Home » Search results for 'sip' (Page 2)
Search Results for: sip
The Most Versatile VoIP Provider: FREE PORTING
JUST RELEASED: Visit the Incredible PBX WikiBest of Both Worlds: Safely Marrying Asterisk to OpenSIPS
Last week we introduced OpenSIPS, the multi-functional, multi-purpose signaling SIP server which can fulfill almost any communications function one can dream up except the unified communications tasks typically performed with a PBX such as Asterisk®. Today we want to marry the two platforms to give you the best of both worlds. For Incredible PBX® users, the primary advantage of adding an OpenSIPS front end is the elimination of the complexities associated with interacting with your PBX from remote sites with ever changing, dynamic IP addresses coupled with NAT firewalls over which you have no control. While there are many approaches to interconnecting the two platforms, we’re not comfortable with the exposure that a simple registration passthrough design introduces for many Asterisk users. Instead we prefer a model that lets everybody contact you and your users without providing the world the access necessary to allow anonymous strangers a platform from which to launch endless attempts to compromise your Asterisk server and individual Asterisk accounts.
Not all users on an Asterisk PBX need anonymous lurkers to have worldwide, public access to their individual phones. For most, DIDs suffice for public access. For users that do need such access, we will begin by creating a SIP account on your OpenSIPS server that is separate and apart from your Asterisk user account or extension. Also keep in mind that anonymous SIP calls require a match on the SIP URI to reach the person or function desired. You can enable and disable these SIP URI-accessible functions on your OpenSIPS server as desired. And you can determine how obscure to make each of the SIP URIs. Security through obscurity works and deters many SIP attacks. Now let’s address what you can and cannot do with this setup.
Using a SIP phone from anywhere in the world, any SIP user CAN:
- Make SIP URI calls to authorized extensions and ring groups on your Asterisk PBX
- Make SIP URI calls to authorized clients registered to a 3CX PBX with a SIP UUID
- With a legitimate password, make DISA-like calls with Asterisk trunks, if enabled
- With an invalid DISA password, converse with Lenny
- With a legitimate password, check and manage authorized Asterisk voicemail accounts
- With a legitimate password, participate in authorized Asterisk conferences
- Access other authorized Asterisk applications available from Asterisk extensions
Using a SIP phone from anywhere in the world, an OpenSIPS-registered User also CAN:
- Make PSTN calls from OpenSIPS-registered SIP phones, if enabled
- Receive calls from Asterisk forwarded to any OpenSIPS-registered SIP phone
- Receive calls from Asterisk forwarded to any 3CX-registered client or SIP phone
Using any SIP phone registered to a SIP proxy, you CANNOT:
- Log into any Asterisk user account without whitelist permission and credentials
- Make 911 calls
Prerequisites: To complete today’s setup, we’re assuming you have (1) an Incredible PBX server running Asterisk 13, (2) an OpenSIPS server built with version 1.2.0 or later of the Incredible PBX for OpenSIPS installer, and (3) either a registered SIP account and SIP URI on your OpenSIPS PBX or a SIP account with a provider such as a free linphone.org account.
Running pbxstatus on your OpenSIPS server will tell you which version you have. If you don’t have pbxstatus or the version is below 1.2.0, please initialize your Debian 8 platform, download the latest release, and reinstall following the our OpenSIPS tutorial here. There were major changes in the OpenSIPS configuration to support Asterisk connectivity which made an in place upgrade too complex. Our apologies.
Before creating user accounts on your OpenSIPS server, give some thought to a numbering scheme that won’t conflict with extension registrations on your Asterisk server. For example, if your Asterisk server uses extensions 701 through 750, then you may wish to consider using 7701 through 7750 on your OpenSIPS server. The one-to-one match keeps things simple without running into conflicts between the Asterisk extension numbers and the OpenSIPS user accounts. We’ll use the 700 (Asterisk) and 7700 (OpenSIPS) extension ranges in our examples which follow. And we’ve reworked the original OpenSIPS tutorial in keeping with this design to simplify Asterisk integration for new readers just joining the party.
We want to express our sincere appreciation to Bill Simon for his patient tutelage in walking us through some of the potential landmines in marrying an OpenSIPS server with Asterisk. Should your organization ever need professional help with a SIP deployment, there is no finer SIP authority than Simon Telephonics.
1. Configuring Asterisk for Inbound OpenSIPS Calls
Assuming you have an Incredible PBX 13 platform, open the GUI as admin using a browser from your desktop. First, let’s create a Trunk for the OpenSIPS server. Choose Connectivity -> Trunks -> Add SIP (chan_sip) Trunk. For Trunk Name, use opensips. Next, click on the SIP Settings tab in the dialog. For Trunk Name, again use opensips. In PEER DETAILS, enter the following and replace xxx.xxx.xxx.xxx twice with the actual IP address of your OpenSIPS server. Then click Submit and Reload Dialplan when prompted.
type=peer host=xxx.xxx.xxx.xxx context=from-opensips insecure=port,invite disallow=all allow=ulaw deny=0.0.0.0/0.0.0.0 permit=xxx.xxx.xxx.xxx/255.255.255.255
Next, using SSH or Putty, login to your Asterisk server as root and issue these commands replacing xxx.xxx.xxx.xxx with the IP address of your OpenSIPS server (choose option 0 when prompted for access type):
cd /root ./add-ip opensips xxx.xxx.xxx.xxx wget http://incrediblepbx.com/from-opensips.tar.gz tar zxvf from-opensips.tar.gz rm -f from-opensips.tar.gz nano -w from-opensips.txt
When the editor opens, scroll down to line 16 and enter a very secure PIN (up to 10 digits) for access to the DISA-like service to make outbound calls via SIP URI. It’s your phone bill so make it long (up to 10 digits) and something that is not easily guessed. On line 20, we have configured DISA for numbers up to 11 digits. If your dialplan requires international dialing support, you can adjust 11 to the desired number of digits. Then save the file and copy the dialplan code into extensions_custom.conf and reload your dialplan:
cd /etc/asterisk cat /root/from-opensips.txt >> extensions_custom.conf asterisk -rx "dialplan reload"
IMPORTANT NOTE: Just because you have configured this DISA option on your Asterisk server does not mean it is available via SIP URI. In fact, no SIP URI access to your Asterisk server is enabled at this juncture. You still must set up the SIP URI connections on your OpenSIPS server. Whether to do that and which features to activate are completely up to you.
2. Configuring OpenSIPS for Asterisk Connectivity
Beginning with version 1.2.0 of the Incredible PBX installer for OpenSIPS, the server itself is preconfigured to support Asterisk connectivity using AVPs. Implementation only requires command line execution of an AVP script to enable each feature you wish to activate. A similar script can be used to deactivate any AVP feature previously activated. To install the scripts on your OpenSIPS server, log in as root using SSH or Putty and issue these commands:
cd /root wget http://incrediblepbx.com/asterisk-features-for-opensips.tar.gz tar zxvf asterisk-features-for-opensips.tar.gz rm -f asterisk-features-for-opensips.tar.gz
The function of each of the Asterisk scripts is self-explanatory from the script names:
- asterisk-add-forward
- asterisk-delete-forward
- asterisk-list-forwards
Three pieces of information are required to add a SIP URI forward from OpenSIPS to your Asterisk server using the AVP asterisk-add-forward script:
- UUID of SIP URI (from any SIP phone, dial UUID@opensips.yourdomain.com to connect)
- Asterisk Extension (destination where incoming OpenSIPS call should be forwarded)
- Asterisk Public IP Address
To add a SIP URI for extension 701 on your Asterisk server at xx.xx.xx.xx reachable at 701@opensips.yourdomain.com, the command would look like this where xx.xx.xx.xx is the public IP address of your Asterisk server and opensips.yourdomain.com is the FQDN of your OpenSIPS server: /root/asterisk-add-forward 701 701 xx.xx.xx.xx
CAUTION: Other than for forwards like this, do NOT set up User accounts in the OpenSIPS Control Panel using the same numbers as existing extensions on your Asterisk server. Otherwise, if your SIP phone is registered to a 701 user account on your OpenSIPS server, you lose the ability to connect to any extension on your Asterisk server if a 701 account requiring registration also existed on the Asterisk platform.
