Detecting Viber traffic characteristics?

RouterOS General
1

Folks,

I’d like to detect Viber’s traffic on my Tik, to let it route different gateway (not the default).

I have studied this document: https://commons.erau.edu/cgi/viewcontent.cgi?article=1477&context=jdfsl, which helped a lot, and also this one (used ports for Viber Desktop): https://help.viber.com/en/article/opening-ports-for-viber-desktop

As of now, I’ve mangles for these ports:

UDP: 443,5242,4244,5243,7985,7987,9785
TCP: 5242,4244,5243,7985,7987,9785

Viber Desktop from PC works perfectly, all voice and video calls are going through these mangles.

However, my Android phone suffers from call creation. Chats are fine, but no voice or video can be established.

I tried adding some known Amazon AWS addresses (used by Viber) to my mangles:

52.0.252.0/22

But calls are always fail. If I mangle all packets initiating from my phone (src=myphone, connectionstate=new), Viber calls start working immediately.

I have seen some trials here which are older threads, and I would need a fresh one, as those are not working anymore. Maybe I’ll have to apply a Level7 rule?

Can I somehow detect Viber’s signature in Layer7?

2

Layer 7 looks into the contents of the traffic, and has some limitations (0x0 bytes ignored etc.), whilst all the Viber traffic is encrypted (or at least so they say). Hence you have to record the start of multiple voice and video calls and search for an eventual pattern in the initial packet of each of them. If there is none, it won’t work.

3

I did some Quick Test…

I didn’t have any success with Layer7 in the short time… I will try again tomorow
BUT I was able to identify “Viber” Servers via a Firewall-Rule and

/ip firewall filter
add action=add-dst-to-address-list address-list=ViberServers address-list-timeout=none-dynamic chain=forward dst-port=\
80,443,4244,5242,5243,7985 out-interface-list=WAN protocol=tcp tls-host=*viber*

I was able to mangel the Traffic and redirect the Traffic to WAN2 (as a test)
88% sure it worked… (VOIP-Call thru WAN2 instead of WAN1)
But Viber as a lot of non VOIP Traffic (Ads, Messaging, rakuten-Traffic, etc..)
So not ideal … =)

And if you try to “Block” the Servers, the App start to commmunicate with other addresses / domains
So not ideal … =)

4

Don’t think a Mikrotik is the right product to “tackle” these issues. (and if you get some lucky attempts, performance impact is probably horrible)

Apparently according to Palo Alto (application research cente) Viber has several subservices.
One could simply select one of these below/all of these in a Palo Alto FW (policy) - commit - done!

viber-base
viber-voice
viber-uploading
viber-downloading

Key-message here : use the right tool for the job

5

Did you turn off cellular when you tested this on the Android as it’s possible the Android app decides whether to use Wi-Fi or cell depending on other factors (like latnecy/jitter)?

Smartphones sometimes steer things to IPv6 if available and believe Viber supports IPv6. Are you sure the Android isn’t use IPv6?

6

Can you use the Palo Alto policy also to use specific routing for the matching traffic, not just to block it? I mean, to choose the routing policy, you have to take the decision while handling the initial packet of a connection, whilst for blocking, you can afford to take more packets into account, thus getting a more precise match.

7

Also you might want to break this up into few rules:

  1. 80/443 using the Layer7 TLS DNS you have. (The port 80 in the specs is curious. It’s possible the app still uses TLS over port 80 to the Viber (as a fallback), so possible you need handle port 80 different than 443 in another rule.)
  2. Don’t look for their IP address in the mange rules for the RTP traffic ports - e.g. just match on the UDP protocol and ports 4244,5242,5243,7985, and just route those out your WAN2. The RTP may go peer-to-peer to local subnet – this wouldn’t use their servers, so you may want a dst-addr-type=!local since you likely don’t want to route those ports out WAN2 if the destination is on the local subnet. (Side effect is if any other application that used those UDP ports would also use WAN2, but avoiding the DNS/IP address matching make it more likely that the Viber traffic would go out WAN2, assuming those ports are still right)
8

I summarize my results:

Best way to handle this, is keeping those ports I mentioned above in the mangle (repeat here for reference):

Both TCP and UDP:

4244,5242,5243,7985,7987,9785

Traffic redirection purely based on these ports are

  • enough for Viber Desktop
  • NOT enough for Viber Android

If also TCP443 was added to the list, Viber Android started working perfectly, but I don’t want to limit myself, 443 is an important port, we shouldn’t generally reroute it!

Based on my research, Android application needs its traffic towards some IP addresses to be forwarded to the same direction as the ports above to be able to correctly build up the call.

Now, how to detect those IP addresses? As Viber uses Amazon, so theoretically, we can forward all Amazon IPs and then we are good. Okay, but we don’t want to redirect the whole Amazon, right?

