A method for a first routing entity controlled by a first mobile network operator, MNO A, to enable establishment of a direct data connection between a first device connected to a telecommunications network of the first mobile network operator and a second device connected to a telecommunications network of a second mobile network operator, MNO B, the method comprising: - receiving from the first device a connection request comprising a first identifier for the second device; - resolving the first identifier of the second device into a second identifier of the second device wherein the second identifier is a network-level identifier identifying a second routing entity controlled by the second mobile network operator, MNO B; - providing to the second routing entity a connection request for the connection between the first device and the second device, the connection request comprising the first identifier or/and the second identifier of the second device; characterized by: - the resolving comprising (i) sending a request including the first identifier, wherein the first identifier is an application-level identifier, to a server associated with an over-the-top, OTT, application and (ii) receiving a response including the second identifier; - providing (316/330) to the second routing entity contact information of the first device, wherein the contact information comprises an IP address of the first device; - receiving from the second routing entity contact information of the second device, wherein the contact information comprises an IP address of the second device; and - configuring a first firewall for a data exchange over the connection between the first device and the second device in accordance with the contact information of the first device and the contact information of the second device, wherein the first firewall is a firewall of the telecommunications network to which the first device is connected that is configured to protect the first device. - receiving from the first device a connection request comprising a first identifier for the second device; - resolving the first identifier of the second device into a second identifier of the second device wherein the second identifier is a network-level identifier identifying a second routing entity controlled by the second mobile network operator, MNO B; - providing to the second routing entity a connection request for the connection between the first device and the second device, the connection request comprising the first identifier or/and the second identifier of the second device; - the resolving comprising (i) sending a request including the first identifier, wherein the first identifier is an application-level identifier, to a server associated with an over-the-top, OTT, application and (ii) receiving a response including the second identifier; - providing (316/330) to the second routing entity contact information of the first device, wherein the contact information comprises an IP address of the first device; - receiving from the second routing entity contact information of the second device, wherein the contact information comprises an IP address of the second device; and - configuring a first firewall for a data exchange over the connection between the first device and the second device in accordance with the contact information of the first device and the contact information of the second device, wherein the first firewall is a firewall of the telecommunications network to which the first device is connected that is configured to protect the first device.