To use a name in the SIP URI or enable a second SIP URI for the same Asterisk 701 extension (jdoe@opensips.yourdomain.com): /root/asterisk-add-forward jdoe 701 xx.xx.xx.xx
Simply repeat the steps above for every SIP URI you wish to enable for an Asterisk extension.
To enable DISA-like access via SIP URI using dial as UUID (dial@opensips.yourdomain.com): /root/asterisk-add-forward dial *1 xx.xx.xx.xx
Keep in mind that you need not use "dial" as the UUID. You can make up any name you like. So long *1 is the DISA extension, the UUID can be as obscure as desired e.g. disa5038now.
For voicemail access via SIP URI, you can do it in two ways. For generic access triggering prompts for both the voice mailbox number and the mailbox PIN, use the following: /root/asterisk-add-forward vm *98 xx.xx.xx.xx
For voicemail access to a specific mailbox (701) with only a prompt for the mail PIN, use: /root/asterisk-add-forward vm701 *98701 xx.xx.xx.xx
For access to a specified conference (2663) with a prompt for the conference PIN, use: /root/asterisk-add-forward conf2663 2663 xx.xx.xx.xx
For access to Weather Reports (947) with a prompt for the ZIP Code, use something like this: /root/asterisk-add-forward weather 947 xx.xx.xx.xx
For News Headlines (951), use: /root/asterisk-add-forward news 951 xx.xx.xx.xx
To delete any previously created UUID forward: /root/asterisk-delete-forward
To list existing UUID forwards for SIP URIs: /root/asterisk-list-forwards
Calling Tip: If your softphone is registered to an OpenSIPS User account, you can call any of the enabled forwarding entries by entering the UUID without @opensips.yourdomain.com, e.g. dialing vm would connect to the Asterisk voicemail system with a prompt for mailbox.
3. Enabling Inbound Calls from Asterisk to a SIP Phone
In today’s design, incoming calls to your Asterisk PBX can be forwarded to a user account on your OpenSIPS server or a free linphone.org user account by (1) creating a free User account in the OpenSIPS Control Panel or at linphone.org, (2) logging into that user account with a SIP phone or softphone, (3) creating a custom extension in the Incredible PBX GUI that points to the SIP URI of your user account on the OpenSIPS server or your free linphone.org SIP user account or a 3CX client, and (4) adding that custom extension to either a Ring Group that includes your Asterisk extension or enabling FindMe/FollowMe for your Asterisk extension and designating the custom extension as the No Answer Destination. Need support for multiple Asterisk users? Not a problem. Repeat the drill for each user.
The procedure for adding a User Account in the OpenSIPS Control Panel was covered in last week’s article. The procedure for creating a free Linphone User Account was covered in an earlier article so we won’t repeat it here. Another obvious SIP URI destination is any 3CX Client if you’ve previously set up a free 3CX server following our 3CX tutorial. Refer back to those articles if you need a refresher.
On the Asterisk side, login to the Incredible PBX GUI as admin with your favorite browser. Then choose Applications -> Extensions -> Add Custom Extension. For the User Extension and Display Name, we recommend using the 7701 numbering scheme for remote accounts. Then click on the Advanced tab and enter the SIP URI of your OpenSIPS, Linphone, or 3CX User account as the Dial option, e.g. SIP/yourname@sip.linphone.org or SIP/7701@opensips.yourdomain.com. Click Submit and Apply Config to reload dialplan.
To assure that incoming calls ring on both your Asterisk phone (701) and your registered SIP phone, we recommend setting up a Ring Group on the Asterisk side that includes both the 701 extension and the new 7701 custom extension. Then adjust your Inbound Routes to point to the number of this Ring Group instead of to 701. In this way, you can preserve the voicemail functionality associated with your 701 extension. FYI: None of these servers proxy audio and video of your calls. They provide a SIP registration service only.
The other alternative to a Ring Group is to enable FindMe/FollowMe in the 701 extension settings and then specify Extension:701 as the No Answer Destination. With this approach, voicemail will never be triggered on calls sent to extension 701 on your PBX. Since OpenSIPS lacks voicemail, you would lose calls not answered on your registered SIP phone or softphone.
TIP: We use 3CX clients exclusively for inbound calls on iPhones and Android devices because we have found they are far superior in dealing with both push notifications and NAT routing. 3CX clients actually ring when someone calls AND you can hear both sides of every call.
4. Outbound PSTN Calling from OpenSIPS
The DISA setup documented above allows your existing Trunks to continue to be managed and secured exclusively on your Asterisk server with no trunk exposure on the OpenSIPS platform at all. Thus, if either your public-facing OpenSIPS server or Linphone is ever compromised, nobody will be able to make any calls on your nickel because there will be no trunks available to process the outbound calls. Your DISA password is never exposed.
For some (like us), a two-step outbound calling procedure is just too painful. In that case, with providers such as Skyetel, you can deploy a PSTN calling platform on both your Asterisk server and on OpenSIPS. We documented the Skyetel trunk setup for OpenSIPS in our tutorial last week. The good news is nothing precludes deployment of Skyetel at multiple sites even if you only use Skyetel on the OpenSIPS platform for outbound calling. And this completely avoids implementing a DISA solution which has security implications of its own. Effective 10/1/2023, $25/month minimum spend at Skyetel is required.
Enabling direct PSTN calling with OpenSIPS means nobody can ever make PSTN calls merely by guessing a SIP URI. It requires an actual SIP registration to OpenSIPS, and you have Fail2Ban to assist with securing that process. So the outbound calling design is completely up to you. Direct PSTN calling from OpenSIPS is no less safe so long as none of your OpenSIPS User account passwords are compromised.
5. Enabling Calls from Asterisk to OpenSIPS Users
For OpenSIPS AVP forwards that have been enabled to Asterisk extensions, you probably will also want to provide a way for Asterisk users to return those calls directly to OpenSIPS users since that will be the CallerID that displays when an OpenSIPS user places a call directly to a forwarded Asterisk extension. Assuming a SIP phone has been registered to User account 7709, when that OpenSIPS user places a call to a forwarded Asterisk extension 701, it means the Asterisk user will see 7709 displayed as the CallerID for the incoming call even though the User of the OpenSIPS 7709 extension may also be associated with extension 709 on the Asterisk side. If the Asterisk callee attempts to return the call by dialing 7709 instead of 709, the call would fail. To avoid confusion by Asterisk users, the simple solution is to add an additional Custom SIP extension for every OpenSIPS User account.
For example, on the Asterisk side, login to the Incredible PBX GUI as admin with your favorite browser. Then choose Applications -> Extensions -> Add Custom Extension. For the User Extension, enter 7709. For the Display Name, enter the name of the person using that OpenSIPS user account. Next, click on the Advanced tab and enter the SIP URI for this OpenSIPS User account as the Dial option, e.g. SIP/7709@opensips.yourdomain.com. Click Submit and Apply Config to reload dialplan.
FYI: Matching Custom Extension numbers on the Asterisk platform to identical extensions on your OpenSIPS server does not create the registration problems we cautioned against earlier. Only Asterisk extensions requiring actual SIP registration need to remain unique from accounts on your OpenSIPS platform.