So I started collecting IP addresses during failed calls. My list is growing, luckily not too much traffic goes towards Amazon servers during a (failing) VoIP call.

Now, every time when I’m making a call and it fails, I start the IP collection, and retry the call. It will still be failed, but I’ll have a (not too big list). Then I check the list items, and if an IP belongs to Amazon, I add it to the Viber IP group, and Viber IP group is rerouted towards the secondary gateway.

This way, In case I have a failed call, I’ll have to retry once, then I’ll have the right config next time. And as my list is growing, this would be getting better and better every time.

Layer7 was not the way to go, they are secured mostly everything, I don’t think they are using port80 anymore.

Thank you all!

9

No one said this be easy :slight_smile:. But think if you want to crack this nut, you’d have to collect some sniffer traces from the Android to Viber, and study it from things that could identify it. A Layer7 rule may be possible, outside tls-host, but really take some digging and may not actually be possible.

Since that might hard. And, since your approach works for Desktop, but Android… One difference is the networking stack on Android is far more complex than a desktop – it generally has two paths to manage, some with CGNAT require UPnP, and other battery saving rules… Like SIP’s ICE protocol, Viber seems to support a range of ways to setup a call, and selecting a different method than the desktop. But why – network should be “same”? Theoretically some Mikrotik trick might steer it to use same “session-style” as Desktop. But what? Again not an easy approach, still requiring dissecting sniffer data.

What you don’t mention here…is what’s going with DNS?

Have you looked for DNS queries (prior to the TLS/443) involved prior to the call setup? While I imagine they push down IP addresses to the Viber clients, worth a look. With scripting, might be able use DNS cache to build your list of AWS servers they use, if they used DNS AND the Android/et’al DNS queires all went through the same Mikrotik router’s DNS – this become more solvable.

Similar on the DNS train, on Android, it’s possible DoH is being used DNS lookups (perhaps, overriding the DHCP ones). DoH would also use port 443…thus the DNS query be invisible to the Mikrotik.

Any other data point from other Viber clients?

Maybe you could try an iPhone with Viber app to see if ask more like the Desktop (working) or Android (not working without all SSL redirected) – be another data point. Similarly, have you tried other Android variants with the Viber app?

Anyway, just some thoughts, I don’t have this need but it is a curious puzzle.

10

I have only one Android device around, no iPhone or other versions of Android.

Also, this device is not rooted, so anything like “netstat” is not available on it (to see by application-level, what application is using what ports and dst IPs).

DNS didn’t help, I tried, but they are obfuscating them to a multilevel CNAME stuff, which I lost after a while.

My method is much easier and works 100%. Just I have to call twice. 1=collection&analyse, 2=working call. That’s all.

11

Sounds like you’re good. But did think of something else here to get the list of IPs… You can use a “firewall address-list”, based on DNS lookups of “well known” *.viber.com DNS names, then use that list in mangle decision. A quick google turn up a list of viber subdomains to use: https://securitytrails.com/list/apex_domain/viber.com?

Taking those gets you the following ROS code, to create an address-list named “viberips”:

/ip firewall address-list add list=viberips address=viber.com
/ip firewall address-list add list=viberips address=invite.viber.com
/ip firewall address-list add list=viberips address=chats.viber.com
/ip firewall address-list add list=viberips address=spl.viber.com
/ip firewall address-list add list=viberips address=support.viber.com
/ip firewall address-list add list=viberips address=download.cdn.viber.com
/ip firewall address-list add list=viberips address=account.viber.com
/ip firewall address-list add list=viberips address=info.viber.com
/ip firewall address-list add list=viberips address=help.viber.com
/ip firewall address-list add list=viberips address=viberout-lp.viber.com
/ip firewall address-list add list=viberips address=download.viber.com
/ip firewall address-list add list=viberips address=partners.viber.com
/ip firewall address-list add list=viberips address=integration.viber.com
/ip firewall address-list add list=viberips address=market.staging.viber.com
/ip firewall address-list add list=viberips address=share.cdn.viber.com
/ip firewall address-list add list=viberips address=chatapi.viber.com
/ip firewall address-list add list=viberips address=content.cdn.viber.com
/ip firewall address-list add list=viberips address=discover.viber.com
/ip firewall address-list add list=viberips address=custom-sticker-pack.cdn.viber.com
/ip firewall address-list add list=viberips address=market.viber.com
/ip firewall address-list add list=viberips address=communities-orig.viber.com
/ip firewall address-list add list=viberips address=market.integration.viber.com
/ip firewall address-list add list=viberips address=o2235.abmail.email.viber.com
/ip firewall address-list add list=viberips address=media.viber.com
/ip firewall address-list add list=viberips address=explore-screen.cdn.development.viber.com
/ip firewall address-list add list=viberips address=market-api.cdn.viber.com
/ip firewall address-list add list=viberips address=email.viber.com
/ip firewall address-list add list=viberips address=ads.integration.viber.com
/ip firewall address-list add list=viberips address=static.integration.viber.com
/ip firewall address-list add list=viberips address=viles.viber.com
/ip firewall address-list add list=viberips address=business.development.viber.com
/ip firewall address-list add list=viberips address=media.cdn.viber.com
/ip firewall address-list add list=viberips address=cdr-proxy.integration.viber.com
/ip firewall address-list add list=viberips address=services.integration.viber.com
/ip firewall address-list add list=viberips address=id-provider.viber.com
/ip firewall address-list add list=viberips address=development.viber.com
/ip firewall address-list add list=viberips address=translate.viber.com
/ip firewall address-list add list=viberips address=edge.integration.viber.com
/ip firewall address-list add list=viberips address=pgws.viber.com
/ip firewall address-list add list=viberips address=market-staging.api.viber.com
/ip firewall address-list add list=viberips address=communities.integration.viber.com
/ip firewall address-list add list=viberips address=support.integration.viber.com
/ip firewall address-list add list=viberips address=locp-ir.aws.viber.com
/ip firewall address-list add list=viberips address=ptt.viber.com
/ip firewall address-list add list=viberips address=media.api.aws.viber.com
/ip firewall address-list add list=viberips address=vcm-backend.viber.com
/ip firewall address-list add list=viberips address=bm-backend.viber.com
/ip firewall address-list add list=viberips address=aloha.viber.com
/ip firewall address-list add list=viberips address=businessform.viber.com
/ip firewall address-list add list=viberips address=market.admin.viber.com
/ip firewall address-list add list=viberips address=cdr-proxy.viber.com
/ip firewall address-list add list=viberips address=rates.viber.com
/ip firewall address-list add list=viberips address=config.viber.com
/ip firewall address-list add list=viberips address=market.admin.staging.viber.com
/ip firewall address-list add list=viberips address=zerorate.api.viber.com
/ip firewall address-list add list=viberips address=stickers-orig.viber.com
/ip firewall address-list add list=viberips address=config.integration.viber.com
/ip firewall address-list add list=viberips address=language.viber.com
/ip firewall address-list add list=viberips address=connect.de-a.voip.aws.viber.com
/ip firewall address-list add list=viberips address=aloha-proxy-ir.aws.viber.com
/ip firewall address-list add list=viberips address=clients-content.integration.viber.com
/ip firewall address-list add list=viberips address=media.integration.viber.com
/ip firewall address-list add list=viberips address=content-suggestions.integration.viber.com
/ip firewall address-list add list=viberips address=mail.viber.com
/ip firewall address-list add list=viberips address=market.api.staging.viber.com
/ip firewall address-list add list=viberips address=pgws.integration.viber.com
/ip firewall address-list add list=viberips address=partners-office.viber.com
/ip firewall address-list add list=viberips address=static.forbusiness.viber.com
/ip firewall address-list add list=viberips address=bm-backend.integration.viber.com
/ip firewall address-list add list=viberips address=gold.voip.aws.viber.com
/ip firewall address-list add list=viberips address=o2234.abmail.email.viber.com
/ip firewall address-list add list=viberips address=communities.qa.viber.com
/ip firewall address-list add list=viberips address=developers.viber.com
/ip firewall address-list add list=viberips address=ads-d-orig.viber.com
/ip firewall address-list add list=viberips address=share.viber.com
/ip firewall address-list add list=viberips address=partners.qa.viber.com
/ip firewall address-list add list=viberips address=dd.aws.viber.com
/ip firewall address-list add list=viberips address=vibes.integration.viber.com
/ip firewall address-list add list=viberips address=media-direct.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=pdl.viber.com
