service at £2/m would be adequate for voip

[#11]

@disfroot 

You could always go with A&A in the first instance while you continue researching your needs. This protects your phone number.

Just remember not to start the number port until after PN have confirmed you phone line is ceased. There will be a few down days on the phone while the port is in progress. If this is a problem then you can set your A&A account up in advance with a generic number to use short term. Also allows you to confirm your phones work with VOIP.

Brian

[#12]

@bmc

Is moving a number between VOIP providers an OfCOM 'one touch process' at A&A once I'm registered?  or do I have to go through loss of service - with the same 'cessation first, then migrate' process as first moving from a real line line to VOIP?

Paying for a temporary 'tin' number would cost another £12 and then £12 again for the port-in as far as I can see. I'd rather save the £12. I can't see any way of getting to see what the control panel offers without buying a number, though.

[#13]

@MisterW 

Yes, I saw the static IP mitigation, but IPs can be spoofed - and it's a mitigation - which in my book means a bodge to work around a misfeature.

I looked at the page you linked - L2TP is only safe when combined with IPSec - it offers no encryption per se, just encapsulation, so I can't see that this addresses any of my security concerns.

Encryption?

There is no encryption, this is plain L2TP and not to be confused with a 'VPN'. You can run encrypted servers through the L2TP tunnel as normal - eg https for web sites, or you can run an encrypted VPN through the L2TP service.

[#14]

Sounds like you'd be better off staying away from voip then.

I think you'll struggle to find a provider who supports TLS let alone SRTP

[#15]

@MisterW 

Not really - already found two. Yay and Freeola.