6. A Few Words About Security 
If you’ve been using Incredible PBX with its Travelin’ Man 3 firewall, it’s not unlike living in a gated community where most of the outside world doesn’t even know you exist. Adding a "second home" with OpenSIPS is not unlike buying a summer place next door to Fred Sanford in Watts. You might as well have set up shop in the middle of Russia because, for all intents and purposes, you have. Anybody in the world can guess your IP address and spend the day trying to break into your server. So the name of the game is vigilance. Especially for the first few weeks, you need to run iptables -nL regularly and see how quickly your Fail2Ban blacklist is filling up. If you heeded our advice and set up your OpenSIPS server on a KVM platform (instead of OpenVZ), we’ve got a handy little script that will let you move bad guys snagged by Fail2Ban to the permanent IPset blacklist. Just download the script and run it daily to move the Fail2Ban entries to permanent block status in the IPset blacklist:
cd /root wget http://incrediblepbx.com/move-fail2bans-to-ipset.tar.gz tar zxvf move-fail2bans-to-ipset.tar.gz rm -f move-fail2bans-to-ipset.tar.gz ./move-fail2bans-to-ipset
Once you have verified that the IP addresses actually are being populated in the IPset blacklist table (ipset list | sort), you can add the script to /etc/crontab to run automatically each night:
echo "2 4 * * * root /root/move-fail2bans-to-ipset > /dev/null 2>&1" >> /etc/crontab
If you’d like a head start on your IPset blacklist, simply download our latest list and then reboot your server:
cd /etc wget http://incrediblepbx.com/badguys.tar.gz tar zxvf badguys.tar.gz rm -f badguys.tar.gz
Another potential vulnerability is SSH. This command will tell you who has attempted to login to your server as root: cat /var/log/auth.log | grep password. If you ever see a failed login and it wasn’t a mistake on your part, change your SSH access port immediately if not sooner: nano -w /etc/ssh/sshd_config. Then restart SSH: /etc/init.d/ssh restart. Better yet, set up SSH public key authentication.
The other major consideration is the number of holes you punch into the security of your Asterisk server using the OpenSIPS asterisk-add-forward script. Every time you add an extension to this list, you open another (read-only) window into your Asterisk communications world. And anybody can connect to these extensions using either the FQDN of your OpenSIPS server or its IP address. Even though we don’t practice what we preach, we strongly recommend using alphanumeric UUIDs instead of numbers for these access points. That at least avoids random calls from bad guys that are accustomed to numeric numbers only in SIP URIs. Regularly review your OpenSIPS log for unusual strings of forwarded calls and adjust your forwarding UUIDs accordingly: cat /var/log/opensips.log | grep forwarded.
In our previous article, we’ve already addressed how important it is to limit User accounts to your FQDN and never the IP address of your OpenSIPS server. In this way, you limit OpenSIPS registration exposure to your FQDN and never the IP address of your server. Fail2Ban also assists here by blocking failed login attempts after a single failure unless you have whitelisted the IP address in Fail2ban’s ignoreip list in /etc/fail2ban/jail.conf and restarted Fail2Ban with this command: /etc/init.d/fail2ban restart. These are the only entry points that offer the ability to actually register to your server. AVPs never do. Obviously, a successful SIP registration is much more dangerous than a random phone call on a SIP URI set up using AVP extension forwarding.
Finally, passwords now matter on your Asterisk PBX for any port forward you’ve established with OpenSIPS. For example, if you’ve set up a generic forward to access voicemail, then it means anybody guessing the SIP URI you created can spend the day (at no cost) attempting to break into ANY voicemail account on your Asterisk server by guessing the PIN. Fail2Ban will not protect you here. If you’ve set up DISA-like access to your Asterisk server on OpenSIPS, then the same applies except now the attacker gets a blank check to make commercial calls if they can guess your access PIN. Worried yet? We hope so. Sure beats a $100,000 phone bill.
7. Taking OpenSIPS for a Test Drive 
We usually provide a Demo Line for readers to try out our latest creations. For obvious reasons, we prefer not to disclose our OpenSIPS FQDN to the general public. But we have set up a port forward from a DID that we temporarily configured on our OpenSIPS server. So, if you’d like to sample the voice quality of placing a call to a DID in Atlanta forwarded to an OpenSIPS server in New York forwarded to an Asterisk server in Miami and then back to you, try calling 843-606-0555 for a weather report in your favorite ZIP code. We’re betting you will be dumbfounded by the quality of the call. Enjoy!
Originally published: Monday, May 20, 2019
Need help with Asterisk? Visit the VoIP-info Forum.
Special Thanks to Our Generous Sponsors
FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.
BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.
The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.
VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
The 5-Minute Wonder: OpenSIPS Server Takes the Cake
We covered Kamailio in our Part I article. And we’ve skipped writing about SIP server contestants two, three, and four because they each had a healthy dose of insurmountable problems… at least for us. So today we’re pleased to present Part V in our SIP server series. And, as the headline exclaims, with OpenSIPS we’ve found a platform that finally is worthy of your attention. Our requirements were fairly straightforward. We wanted an open source SIP server to which we could connect users to make and receive free as well as commercial calls worldwide. We also wanted a SIP server with good documentation that was simple to install and to integrate into our existing Asterisk platforms without hiring a consultant. And finally we were searching for a SIP server that could be secured easily without providing free phone service to every bad guy on the planet. OpenSIPS has it all.
OpenSIPS is a multi-functional, multi-purpose signaling SIP server used by carriers, telecoms or ITSPs for solutions like Class4/5 Residential Platforms, Trunking / Wholesale, Enterprise / Virtual PBX Solutions, Session Border Controllers, Application Servers, Front-End Load Balancers, IMS Platforms, Call Centers, and many others. Source: opensips.org
We’ve often complained that the problem with many open source projects is that the developers get so focused on making money that they skimp on the documentation to encourage consulting work or participation in expensive conferences. We have found just the opposite with OpenSIPS. In fact, much of today’s implementation is based upon an excellent tutorial by the folks at PowerPBX. Down the road, if you find yourself in need of a consultant, their services would be a good place to start. What we’ve added to the PowerPBX design is security, support for clients behind NAT-based routers, and an integration scheme for Asterisk®, FreePBX®, and Incredible PBX® platforms so that you get the best of both worlds, a public facing SIP server with the UC feature set that most organizations expect. Last but not least, our turnkey GPL installer will get you up and running in about 5 minutes.
Choosing a KVM/OVZ7 Platform for OpenSIPS
Let’s begin by addressing the appropriate platform for an OpenSIPS server. The server needs to have a public IP address that is static, and the server should not be situated behind a NAT-based router. It only complicates things and is beyond the scope of what we plan to address. For those that are frequent visitors, you already know that we’ve been pushing everyone to kiss their local hardware goodbye and join the cloud revolution. When it comes to public-facing VoIP platforms like OpenSIPS, most of us don’t have a choice. You need a static IP address on the open Internet. And, for the sake of security, a KVM or OVZ7 cloud platform is a must since older OpenVZ platforms don’t support the ipset component of IPtables which makes it easy to block hundreds of thousands of IP addresses without a performance hit on your server. While we previously have identified older OpenVZ providers for our Incredible PBX platforms protected by the Travelin’ Man 3 firewall, pure whitelist access simply isn’t an option if you wish to retain the functionality of a VoIP application such as OpenSIPS.