/ip firewall address-list add list=viberips address=im3.viber.com
/ip firewall address-list add list=viberips address=unv.viber.com
/ip firewall address-list add list=viberips address=www-php.viber.com
/ip firewall address-list add list=viberips address=viberout-calls.integration.viber.com
/ip firewall address-list add list=viberips address=livecom.integration.viber.com
/ip firewall address-list add list=viberips address=vcm.qa.viber.com
/ip firewall address-list add list=viberips address=chatext.viber.com
/ip firewall address-list add list=viberips address=ads-d.integration.viber.com
/ip firewall address-list add list=viberips address=hpx.viber.com
/ip firewall address-list add list=viberips address=wab.development.viber.com
/ip firewall address-list add list=viberips address=aws.viber.com
/ip firewall address-list add list=viberips address=test-analytics.viber.com
/ip firewall address-list add list=viberips address=live-orig.viber.com
/ip firewall address-list add list=viberips address=partners-orig.viber.com
/ip firewall address-list add list=viberips address=www.integration.viber.com
/ip firewall address-list add list=viberips address=market-staging.api.development.viber.com
/ip firewall address-list add list=viberips address=share.api.aws.integration.viber.com
/ip firewall address-list add list=viberips address=wallet-api.staging.viber.com
/ip firewall address-list add list=viberips address=unv.integration.viber.com
/ip firewall address-list add list=viberips address=reports.integration.viber.com
/ip firewall address-list add list=viberips address=viber.com
/ip firewall address-list add list=viberips address=invite.viber.com
/ip firewall address-list add list=viberips address=chats.viber.com
/ip firewall address-list add list=viberips address=spl.viber.com
/ip firewall address-list add list=viberips address=support.viber.com
/ip firewall address-list add list=viberips address=download.cdn.viber.com
/ip firewall address-list add list=viberips address=account.viber.com
/ip firewall address-list add list=viberips address=info.viber.com
/ip firewall address-list add list=viberips address=help.viber.com
/ip firewall address-list add list=viberips address=viberout-lp.viber.com
/ip firewall address-list add list=viberips address=download.viber.com
/ip firewall address-list add list=viberips address=partners.viber.com
/ip firewall address-list add list=viberips address=integration.viber.com
/ip firewall address-list add list=viberips address=market.staging.viber.com
/ip firewall address-list add list=viberips address=share.cdn.viber.com
/ip firewall address-list add list=viberips address=chatapi.viber.com
/ip firewall address-list add list=viberips address=content.cdn.viber.com
/ip firewall address-list add list=viberips address=discover.viber.com
/ip firewall address-list add list=viberips address=custom-sticker-pack.cdn.viber.com
/ip firewall address-list add list=viberips address=market.viber.com
/ip firewall address-list add list=viberips address=communities-orig.viber.com
/ip firewall address-list add list=viberips address=market.integration.viber.com
/ip firewall address-list add list=viberips address=o2235.abmail.email.viber.com
/ip firewall address-list add list=viberips address=media.viber.com
/ip firewall address-list add list=viberips address=explore-screen.cdn.development.viber.com
/ip firewall address-list add list=viberips address=market-api.cdn.viber.com
/ip firewall address-list add list=viberips address=email.viber.com
/ip firewall address-list add list=viberips address=ads.integration.viber.com
/ip firewall address-list add list=viberips address=static.integration.viber.com
/ip firewall address-list add list=viberips address=viles.viber.com
/ip firewall address-list add list=viberips address=business.development.viber.com
/ip firewall address-list add list=viberips address=appsauth-nginx.viber.com
/ip firewall address-list add list=viberips address=12tpe.rates.integration.viber.com
/ip firewall address-list add list=viberips address=admin.integration.viber.com
/ip firewall address-list add list=viberips address=media.aws.viber.com
/ip firewall address-list add list=viberips address=stage.forbusiness.viber.com
/ip firewall address-list add list=viberips address=account.integration.viber.com
/ip firewall address-list add list=viberips address=main.api.viber.com
/ip firewall address-list add list=viberips address=stickers.staging.viber.com
/ip firewall address-list add list=viberips address=group-vb.cdn.viber.com
/ip firewall address-list add list=viberips address=market-staging.development.viber.com
/ip firewall address-list add list=viberips address=share.media.eu.aws.viber.com
/ip firewall address-list add list=viberips address=content.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=pg.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=api.development.viber.com
/ip firewall address-list add list=viberips address=static.qa.viber.com
/ip firewall address-list add list=viberips address=services.viber.com
/ip firewall address-list add list=viberips address=websup.viber.com
/ip firewall address-list add list=viberips address=www-php.staging.viber.com
/ip firewall address-list add list=viberips address=viberout-calls.viber.com
/ip firewall address-list add list=viberips address=sm-content.integration.viber.com
/ip firewall address-list add list=viberips address=search-by-name.viber.com
/ip firewall address-list add list=viberips address=locp.viber.com
/ip firewall address-list add list=viberips address=partners.integration.viber.com
/ip firewall address-list add list=viberips address=market-staging.integration.viber.com
/ip firewall address-list add list=viberips address=manage.viber.com
/ip firewall address-list add list=viberips address=www.forbusiness.viber.com
/ip firewall address-list add list=viberips address=privacy.viber.com
/ip firewall address-list add list=viberips address=mailgw1.private.viber.com
