How to Configure an Asterisk PJSIP Trunk on an Ubuntu VPS

Architecture: separate signaling from media

SIP creates, modifies and ends the dialog; RTP or SRTP normally carries audio on different UDP ports. A successful 200 OK and ACK proves signaling reached an accepted dialog, but it does not prove that either media direction is routable. Treat the peer specification, DNS, firewall, PJSIP objects, dialplan and media policy as separate verification domains.

Pre-flight inventory

lsb_release -a
uname -a
timedatectl status
ip -br addr
ip route
ss -lntup
sudo asterisk -V
sudo asterisk -rx "core show uptime"

Record the operating-system release, kernel, UTC synchronization, interface addressing, default route, listeners, Asterisk version and uptime. Healthy output means time is synchronized, the expected interface owns the expected address, the route points to the intended gateway, and Asterisk is running. An unexpected listener is a security finding; a missing Asterisk version or uptime response means configuration work should stop until service state is understood.

System clock synchronized: yes
NTP service: active
Asterisk 22.x (illustrative)
System uptime: 4 days, 03:12:08

Back up before change

sudo install -d -m 700 /root/asterisk-backup
sudo cp -a /etc/asterisk/pjsip.conf /root/asterisk-backup/pjsip.conf.$(date -u +%Y%m%dT%H%M%SZ)
sudo cp -a /etc/asterisk/extensions.conf /root/asterisk-backup/extensions.conf.$(date -u +%Y%m%dT%H%M%SZ)
sudo cp -a /etc/asterisk/rtp.conf /root/asterisk-backup/rtp.conf.$(date -u +%Y%m%dT%H%M%SZ)

The mode-700 directory limits casual disclosure of dialplan and authentication references. Confirm the files exist and record their exact timestamps. To roll back, copy only the reviewed backup version over the changed file, validate syntax, and use the narrowest supported reload in a controlled window. Never restore an entire directory blindly because unrelated valid changes may be lost.

Firewall planning: signal and media deliberately

Permit administration only from an approved documentation range, signaling only from an expected peer when IP authentication applies, and the RTP range actually configured in rtp.conf. The commands below are patterns, not a universal policy. A hostname may resolve to multiple or changing addresses; coordinate that behavior before expressing peer policy as a static firewall rule.

sudo ufw allow from 192.0.2.0/28 to any port 22 proto tcp comment 'approved admin range'
sudo ufw allow from 203.0.113.10 to any port 5060 proto udp comment 'documented SIP peer'
sudo ufw allow from 203.0.113.10 to any port 5061 proto tcp comment 'documented SIP TLS peer'
sudo ufw allow from 203.0.113.10 to any port 10000:20000 proto udp comment 'RTP range; match rtp.conf'
sudo ufw status numbered

Do not open AMI, ARI, a management GUI or SSH to the world because SIP is public. A healthy result lists only intended sources and ports. If audio uses a different negotiated relay, update the approved architecture first rather than broadening UDP indiscriminately.

PJSIP transports

Select the transport required by the peer. Enabling UDP and TLS together does not automatically upgrade calls; the endpoint and URI must select the intended transport. Transport changes can be restart-sensitive in some Asterisk situations, so consult the installed branch and schedule a controlled window.

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060
local_net=192.0.2.0/24
external_signaling_address=198.51.100.20
external_media_address=198.51.100.20

[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
cert_file=/etc/asterisk/keys/example/fullchain.pem
priv_key_file=/etc/asterisk/keys/example/private.key
method=tlsv1_2
verify_server=yes
require_client_cert=no

AOR and contact location

[carrier-aor]
type=aor
contact=sip:sip.example.net:5060
qualify_frequency=60
qualify_timeout=3.0

A static contact tells Asterisk where to send requests. max_contacts applies when contacts are created by inbound registration and is not a substitute for a static trunk contact. Qualification can show whether OPTIONS receives a response, but “Available” does not prove call admission, destination authorization or RTP.

Outbound authentication

[carrier-auth]
type=auth
auth_type=userpass
username=EXAMPLE_USERNAME
password=LOAD_FROM_PRIVATE_DEPLOYMENT_PROCESS

The public example intentionally contains no working credential. Keep the actual file readable only by the service account and authorized administrators, and do not place it in source control or tickets. Digest challenges may expose usernames and derived responses in traces, so redact those fields even though the plaintext password is not present.