Ten to twenty gigabytes of disk space should be more than ample for OpenSIPS. The amount of RAM in your server depends upon the volume of calls your server will be handling. If it’s a dozen simultaneous calls then 1GB of RAM will suffice. If it’s 100,000 calls, then take a look at this article for tips on sizing your server. For today’s implementation, we’ll be using Debian 8 so any low-cost provider or KVMs at Digital Ocean, Vultr, and OVH should be fine.1
We recently went on the hunt to identify KVM or OVZ7 cloud providers around the world that could offer a KVM VPS with 1GB RAM, 20GB storage, and 1TB of monthly bandwidth for about $25 a year. No small feat! But our friends at LowEndTalk have come through. Read the message thread and find an offer with a site that best meets your requirements. Many of the KVM offers require you to open a ticket to get the special pricing and configuration outlined above. Here’s a short list of our favorites, but remember to only use the KVM or OVZ7 offerings below for OpenSIPS!
| Provider | RAM | Disk | Bandwidth | Performance as of 12/1/19 | Cost |
|---|---|---|---|---|---|
| CrownCloud KVM (LA) | 1GB | 20GB + Snapshot | 1TB/month | 598Mb/DN 281Mb/UP 2CPU Core | $25/year Best Buy! |
| Naranjatech KVM (The Netherlands) | 1GB | 20GB | 1TB/month | Hosting since 2005 VAT: EU res. | 20€/year w/code: SBF2019 |
| BudgetNode KVM (LA) | 1GB | 40GB RAID10 | 1TB/month | Also available in U.K PM @Ishaq on LET before payment | $24/year |
| FreeRangeCloud KVM (Ashburn VA, Winnipeg, Freemont CA) | 1GB | 20GB SSD | 3TB/month | Pick EGG loc'n Open ticket for last 5GB SSD | $30/year w/code: LEBEGG30 |
Choosing OpenSIPS Components to Deploy
We’ve divided up today’s tutorial into bite-sized pieces so that you can pick and choose where to stop implementing and start using. You do not need to have an Asterisk server to make and receive calls with OpenSIPS. However, OpenSIPS lacks voicemail and AutoAttendant/IVR components so, if those are a requirement, then you either need a VoIP service provider that offers them, or deploy a $50 Incredible PBX for the Raspberry Pi to add the missing pieces.
What OpenSIPS offers is a free server platform for worldwide SIP communications so that you, your friends, and business associates can call or connect from anywhere using freely available SIP softphones or any of dozens of SIP telephone instruments. We’ll stick with softphones for today, but hardware-based SIP telephones are equally simple to deploy.
This is not a criticism because it is one of the best tutorials we’ve ever used but, if you want to see how complex a typical OpenSIPS server deployment is, take a look at the PowerPBX tutorial we used as a starting point with OpenSIPS. We’ve compressed most of those procedures into a turnkey installer that only requires you to enter a MySQL root password of passw0rd (with a zero) once you have your Debian 8/64 platform up and running.
Deploying a Debian 8 Server Platform
Start by choosing a cloud provider that offers the 64-bit Debian 8 minimal platform as a deployment option. Most do. As noted, we recommend a KVM or OVZ7 platform, but older OpenVZ platforms perform equally well minus support for ipset which makes it easy to block entire countries overrun with bad guys. Choose offerings with at least 1GB RAM and a 10GB drive to get started. Configure your Debian 8 server with a fully-qualified domain name (FQDN). This is critically important with our security design because we will assign all OpenSIPS users/extensions to this FQDN and reserve your server’s IP address purely for connections from service providers and Asterisk servers. This makes it all but impossible for anyone to hack into your server since most script kiddies launch attacks on IP addresses, not FQDNs. Using an unusual FQDN adds an extra layer of security, but that’s your call. If you lack the ability to assign FQDN aliases to a domain which you own, you can obtain a free FQDN from numerous sources including ChangeIP and point it to the IP address of your OpenSIPS server.
Installing OpenSIPS on a Debian 8 Server
Now the fun begins. Log into your Debian 8 server as root and issue the following commands to prepare for the OpenSIPS install:
cd /root wget http://incrediblepbx.com/opensips.tar.gz tar zxvf opensips.tar.gz rm -f opensips.tar.gz
After untarring opensips.tar.gz above, there’s one extra step for those using KVM or OVZ7 platforms. Do NOT make this change if you’re on an older OpenVZ-based server (not recommended!) that shares its kernel with the host machine. Otherwise, the firewall startup will always fail. For KVM and OVZ7 platforms only, issue the following command: cp -p /root/kvm/* /root
Make sure you have logged into your Debian 8 server as root using SSH or Putty from a desktop PC that you will use to manage OpenSIPS with a browser. The reason is because this IP address automatically will be whitelisted in the OpenSIPS firewall as part of the install process. Otherwise, you will need to manually log into SSH and whitelist the IP address of your desktop PC using /root/add-ip each time you wish to access the OpenSIPS Control Panel since TCP port 80 (HTTP) is not exposed to the public Internet as a security precaution.
To begin the install, issue this command:
/root/install
As the install progresses, you’ll be prompted several times to assign and then to use the MySQL root password. Please use passw0rd (with a zero) as your MySQL password, or the install will fail. This is NOT a security risk unless your Debian 8 root user account is compromised. And, in that case, it won’t matter anyway since the MySQL password could easily be changed. The rest of the install is self-explanatory. There are a couple of steps where you will be prompted for input. Correct responses are indicated before the various prompts. Pay particular attention when you are prompted to change the SSH port from TCP 22 to a port number in the 1000-2020 range as a security precaution. We recommend using the year you were born because it will be easy for you to remember. When the install finishes and you log out of your server, the next SSH login will look like this where XXXX is the SSH port you chose and yyy.yyy.yyy.yyy is the OpenSIPS server address: ssh -p XXXX root@yyy.yyy.yyy.yyy
Although most of the configuration of your OpenSIPS server will be handled using a web browser and the OpenSIPS Control Panel GUI, we’ve included a few scripts in /root to assist with maintenance of your server platform. Here’s a brief summary of the script functions:
- pbxstatus – Status of your OpenSIPS server (image sample above)
- add-ip – Temporarily WhiteList IP address until next iptables-restart
- ban-ip – Permanently Ban an IP address
- unban-ip – Unban a previously banned IP address
- log-purge – Zero out all of the major Linux log files
- opensips-check – Assures OpenSIPS and RTPproxy are running (runs automatically)
- Fail2Ban BlackLists –
iptables -nL | grep -A100000 "opensips (" - IPset BlackList (KVM/OVZ7 platforms only) –
ipset list | sort
We secure your server in several ways: (1) by disguising the SSH port, (2) by locking down almost every port on your server with the IPtables firewall with the exception of the SIP ports, (3) by deploying Fail2Ban to scan your OpenSIPS log for errors and lock out attackers for an extended period of time, and (4) by deploying the IPset blacklist on KVM/OVZ7 platforms. With this design, there is a symbiotic relationship between IPtables, Fail2Ban, and IPset. Therefore, it is critically important that you only restart these services using the iptables-restart command. NEVER issue other IPtables commands to restart or save your firewall settings.
Activating a SIP Server with OpenSIPS Control Panel
We don’t want to overload you on the first day with your new OpenSIPS platform so we’ll walk you through the preliminary setup steps to create your SIP Domain. Then we’ll show you how to set up user accounts (also known as extensions). Finally we’ll walk you through setting up a trunk to make and receive calls from a commercial SIP provider. When we’re finished today, you’ll be able to make and receive calls using SIP URIs or DIDs which you have purchased from a provider. Then next week we’ll focus on integration of OpenSIPS with an Asterisk platform of your choice using Incredible PBX and FreePBX as an example. Once we’re finished, you’ll be able to handle user account registrations exclusively on your OpenSIPS server while leaving your Asterisk platform completely hidden from public exposure.
Logging into the OpenSIPS Control Panel
As deployed, the OpenSIPS Control Panel is accessible via web browser. As noted previously, HTTP Port 80 access is blocked by default unless the IP address of your desktop PC has been whitelisted either as part of the initial install or using the add-ip script in /root. Once your desktop PC’s IP address is whitelisted, point your browser to http://xxx.xxx.xxx.xxx/cp
The default Username is admin, and the default password is opensips. Once you’re logged in, immediately click on the Users icon in the upper-right corner of the dashboard. Then click the Edit Info pencil icon for user Admin and change your password. Click Save when done.