/ip firewall address-list add list=viberips address=vibes.development.viber.com
/ip firewall address-list add list=viberips address=static.viber.com
/ip firewall address-list add list=viberips address=www.viber.com
/ip firewall address-list add list=viberips address=market-api.staging.viber.com
/ip firewall address-list add list=viberips address=splash.viber.com
/ip firewall address-list add list=viberips address=hpx.integration.viber.com
/ip firewall address-list add list=viberips address=api.aws.viber.com
/ip firewall address-list add list=viberips address=chatapi.integration.viber.com
/ip firewall address-list add list=viberips address=download.integration.viber.com
/ip firewall address-list add list=viberips address=market-staging.viber.com
/ip firewall address-list add list=viberips address=bi-airflow.aws.viber.com
/ip firewall address-list add list=viberips address=unv-orig.integration.viber.com
/ip firewall address-list add list=viberips address=unauthorized.viber.com
/ip firewall address-list add list=viberips address=www.staging.viber.com
/ip firewall address-list add list=viberips address=vln.integration.viber.com
/ip firewall address-list add list=viberips address=id-provider.integration.viber.com
/ip firewall address-list add list=viberips address=viberout-calls.staging.viber.com
/ip firewall address-list add list=viberips address=streaming.api.development.viber.com
/ip firewall address-list add list=viberips address=wab-office.viber.com
/ip firewall address-list add list=viberips address=static-orig.viber.com
/ip firewall address-list add list=viberips address=explore-screen.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=wallet.viber.com
/ip firewall address-list add list=viberips address=cdn.viber.com
/ip firewall address-list add list=viberips address=locp-de.aws.viber.com
/ip firewall address-list add list=viberips address=forbusiness.viber.com
/ip firewall address-list add list=viberips address=stickers-search.aws.viber.com
/ip firewall address-list add list=viberips address=chats.integration.viber.com
/ip firewall address-list add list=viberips address=pabotform.viber.com
/ip firewall address-list add list=viberips address=stickers.development.viber.com
/ip firewall address-list add list=viberips address=language.integration.viber.com
/ip firewall address-list add list=viberips address=r.viber.com
/ip firewall address-list add list=viberips address=rakuten-games.api.viber.com
/ip firewall address-list add list=viberips address=streaming3.api.viber.com
/ip firewall address-list add list=viberips address=say-hi.integration.viber.com
/ip firewall address-list add list=viberips address=share.media.aws.viber.com
/ip firewall address-list add list=viberips address=stickers.viber.com
/ip firewall address-list add list=viberips address=download.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=edge.aws.viber.com
/ip firewall address-list add list=viberips address=custom-sticker-pack.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=market.api.integration.viber.com
/ip firewall address-list add list=viberips address=stickers-search.aws.integration.viber.com
/ip firewall address-list add list=viberips address=live.viber.com
/ip firewall address-list add list=viberips address=ads-test.viber.com
/ip firewall address-list add list=viberips address=vln-service.viber.com
/ip firewall address-list add list=viberips address=market-orig.viber.com
/ip firewall address-list add list=viberips address=ca-content.viber.com
/ip firewall address-list add list=viberips address=ads.cdn.viber.com
/ip firewall address-list add list=viberips address=media.api.viber.com
/ip firewall address-list add list=viberips address=vln.viber.com
/ip firewall address-list add list=viberips address=admin.forbusiness.viber.com
/ip firewall address-list add list=viberips address=feb.client.csr.integration.viber.com
/ip firewall address-list add list=viberips address=secure.integration.viber.com
/ip firewall address-list add list=viberips address=pasupport.viber.com
/ip firewall address-list add list=viberips address=argo.development.viber.com
/ip firewall address-list add list=viberips address=media.eu.aws.viber.com
/ip firewall address-list add list=viberips address=share.integration.viber.com
/ip firewall address-list add list=viberips address=url3028.email.viber.com
/ip firewall address-list add list=viberips address=sm-content.viber.com
/ip firewall address-list add list=viberips address=livecom.viber.com
/ip firewall address-list add list=viberips address=unv.qa.viber.com
/ip firewall address-list add list=viberips address=credit-account.staging.viber.com
/ip firewall address-list add list=viberips address=apps.viber.com
/ip firewall address-list add list=viberips address=wadev.viber.com
/ip firewall address-list add list=viberips address=livecom.qa.viber.com
/ip firewall address-list add list=viberips address=market.development.viber.com
/ip firewall address-list add list=viberips address=explore.api.viber.com
/ip firewall address-list add list=viberips address=csr.integration.viber.com
/ip firewall address-list add list=viberips address=market-api.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=locp-ir.viber.com
/ip firewall address-list add list=viberips address=smpp1.viber.com
/ip firewall address-list add list=viberips address=search-by-name-orig.viber.com
/ip firewall address-list add list=viberips address=clients-content.viber.com
/ip firewall address-list add list=viberips address=ptt.integration.viber.com
/ip firewall address-list add list=viberips address=static-orig.integration.viber.com
/ip firewall address-list add list=viberips address=market-staging.api.integration.viber.com
/ip firewall address-list add list=viberips address=update.viber.com
/ip firewall address-list add list=viberips address=media-direct.viber.com
/ip firewall address-list add list=viberips address=sibunatra.aws.viber.com
/ip firewall address-list add list=viberips address=rakuten-games.api.integration.viber.com