Endpoint policy

[carrier-endpoint]
type=endpoint
transport=transport-udp
context=from-carrier-restricted
disallow=all
allow=ulaw,alaw
aors=carrier-aor
outbound_auth=carrier-auth
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
from_user=+12025550123

The endpoint combines channel policy. Context isolation prevents an inbound peer from reaching unrestricted dialplan destinations. Codec order must reflect both licensed capability and the peer agreement. NAT options should address observed packet behavior, not be enabled reflexively; direct_media=no keeps Asterisk in the media path, which simplifies control but consumes relay resources.

Outbound registration when required

[carrier-registration]
type=registration
transport=transport-udp
outbound_auth=carrier-auth
server_uri=sip:sip.example.net
client_uri=sip:EXAMPLE_USERNAME@sip.example.net
contact_user=carrier-inbound
retry_interval=60
forbidden_retry_interval=600
expiration=300

Registration-auth trunks use REGISTER to establish a binding. An IP-authenticated trunk may not register at all, so “No registrations found” can be correct. A registered state proves only the REGISTER transaction; it does not prove INVITE authorization, route capacity, called-number policy or media.

$ sudo asterisk -rx "pjsip show registrations"

 <Registration/ServerURI................>  <Auth.........>  <Status.....>
==========================================================================
 carrier-registration/sip:sip.example.net  carrier-auth    Registered

Inbound identify mapping

[carrier-identify]
type=identify
endpoint=carrier-endpoint
match=203.0.113.10

The identify object maps packets from the documentation address to the endpoint. Confirm the packet source at Asterisk, including any authorized proxy or SBC; do not add broad networks simply to make matching succeed. If the source is not stable, use the peer’s supported identification model and document its trust boundary.

Restricted outbound test dialplan

[from-internal-test]
exten => _+120255501XX,1,NoOp(Controlled documentation-range test)
 same => n,Set(CALLERID(num)=+12025550123)
 same => n,Dial(PJSIP/${EXTEN}@carrier-endpoint,30)
 same => n,Hangup()

The narrow example pattern avoids creating an unrestricted international route. Replace it only through an approved dialplan design with authentication, authorization, fraud limits and emergency-service handling. Validate the selected context and a single authorized test destination before expanding scope.

RTP range and firewall alignment

[general]
rtpstart=10000
rtpend=20000
strictrtp=yes

The firewall and NAT policy must match the locally configured range, but the peer’s media addresses may differ from its SIP address. Do not assume 10000–20000 is universal. After changing the range, validate that active calls are not disrupted and that sufficient ports remain for expected concurrency.

Validate objects before a call

sudo asterisk -rx "pjsip show transports"
sudo asterisk -rx "pjsip show endpoints"
sudo asterisk -rx "pjsip show endpoint carrier-endpoint"
sudo asterisk -rx "pjsip show aor carrier-aor"
sudo asterisk -rx "pjsip show registrations"
sudo asterisk -rx "pjsip show contacts"

Controlled SIP debugging

asterisk -rvvv
pjsip set logger on
# place one authorized test call and record UTC time
pjsip set logger off

Correlate Call-ID across request and response, CSeq across each method, Via for transaction return paths, From and To for dialog identity, and P-Asserted-Identity only inside an authorized trust domain. Enable logging for the shortest necessary interval; high-volume logging can expose identifiers and consume storage.

Narrow packet capture

sudo tcpdump -ni any host 203.0.113.10 and port 5060
sudo tcpdump -ni any host 203.0.113.10 and udp portrange 10000-20000

The first filter observes UDP signaling to the documented peer; the second observes only the configured example media range. If the peer uses TLS, tcpdump can confirm TCP/TLS establishment but not decrypted SIP content. Never leave an unbounded production capture running. Protect packet files as sensitive records and delete them under the incident retention policy.

Controlled test matrix

Failure matrix

Rollback and recovery

Stop testing, disable verbose logging, preserve the Call-ID and failure evidence, then restore only the changed sections from the timestamped backup. Validate the restored syntax and object state before resuming traffic. If a transport change requires a restart on the installed release, use an approved window and confirm active channel drain. Rollback is complete only when baseline registration, signaling and two-way RTP tests match the pre-change record.

Related engineering resources

Inputs you need from your peer