Creating Domains with OpenSIPS Control Panel
In the Left column of the Dashboard, you’ll see two tabs: Users and System. Click on the System tab to expose the available choices. Then choose the Domains option.
Domains are the essential building blocks in OpenSIPS. You can manage one or a hundred domains on a single OpenSIPS server, and each domain can have its own set of Users, Trunks/Gateways, and Dialplan rules. We’re actually going to create two domains, one for the IP Address of your OpenSIPS server and a second one for the FQDN of your OpenSIPS server. For added security, we will create all User accounts under the FQDN Domain. And we’ll reserve the IP Address Domain for DID Trunks/Gateways from registered, commercial SIP providers. This design allows attackers to attempt to register to accounts on your IP Address Domain until the cows come home, and they will never be successful because there are no existing SIP user accounts there. Keep it that way! With our OpenSIPS design, Fail2Ban will block attackers after a single failed registration attempt. And OpenSIPS itself will identify and block all SIP flood attacks using either Fail2Ban or IPset (on KVM and OVZ7 platforms only).
Now that you understand the design, let’s set up your domains. After choosing System -> Domains, enter the IP Address of your OpenSIPS server at the SIP Domain prompt. Then click Add New Domain followed by Reload on Server. Repeat the same steps to enter the fully-qualified domain name (FQDN) of your OpenSIPS server. When finished, you should see:
Creating Users with OpenSIPS Control Panel
We’ve already explained the security implications and reason for creating User accounts with your FQDN Domain only. Click on Users -> User Management -> Add New to get started. You can use Numbers (what we call Extensions in Asterisk) or Names. Our preference is to use Numbers for the User accounts and then to create Alias Names (as desired) for each User account. You can’t dial names from most SIP telephones. This also keeps the design similar to what many are used to coming from the Asterisk environment. A completed dialog would look something like the following. Use the Domain pull-down to choose your FQDN. Obviously, the passwords must be secure and must match. Then the Register button will be enabled to save. The actual Numbers used for Usernames are completely up to you.
Create at least a couple User accounts so that you can set up two SIP phones to call yourself and verify that everything is working. These User accounts become an integral part of the SIP URI to receive calls from any SIP phone in the world:
7701@opensips.yourdomain.com
Before you can actually answer an incoming call to your SIP URI, you’ll need to register the User account using either a softphone or SIP phone. We’ll do that next. But, first, let’s create an Alias to 7701 User so that folks can reach you by calling joe@opensips.yourdomain.com
Click on Users -> Alias Management -> Add New Alias to get started. Fill in the form using the example below. Make sure that you select your FQDN Domain using the pull-downs for BOTH the Domain and Alias Domain fields. Then click Add to save.
Registering a Softphone to an OpenSIPS User Account
There are literally dozens of free SIP soft phones from which to choose. We covered some of our favorites for every platform in previous articles. For our purposes today, we recommend you choose one of the Linphone softphones which are available for the PC, Mac, Linux, Android, and iOS platforms. We also recommend signing up for a free Linphone.org SIP account which doesn’t cost you anything. For today, we will be configuring the softphone to register to your new OpenSIPS server.
Once you have downloaded and installed the Linphone client, go into the Preferences menu and make the following changes. Some depend upon your calling platform.
- Audio Codecs: PCMU, G722, PCMA
- Video Codecs: VP8, H264
- Call Encryption: None
- DTMF: RFC2833 only
- Send InBand DTMF: OFF
- Send SIP INFO DTMF: OFF
- SIP UDP 5060: Enabled
- SIP TCP 5060: Enabled
- Allow IPv6: Disabled
Then set up a new SIP Proxy account: Username (7701), Password (as defined), Domain: your FQDN not IP address, Transport: UDP, Outbound Proxy: OFF, Stun Server: stun.linphone.org, ICE: ON, AVPF: OFF, Push Notification: ON, Country Code Prefix: 1 (if required by your commercial SIP provider), Register: YES, Account Enabled: YES. HINT: You can call Alias Names via SIP URI, but you can only register to a SIP account using its actual Username.
Avoiding Lockouts with NeoRouter VPN
By design, Fail2Ban is unforgiving when it comes to failed registrations. A single failed registration will get an IP address banned for a full week. The reason is because the new bad guy strategy is to hit your server once to determine whether anybody is home. Then the creep bombards you later with an endless stream of registration attempts. With our design, nobody will be home when they return. The bad news is a single failed registration attempt by you or your users will also trigger a ban. There are several workarounds. The easiest is to set up the NeoRouter client on each of your machines including your OpenSIPS server and use the 10.0.0.x private network for access. These IP addresses never get banned. Our previous tutorial will walk you through setting up a free NeoRouter server and installing the free NeoRouter clients on your machines. The client software already is installed and running on your OpenSIPS server. It only requires that you log in using nrclientcmd and register to your NeoRouter server to obtain a private IP address.
There are other options to unban an IP address which has accidentally been snagged. First, almost all of the cloud providers include a Console option in their web portals. Second, you can log into your server via SSH from any non-blacklisted IP address to remove the banned IP address. Once you’re logged in, simply run this command using the IP address you wish to unban: /root/unban-ip xxx.xxx.xxx.xxx
Choosing Commercial SIP Providers
Recall that you cannot register to a SIP alias on your OpenSIPS server. We’ll take advantage of this restriction in setting up incoming calls from commercial providers’ DIDs. To set up Trunks from commercial providers so that you can not only receive incoming calls but also make outbound calls over their PSTN network connections, you must use providers that support IP address authentication rather than a SIP registration. Many providers support this including our platinum sponsor, Skyetel, as well as providers such as VoIP.ms, Anveo Direct, V1VoIP, and many others. In our OpenSIPS design, you also can use DIDs from providers that support SIP URI forwarding such as CallCentric and LocalPhone; however, you are limited to receiving inbound calls only. VoIP communications really shines here because you don’t have to choose a single provider to meet all of your communications requirements.
Skyetel is by far the easiest provider to set up with OpenSIPS. See our earlier tutorial for a special offer that will get you half-price calling for up to $500. Effective 10/1/2023, $25/month minimum spend required. Once you’re registered on the Skyetel site, add a new EndPoint Group using the IP address of your OpenSIP server and designate UDP 5060 as the access port. Sign up for a DID and map it to the OpenSIPS Endpoint Group. Done. In the OpenSIPS Control Panel, navigate to System -> Dynamic Routing and click Add Gateway. Using the template below, create 5 Proxy gateways for the following Skyetel data centers:
- skyetel-NW 52.41.52.34
- skyetel-SW 52.8.201.128
- skyetel-NE 52.60.138.31
- skyetel-SE 50.17.48.216
- skyetel-EU 35.156.192.164
The latest installer will automatically whitelist the Skyetel IP addresses in /etc/iptables/rules.v4 just below the existing 10.8.0.0/24 rule. This will protect you in the event that one or more of the Skyetel IP addresses gets blacklisted inadvertently. You should also add the IP addresses of any other providers you need and then issue the command: iptables-restart
Next, we need to create what Asterisk users know as an Outbound Route. This tells OpenSIPS to send dialed numbers in 11-digit format to Skyetel for termination. We’ve already created the Dial Plan rule for calling out by dialing 1 plus a 10-digit number. So, while you’re still in the Dynamic Routing section of the OpenSIPS Control Panel, click on the Rules tab at the top of the template. Then click Add Rule. Begin by clicking Add ID button and choosing Group ID 0. In the Prefix field, type 1. Now click the Add GW button 3 times after choosing the Skyetel gateways in the following order from the GW pull-down list: skyetel-nw, skyetel-sw, and skyetel-se. Those are the three currently operational Skyetel gateways. When you’re finished, your template should look like the following. Then click the Add button to save the new rule. Click Reload Server to load the new rule into OpenSIPS. Then repeat this procedure leaving the Prefix field blank so that you can make 10-digit calls as well.