/ip firewall address-list add list=viberips address=say-hi.viber.com
/ip firewall address-list add list=viberips address=analytics.viber.com
/ip firewall address-list add list=viberips address=lp.viber.com
/ip firewall address-list add list=viberips address=activate.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=spam-checker.aws.viber.com
/ip firewall address-list add list=viberips address=api.viber.com
/ip firewall address-list add list=viberips address=vbm.viber.com
/ip firewall address-list add list=viberips address=main.api.integration.viber.com
/ip firewall address-list add list=viberips address=business.viber.com
/ip firewall address-list add list=viberips address=vcm.viber.com
/ip firewall address-list add list=viberips address=ca-content.integration.viber.com
/ip firewall address-list add list=viberips address=advertisers.viber.com
/ip firewall address-list add list=viberips address=live.integration.viber.com
/ip firewall address-list add list=viberips address=share.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=akamaiedge.viber.com
/ip firewall address-list add list=viberips address=explore.api.development.viber.com
/ip firewall address-list add list=viberips address=explore.api.integration.viber.com
/ip firewall address-list add list=viberips address=vba.viber.com
/ip firewall address-list add list=viberips address=invite-orig.integration.viber.com
/ip firewall address-list add list=viberips address=ca.viber.com
/ip firewall address-list add list=viberips address=activate.integration.viber.com
/ip firewall address-list add list=viberips address=locp-sg.aws.viber.com
/ip firewall address-list add list=viberips address=media-files.aws.viber.com
/ip firewall address-list add list=viberips address=secure-evs.aws.integration.viber.com
/ip firewall address-list add list=viberips address=b2b.viber.com
/ip firewall address-list add list=viberips address=admin.development.viber.com
/ip firewall address-list add list=viberips address=pa-keyboard.viber.com
/ip firewall address-list add list=viberips address=share.aws.integration.viber.com
/ip firewall address-list add list=viberips address=group-vb.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=discover-orig.viber.com
/ip firewall address-list add list=viberips address=business.integration.viber.com
/ip firewall address-list add list=viberips address=braze-ingest.integration.viber.com
/ip firewall address-list add list=viberips address=language-internal.integration.viber.com
/ip firewall address-list add list=viberips address=aloha46.integration.viber.com
/ip firewall address-list add list=viberips address=blog.viber.com
/ip firewall address-list add list=viberips address=rates.integration.viber.com
/ip firewall address-list add list=viberips address=dl-media.aws.integration.viber.com
/ip firewall address-list add list=viberips address=bis-support.viber.com
/ip firewall address-list add list=viberips address=register.api.development.viber.com
/ip firewall address-list add list=viberips address=mutual-friends.viber.com
/ip firewall address-list add list=viberips address=config.development.viber.com
/ip firewall address-list add list=viberips address=search-by-name.integration.viber.com
/ip firewall address-list add list=viberips address=silver.voip.aws.viber.com
/ip firewall address-list add list=viberips address=ptt.development.viber.com
/ip firewall address-list add list=viberips address=bm-office.viber.com
/ip firewall address-list add list=viberips address=dl-media.viber.com
/ip firewall address-list add list=viberips address=wasabi.aws.integration.viber.com
/ip firewall address-list add list=viberips address=abtest.api.integration.viber.com
/ip firewall address-list add list=viberips address=ads.viber.com
/ip firewall address-list add list=viberips address=abtest.api.viber.com
/ip firewall address-list add list=viberips address=vibes1.viber.com
/ip firewall address-list add list=viberips address=zerorate.viber.com
/ip firewall address-list add list=viberips address=media.api.aws.integration.viber.com
/ip firewall address-list add list=viberips address=chef.api1.csr.integration.viber.com
/ip firewall address-list add list=viberips address=media-files.api.viber.com
/ip firewall address-list add list=viberips address=translation-service.viber.com
/ip firewall address-list add list=viberips address=share.media.api.aws.viber.com
/ip firewall address-list add list=viberips address=bm.viber.com
/ip firewall address-list add list=viberips address=stickers-search.integration.viber.com
/ip firewall address-list add list=viberips address=dl-media.integration.viber.com
/ip firewall address-list add list=viberips address=maps-ce.viber.com
/ip firewall address-list add list=viberips address=media-direct.cdn.viber.com
/ip firewall address-list add list=viberips address=wa.integration.viber.com
/ip firewall address-list add list=viberips address=apps.integration.viber.com
/ip firewall address-list add list=viberips address=activate.cdn.development.viber.com
/ip firewall address-list add list=viberips address=locp-de.viber.com
/ip firewall address-list add list=viberips address=media.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=spam-checker.aws.integration.viber.com
/ip firewall address-list add list=viberips address=cdn.integration.viber.com
/ip firewall address-list add list=viberips address=market.admin.development.viber.com
/ip firewall address-list add list=viberips address=service.stage.viber.com
/ip firewall address-list add list=viberips address=api.integration.viber.com
/ip firewall address-list add list=viberips address=mail.helpme.viber.com
/ip firewall address-list add list=viberips address=streaming.api.integration.viber.com
/ip firewall address-list add list=viberips address=explore-screen.cdn.viber.com
/ip firewall address-list add list=viberips address=share.api.integration.viber.com
/ip firewall address-list add list=viberips address=wuwallet.viber.com
/ip firewall address-list add list=viberips address=media.api.integration.viber.com