Finally, we need to create what Asterisk users know as an Inbound Route. This tells OpenSIPS where to send incoming calls from our Skyetel DID. OpenSIPS handles inbound routes by defining a User Alias for the Username to which you want to route the incoming DID calls. Click on Users -> Alias Management -> Add New Alias to get started. Fill in the form using the following template and then click Add.
- Username: 7701 (the extension to which to route the incoming calls)
- Domain: opensips.xyz.com (the FQDN of your OpenSIPS server)
- Alias Username: 18435551212 (the 11-digit Skyetel DID)
- Alias Domain: 11.12.13.14 (the IP address of your OpenSIPS server)
- Alias Type: dbaliases
Introducing the VoIP Blacklist
We’ve always dreamed of an effective VoIP Blacklist, and many have tried. But the crowd-sourced VoIP Blacklist at voipbl.org is the real deal. Everybody can post entries (including the bad guys) and, magically, most of the illegitimate entries get sifted out before the next day’s list is released. We’ve made this easy in two ways. First, the list gets populated every night while you sleep. At last count, there were 84,504 IP addresses. And, second, to contribute to the blacklist, run iptables -nL weekly to see if Fail2Ban has snagged any bad guys. If so, simply run the new /root/blacklist utility which will move them into your local blacklist and also format the entries for easy submission to voip.bl whenever you feel the urge. Simply issue the command cat /root/blcklist.txt to display the entries you just blacklisted. Then cut-and-paste the results and post them to the VoIP Blacklist. The whole process takes less than a minute, and you’ll be contributing to a very valuable VoIP resource while also using it.
Congratulations! You now have a functioning OpenSIPS server that can process incoming calls from SIP URIs as well as DIDs. And you can make SIP URI and 11-digit PSTN calls using your SIP softphone that’s registered to your OpenSIPS server. See you next week. Enjoy!
Continue Reading: Best of Both Worlds: Safely Marrying Asterisk to OpenSIPS
Originally published: Monday, May 13, 2019 Updated: Monday, June 24, 2019
Need help with Asterisk? Visit the VoIP-info Forum.
Special Thanks to Our Generous Sponsors
FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.
BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.
The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.
VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
- Nerd Vittles receives referral fees from some VoIP service providers to help cover the costs of our blog. We never recommend particular companies solely to generate commissions. We also test all services that we recommend. [↩]
Meet Linphone: Free Worldwide Calling to Anybody with SIP
Earlier this year we demonstrated how to set up a publicly-accessible Asterisk® server to enable free worldwide calling using SIP URIs which are email-like addresses for VoIP and video calls. But not everyone has an Asterisk server so today’s tutorial extends free calling to everyone with a Windows or Linux PC, a Mac, or any smartphone or tablet. All you need is a desktop computer with wired or wireless Internet access or, on a smartphone or tablet, a cell data plan or WiFi connection will suffice. When friends sign up, their calls also will be free.
The secret sauce on all of these platforms is the Linphone app (shown above) which can be downloaded and used at no cost. Source code is available for those that want it. Use it as often and for as long as you like. Here are the Linphone download links for each of the platforms:
- Windows
- Mac
- Linux
- Web Browser (Chrome, Edge, Firefox, Safari)
- Android via Google Play
- iOS via App Store
The only other piece you’ll need to get started is a free Linphone SIP account. Sign up here. Once you’ve signed up, simply respond to the confirmation email to activate your account. Your registration gets you credentials to plug into your Linphone app that you downloaded above. In addition, it gets you a free Linphone SIP URI which looks something like this: yourname@sip.linphone.org. This is the SIP URI address that anyone in the world can use to contact you. Here are the pieces you’ll need to plug into your desktop or smartphone app:
- Account Name
- Account Password
- Domain: sip.linphone.org
Be very careful not to lose your password. You can’t retrieve it, and you can’t change it without knowing the original password. All you can do is delete your account and start over.
The Linphone feature set is downright impressive. Here’s what you and your friends will be using at zero cost:
IMPORTANT TIP: Missing audio or one-way audio is a common problem on SIP calls. For best results, configure your account in the Linphone app to use UDP for the Transport, disable the Outbound Proxy, configure stun.linphone.org as the Stun Server, and enable ICE. In Network settings, turn off IPv6 and Media Encryption. In Audio settings, enable Opus, G.722, PCMU, and PCMA only. In Video settings, enable both VP8 and H.264. Then close the app and reopen it.
Once you have your Linphone credentials, another option in addition to using one of the SIP clients above is to acquire a stand-alone SIP telephone which can easily be connected to your Linphone SIP account. While there are literally hundreds of SIP telephones from which to choose, here’s a $35 offering from Grandstream that we use. It’s available from Amazon.1
Unlike other proprietary communications apps, the beauty of using Linphone with its native SIP URI support is you can call any SIP phone in the world for free whether the recipient uses Linphone or not. For example, to annoy your friends and spammers, you can transfer their calls to Lenny: 2233435945@sip2sip.info or 883510001198938@sip.inum.net. And here are some other SIP URI calls you might want to try. Store them in your Linphone Phonebook.
Yahoo News Headlines - news@demo.nerdvittles.com Yahoo News Headlines - 951@demo.nerdvittles.com Weather by Zip Code - weather@demo.nerdvittles.com Weather by Zip Code - 947@demo.nerdvittles.com Directory Assistance - information@demo.nerdvittles.com Directory Assistance - 411@demo.nerdvittles.com Lenny for Spammers - 53669@demo.nerdvittles.com Technical Support - 0@sip.incrediblepbx.com Call Any TollFree # - **1800XXXXXXX@tollfree.future-nine.com
There are now more than 2,000 VoIP networks worldwide that support SIP URI access. Any person or organization with an account on any of these networks can be reached at no cost via SIP URI or via several hundred PSTN numbers. Using a SIP URI dialing prefix, you can call any referenced network@sipbroker.com. For example, *656news@sipbroker.com would reach the Nerd Vittles News Headlines from Yahoo. Or choose a local access number from the SipBroker worldwide directory, e.g. 702-789-0530 and then dial *656951 at the prompt.
Of course, every 3CX platform provides dedicated SIP URIs for every extension on the PBX. Our recent article covers adding SIP URI access to any Asterisk PBX.
If you want to associate a phone number with your Linphone SIP URI, you can do it in a couple of ways. First, using a smartphone, you can link your cell number to Linphone within the Linphone app itself. If you have a free DID from IPComms, you can point it to your Linphone SIP URI. If you have a $1/month CallCentric DID, it can also be pointed to your Linphone SIP URI. A 25¢/month iNum DID from LocalPhone.com also can be pointed to your SIP URI. LocalPhone supports Nerd Vittles through referral revenue from your 25¢ investment. 🙂
Speaking of iNUMs, you can reach anyone with an iNUM DID by dialing the iNUM number in SIP URI format: 8835100xxxxxxxx@sip.inum.net. One of the real beauties of signing up for an iNUM number as well is that it can be reached in most places around the globe by dialing a local number from any telephone. As part of the iNum initiative, local access numbers have been established in more than 50 countries around the globe. By placing a local call from any telephone to one of these local access numbers, any individual with an iNum phone number anywhere in the world can be reached without further cost. Here is a current list of the local access numbers. If the link is down (frequently), try here or here or the iNUM listing here. Once your call is answered, simply enter the 15-digit iNum phone number you wish to reach, and you will be connected. It’s worth pointing out that iNUMs aren’t as unwieldy as they may appear. The numbers always begin with 8835100 followed by 8 digits starting with a zero.
And another iNUM listing from DSL Reports:
Country City Access Number ------------------- ------------------------ --------------- Argentina Buenos Aires +54 1159839500 Australia Sydney +61 280148200 Austria +43 720880500 Bahrain +973 16199200 Belgium Brussels +32 28081771 Brazil Brasilia +556135500791 Brazil Florianopolis +554840420809 Brazil Rio De Janeiro +552135006959 Brazil Sao Paulo +551146803621 Bulgaria Sofia +359 24917555 Canada Calgary (403) 775-1446 Canada Edmonton (780) 669-9257 Canada Halifax (902) 982-6937 Canada London (519) 488-9336 Canada Montreal (514) 907-7500 Canada Ottawa (613) 686-4519 Canada Quebec City (418) 800-0384 Canada St. Johns, Newfoundland (709) 757-0060 Canada Regina (306) 988-1600 Canada Toronto (416) 800-4303 Canada Toronto (647) 724-8777 Canada Vancouver (778) 786-3497 Canada Winnipeg (204) 272-8182 Chile Santiago +56 25813444 Croatia Zagreb +385 17776363 Cyprus Nicosia +357 22030500 Czech Republic Prague +420 246019777 Denmark +45 69918686 Dominican Republic Santiago (829) 947-9610 El Salvador +503 21131899 Estonia +372 6681881 Finland Helsinki +358 942419200 France Paris +33 170619800 Germany Frankfurt +4969257385876 Germany Frankfurt +4969257380439 Greece Athens +30 2111768444 Hungary Budapest +36 14088951 Ireland Dublin +353 15262600 Israel Tel Aviv +972 37219555 Italy Rome +39 0662207777 Japan Tokyo +81 345209777 Latvia Vilnius +370 52059090 Lithuania +371 67652500 Luxembourg +352 20880108 Malta +35627780107 Mexico Guadalajara +52 3346242977 Mexico Mexico City +52 5511678222 Mexico Monterrey +52 8141703540 Netherlands Amsterdam +31 208080808 New Zealand Auckland +64 99250499 Norway Oslo +47 21031306 Panama +507 8322488 Peru Lima +51 17085500 Poland Warsaw +48 223982688 Portugal Lisbon +351 308803219 Puerto Rico Bayamon Norte (787) 395-7140 Romania +40 318103500 Singapore +65 31581212 Slovakia Bratislava +421 233002555 Slovenia Ljubljana +386 16001422 South Africa Johannesburg +27105002854 South Africa Pretoria +27120042701 Spain Barcelona +34 931815653 Spain Madrid +34 911883777 Sweden Stockholm +46 852500111 Switzerland Zurich +41 435006262 United Kingdom London +44 2033556363 United States Albuquerque (505) 225-8243 United States Charlotte (980) 202-0283 United States Charlotte (980) 236-0398 United States Kansas City (913) 951-0932 United States Chicago (312) 253-4880 United States Houston (713) 474-2323 United States Los Angeles (213) 221-3799 United States New York (646) 843-6969 United States Phoenix (602) 354-9444 United States San Diego (619) 330-9640 United States San Francisco (650) 360-0999 United States Santa Barbara (805) 308-9649 United States Seattle (206) 420-5904 United States Spokane, WA (509) 931-0459 United States Tacoma, WA (253) 343-1529
More iNUM details are available here. If sip.inum.net is down, try 81.201.82.50.
Let’s tie all the pieces together now. Linphone gives you and your friends a free SIP URI as well as a SIP client for any platform to make and receive SIP voice and video calls. You can associate this SIP URI with your cellphone number as well as a free or almost free phone number (DID) that’s available from IPComms, CallCentric, and other providers. If you sign up for a LocalPhone iNUM number, you also can associate it with your Linphone SIP URI. So you can be reached on your Linphone client by SIP URI, by iNUM, and by regular phone numbers. You can place unlimited calls to any SIP URI or iNUM worldwide at no cost. What’s not to like?
Deploying Linphone as an Asterisk Trunk
If you don’t have an Asterisk PBX, you can stop reading here. The good news is you can also use a Linphone SIP account as a SIP trunk on your Asterisk PBX. Once configured, you can add an Incoming Route and send the incoming Linphone SIP URI calls to any destination desired: an extension, a ring group, an IVR, or even a Conference Room. Using the FreePBX® or Incredible PBX® GUI, create a chan_SIP Trunk and name it linphone. In the PEER DETAILS, enter the following using your actual Linphone username and password:
type=friend qualify=yes insecure=port,invite host=sip.linphone.org disallow=all context=from-trunk dtmfmode=rfc2833 allow=g722&ulaw fromuser=your-username defaultuser=your-username secret=your-password
For the Registration String: your-username:your-password@sip.linphone.org/99999
Next, create an Inbound Route using 99999 as the DID entry. Route the call to your desired destination, SAVE your settings, and you’re in business.
There’s one more nice surprise. Linphone accounts work much like the old key telephones and Google Voice setup that we all knew and loved. What that means is you can register the same Linphone account in multiple places, e.g. as an Asterisk trunk and elsewhere using one of the Linphone softphone apps. When incoming calls to your SIP URI arrive, they will ring on both your Asterisk PBX and your Linphone softphone as long as you haven’t routed the Linphone trunk to a destination that automatically answers the calls such as an IVR.
HINT: If you’re using dual registrations and routing the Linphone trunk to an extension, we recommend disabling voicemail on that extension so that Asterisk doesn’t automatically answer the call and send it to voicemail when the extension is not registered or answered.
To make outbound calls from extensions on your PBX using the Linphone trunk, the easiest way is to create custom extensions in the [from-internal-custom] context in /etc/asterisk/ extensions_custom.conf. Make up an unused extension number (90210 in this example), enter the Linphone account name you wish to call (acctname in this example), save the file, and reload your dialplan: exten => 90210,1,Dial(SIP/acctname@linphone).
Another way to create a Custom Extension is using the FreePBX or Incredible PBX GUI. Under Applications -> Extensions -> Add Custom Extension, assign an extension number for the extension. Click on the Advanced tab and enter SIP/acctname@linphone in the Dial field. Click Submit button and reload the dialplan at the prompt. Enjoy your worldwide free calling.
Originally published: Monday, April 29, 2019
Need help with Asterisk? Visit the VoIP-info Forum.
Special Thanks to Our Generous Sponsors
FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.
BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.
The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.
VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
- This phone requires a wired network connection. Some of our purchase links refer users to Amazon when we find their prices are competitive for the recommended products. Nerd Vittles receives a small referral fee from Amazon to help cover the costs of our blog. We never recommend particular products solely to generate Amazon commissions. However, when pricing is comparable or availability is favorable, we support Amazon because Amazon supports us. [↩]
Adding SIP URI Dialing to Asterisk for Free Worldwide Calling
Since giving up on Google Voice, we’ve been extolling the virtues of SIP URI dialing which gives you unlimited free calls to anyone else in the world that happens to have their own SIP URI address. SIP URIs look very much like email addresses except they’re used to share phone conversations instead of email messages. And, as we’ve mentioned previously, if everyone in the world had their own SIP URI, paying for phone calls would become a thing of the past. We hope you’ll join us in making that happen. As a fallback, give our $50 credit at Skyetel a try.
One of the drawbacks of Asterisk® PBXs using the FreePBX® GUI has been the inability to place outbound SIP URI calls from SIP phones registered as extensions on the PBX. Today we first want to address that shortcoming. Our SIP URI dialing solution for Asterisk should work with any FreePBX-based implementation including Incredible PBX® and Issabel as well as on Raspberry Pi platforms. We’ll wrap things up by providing some tips on obtaining and deploying your own SIP URI at little or no cost and pointing you to some excellent resources that facilitate calling millions of SIP phones around the world at zero cost. All you need is an Internet connection, and we’ll point you to a terrific softphone to begin your adventure.