/ip firewall address-list add list=viberips address=account.development.viber.com
/ip firewall address-list add list=viberips address=edge.viber.com
/ip firewall address-list add list=viberips address=chats-orig.viber.com
/ip firewall address-list add list=viberips address=storm-us-cluster.aws.viber.com
/ip firewall address-list add list=viberips address=invite-orig.viber.com
/ip firewall address-list add list=viberips address=livecom-orig.viber.com
/ip firewall address-list add list=viberips address=locp-sg.viber.com
/ip firewall address-list add list=viberips address=eu.aws.viber.com
/ip firewall address-list add list=viberips address=live.qa.viber.com
/ip firewall address-list add list=viberips address=pg-vb.cdn.integration.viber.com
/ip firewall address-list add list=viberips address=unv-orig.viber.com
/ip firewall address-list add list=viberips address=pgws-orig.viber.com
/ip firewall address-list add list=viberips address=service.dev.viber.com
/ip firewall address-list add list=viberips address=wab.viber.com
/ip firewall address-list add list=viberips address=content-suggestions.viber.com
/ip firewall address-list add list=viberips address=pg.cdn.viber.com
/ip firewall address-list add list=viberips address=service.int.viber.com
/ip firewall address-list add list=viberips address=custom-sticker-pack.cdn.development.viber.com
/ip firewall address-list add list=viberips address=secure.viber.com
/ip firewall address-list add list=viberips address=reports.viber.com
/ip firewall address-list add list=viberips address=repob.account.integration.viber.com
/ip firewall address-list add list=viberips address=vibes.viber.com
/ip firewall address-list add list=viberips address=share.api.viber.com
/ip firewall address-list add list=viberips address=zoho.viber.com
/ip firewall address-list add list=viberips address=chats.qa.viber.com
/ip firewall address-list add list=viberips address=stickers-staging.viber.com
/ip firewall address-list add list=viberips address=smpp2.viber.com
/ip firewall address-list add list=viberips address=live-orig.integration.viber.com
/ip firewall address-list add list=viberips address=explore-staging.api.integration.viber.com
/ip firewall address-list add list=viberips address=dl-media.development.viber.com
/ip firewall address-list add list=viberips address=pg-vb.cdn.viber.com
/ip firewall address-list add list=viberips address=ads.aws.viber.com
/ip firewall address-list add list=viberips address=vbmr.private.viber.com
/ip firewall address-list add list=viberips address=noc-vo.viber.com
/ip firewall address-list add list=viberips address=activate.viber.com
/ip firewall address-list add list=viberips address=activate.cdn.viber.com
/ip firewall address-list add list=viberips address=vcm.integration.viber.com
/ip firewall address-list add list=viberips address=secure-evs.aws.viber.com
/ip firewall address-list add list=viberips address=wa.viber.com
/ip firewall address-list add list=viberips address=appsauth.development.viber.com
/ip firewall address-list add list=viberips address=communities.viber.com
/ip firewall address-list add list=viberips address=analytics.integration.viber.com
/ip firewall address-list add list=viberips address=www.cdn.viber.com
/ip firewall address-list add list=viberips address=chatext.integration.viber.com
/ip firewall address-list add list=viberips address=client-downloads.viber.com
/ip firewall address-list add list=viberips address=invite.integration.viber.com
/ip firewall address-list add list=viberips address=noc.viber.com
/ip firewall address-list add list=viberips address=stickers.integration.viber.com
/ip firewall address-list add list=viberips address=ca.integration.viber.com
/ip firewall address-list add list=viberips address=sibunatra.development.viber.com
/ip firewall address-list add list=viberips address=bm.integration.viber.com
/ip firewall address-list add list=viberips address=stickers-search.viber.com
/ip firewall address-list add list=viberips address=www-orig.viber.com
/ip firewall address-list add list=viberips address=media-direct.integration.viber.com
/ip firewall address-list add list=viberips address=partners-office.integration.viber.com
/ip firewall address-list add list=viberips address=market.api.development.viber.com
/ip firewall address-list add list=viberips address=go.viber.com
/ip firewall address-list add list=viberips address=braze-ingest.viber.com
/ip firewall address-list add list=viberips address=vln.development.viber.com
/ip firewall address-list add list=viberips address=partners-office-orig.viber.com
/ip firewall address-list add list=viberips address=wuwallet.integration.viber.com
/ip firewall address-list add list=viberips address=pg.cdn.development.viber.com
/ip firewall address-list add list=viberips address=update.api.development.viber.com
/ip firewall address-list add list=viberips address=guides.viber.com
/ip firewall address-list add list=viberips address=service.viber.com
/ip firewall address-list add list=viberips address=partners-orig.integration.viber.com
/ip firewall address-list add list=viberips address=aloha.integration.viber.com
/ip firewall address-list add list=viberips address=api.eu.aws.viber.com
/ip firewall address-list add list=viberips address=share.api.development.viber.com
/ip firewall address-list add list=viberips address=ads-d.viber.com
/ip firewall address-list add list=viberips address=mutual-friends.integration.viber.com
/ip firewall address-list add list=viberips address=content.cdn.development.viber.com
/ip firewall address-list add list=viberips address=streaming.api.viber.com
/ip firewall address-list add list=viberips address=staging.viber.com
/ip firewall address-list add list=viberips address=helpme.viber.com
/ip firewall address-list add list=viberips address=language-internal.viber.com
/ip firewall address-list add list=viberips address=market.api.viber.com
/ip firewall address-list add list=viberips address=media.api.eu.aws.viber.com

which gets you the IPs:

> /ip firewall address-list print 
Flags: X - disabled, D - dynamic 
 #   LIST                                               ADDRESS                                                                 CREATION-TIME        TIMEOUT             
 2   viber                                              viber.com                                                               nov/25/2021 10:21:53
 3 D ;;; viber.com
     viber                                              23.193.132.243                                                          nov/25/2021 10:21:53
 4   viberips                                           viber.com                                                               nov/25/2021 10:31:06
 5   viberips                                           invite.viber.com                                                        nov/25/2021 10:31:06
 6   viberips                                           chats.viber.com                                                         nov/25/2021 10:31:06
 7   viberips                                           spl.viber.com                                                           nov/25/2021 10:31:06
 8   viberips                                           support.viber.com                                                       nov/25/2021 10:31:06
 9   viberips                                           download.cdn.viber.com                                                  nov/25/2021 10:31:06
10   viberips                                           account.viber.com                                                       nov/25/2021 10:31:06
11   viberips                                           info.viber.com                                                          nov/25/2021 10:31:06
12   viberips                                           help.viber.com                                                          nov/25/2021 10:31:06
13   viberips                                           viberout-lp.viber.com                                                   nov/25/2021 10:31:06
14   viberips                                           download.viber.com                                                      nov/25/2021 10:31:06
15 D ;;; viber.com
     viberips                                           184.50.5.78                                                             nov/25/2021 10:31:06
16   viberips                                           partners.viber.com                                                      nov/25/2021 10:31:06
17 D ;;; invite.viber.com
     viberips                                           104.86.4.102                                                            nov/25/2021 10:31:06
18   viberips                                           integration.viber.com                                                   nov/25/2021 10:31:06
19   viberips                                           market.staging.viber.com                                                nov/25/2021 10:31:06
20   viberips                                           share.cdn.viber.com                                                     nov/25/2021 10:31:06
21   viberips                                           chatapi.viber.com                                                       nov/25/2021 10:31:06
22   viberips                                           content.cdn.viber.com                                                   nov/25/2021 10:31:06
23 D ;;; support.viber.com
     viberips                                           99.84.64.5                                                              nov/25/2021 10:31:06
24 D ;;; support.viber.com
     viberips                                           99.84.64.112                                                            nov/25/2021 10:31:06
25 D ;;; support.viber.com
     viberips                                           99.84.64.44                                                             nov/25/2021 10:31:06
26 D ;;; support.viber.com
     viberips                                           99.84.64.36                                                             nov/25/2021 10:31:06
27   viberips                                           discover.viber.com                                                      nov/25/2021 10:31:06
28   viberips                                           custom-sticker-pack.cdn.viber.com                                       nov/25/2021 10:31:06
29 D ;;; chats.viber.com
     viberips                                           54.192.73.75                                                            nov/25/2021 10:31:06
30 D ;;; chats.viber.com
     viberips                                           54.192.73.63                                                            nov/25/2021 10:31:06
31 D ;;; chats.viber.com
     viberips                                           54.192.73.6                                                             nov/25/2021 10:31:06
12

Yes, probably that is a good start-point.

However, I’m already having more IPs which required (or was required in the past few days) to build up a call.

And call establishment doesn’t need all IP addresses by those DNS. Call establishment is very specific according to my research (on Android): so having a static list probably won’t give you optimal results.