Let’s begin by examining why SIP URI dialing is a problem with FreePBX. The reason is pretty simple. FreePBX interprets dial strings by matching them against some rules to determine whether you’re making an internal call or a call outside your PBX. It matches internal calls against a list of available internal extensions. External calls are matched against rules defined in your outbound routes which are associated with trunks. Since SIP URI calls don’t match any extension or outbound route, the caller receives a congestion tone.
The traditional workaround has been to define a custom extension using the FreePBX GUI which points to a SIP URI. Then the user can dial the custom extension, and the call will be routed to the defined SIP URI. These custom extensions also can be defined in extensions_custom.conf within the from-internal-custom context. For example, the following dialplan code would let users dial 411 to reach AT&T’s Toll-Free Directory Assistance: exten => 411,1,18005551212@switch.starcompartners.com.
But there’s a better way. Wouldn’t it be nice to be able to dial any SIP URI from a softphone or to store SIP URI addresses in the phonebook of your SIP phone?1 Well, now you can. Before we actually put the dialplan code in place, let us explain how this will work. First, FreePBX still needs to be able to distinguish a SIP URI call from a "regular call." The reason this gets tricky is because Asterisk typically throws away the destination hostname when you place a call. For example, calls to 8005551212 and 8005551212@sip2sip.info are processed by Asterisk in exactly the same way, i.e. dropping the host address before dialing.
Using the new dialplan code in the next section, here’s how calls will be processed:
User dials Asterisk processes call as ------------------------ --------------------------------------------- 701 internal call to local extension 701 4045551212 external call using NXXNXXXXXX outbound route 2233435945@sip2sip.info SIP URI call to Lenny by acct at sip2sip.info lennybgood@sip2sip.info SIP URI call to alias lennybgood@sip2sip.info
Cautionary Notes: Our code should work fine with any Asterisk 13 and FreePBX 13 or Incredible PBX deployment on any Linux platform; however, with servers other than Incredible PBX, make sure you have added the following entries to sip_general_custom.conf, or you can configure them in the GUI by making the changes in Settings -> Asterisk SIP Settings -> Chan SIP Settings:
srvlookup=yes allowguest=yes
You also need to test a traditional outbound call (e.g. 8005551212) immediately after you finish the install procedure. Monitor the Asterisk CLI (asterisk -rvvvvvvvvvv) and observe the first few lines of the log after you place a call. The second line will show SIPDOMAIN which should be either the FQDN of your server or an IP address depending upon how you registered your softphone extension. The first line should display the MyDomain variable. If it is empty or doesn’t match the SIPDOMAIN entry, the outbound call will fail. To fix it, add an entry to the Asterisk database from the Asterisk CLI using syntax like the following: database put MyDomain FQDN 10.0.0.11 or database put MyDomain FQDN sip.me.com where 10.0.0.11 or sip.me.com matches the SIPDOMAIN entry shown on the second line. Then retry your outbound call, and it should complete successfully. We’ve tested this back to the early Asterisk 11 days with FreePBX 2.11 without any problems. If your calls still fail, then you will probably need to remove the new code from your platform until you upgrade to a more current version of Asterisk and FreePBX. The code hasn’t been tested with FreePBX 14 and 15.
Finally, you may want to manually set the CallerID for your outgoing SIP URI calls. From the Asterisk CLI, issue a command for every extension from which you will be placing SIP URI calls, e.g. extension 701 syntax: database put 701 user_sipname "Nerd Uno"
Enabling SIP URI Dialing with FreePBX
To enable SIP URI dialing from phones registered with your Asterisk PBX, we’ll modify the dialplan in order to detect SIP URI dial strings entered into a softphone or retrieved from a phonebook associated with almost any SIP phone. When a SIP URI dial string is detected, we’ll send the call out as requested rather than passing the call through the outbound routes and trunks associated with your PBX. All of this dialplan code is open source and is licensed pursuant to the GPL2 license.
SECURITY ALERT: Never use the SIP URI MOD on a server with a publicly-exposed SIP port as it is possible for some nefarious individual to spoof your FQDN in the headers of a SIP packet and easily gain outbound calling access using your server’s trunk credentials.
FEB. 21 UPDATE: There was a bug in the original code which caused some internal calls to fail including calls to a DISA extension. Simply install the application again, and it will overwrite the previous version.
MAR. 5 UPDATE: A bug was discovered in previous releases that treated 911 and 933 calls as internal calls when, in fact, they should have been routed out using your outbound trunks. Simply install the application again, and it will overwrite the previous version.
MAR. 13 ALERT: This software is not compatible with the Debian, Raspbian, and Ubuntu platforms.
To begin or update your installation, log in to your PBX as root using SSH or Putty and issue these commands:
cd /tmp wget http://incrediblepbx.com/sipuri-mod.tar.gz tar zxvf sipuri-mod.tar.gz rm -f sipuri-mod.tar.gz ./install-sip-uri-mod.sh
Obtaining Your Own SIP URI
There are a number of ways to obtain your own SIP URI. Perhaps the easiest is to set up the open Incredible PBX cloud platform that we introduced several weeks ago. Then you can create as many SIP URIs as you like, and they can be used to perform any task that’s available with Asterisk. If you’re not quite ready to make that leap, a free or almost free SIP URI is available from the following sources. VoIP.ms provides a SIP URI for every subaccount you create. Just set up an internal extension number for the subaccount, and that becomes a SIP URI to connect back to your registered server or SIP phone. In the alternative, VoIP.ms will also provide you with a free iNUM DID which can be reached at the following IP address: 81.201.82.50. CallCentric provides a SIP URI matching your account number which can be reached @in.callcentric.com. CallCentric will also provide you with a free iNUM DID which can be reached at the following IP address: 81.201.82.50. LocalPhone provides the same two options as CallCentric: you can be reached by your account number @localphone.com. Or the LocalPhone-assigned iNUM DID can be reached @81.201.82.50. Then there’s pbxes.org. Your account name can be used for SIP URI access @pbxes.org. And, of course, if you’re a 3CX user, you can set up a SIP URI for each extension on your PBX. Just navigate to the Options tab of the desired extension(s) and enter a unique SIP ID for each extension. The SIP URI becomes SIPID@YOUR-3CX-FQDN. SIP URI calls to 3CX Clients on smartphones are also free! This list is not exhaustive. There are now more than 2,000 VoIP networks that support SIP URI access. Using a SIP URI dialing prefix, call any of the referenced networks @sipbbroker.com.2
Choosing a SIP Phone or Softphone
You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum. For today we’ll get you started with one of our favorite (free) softphones, YateClient. It’s available for almost all desktop platforms. Download YateClient from here. Run YateClient once you’ve installed it and enter the credentials for an extension on your PBX. You’ll need the IP address of your server plus your extension number and its password. Fill in the Yate Client template using the IP address of your PBX as well as your extension credentials. Click OK to save your entries.
Once the Yate softphone shows that it is registered, try a test call to Lenny using one of the following SIP URIs: 2233435945@sip2sip.info or 883510001198938@81.201.82.50. Better yet, try out a few Incredible PBX samples from the public server we previously deployed:
Yahoo News Headlines - news@demo.nerdvittles.com Weather by Zip Code - weather@demo.nerdvittles.com Directory Assistance - information@demo.nerdvittles.com Lenny for Telemarketers - lenny@demo.nerdvittles.com
Originally published: Monday, February 11, 2019
Need help with Asterisk? Visit the VoIP-info Forum.
Special Thanks to Our Generous Sponsors
FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.
BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.
The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.
VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
- Special thanks to Olivier Adler and voip-info.org for their early work on SIP URI dialing with Asterisk. [↩]
- Some of our links refer users to sites or service providers when we find their prices are competitive for the recommended products. Nerd Vittles receives a small referral fee from these providers to help cover the costs of our blog. We never recommend particular products solely to generate commissions. [↩]
SIP Happens! Deploying a Publicly-Accessible Asterisk PBX – replaced
We’ve previously documented the benefits of SIP URI calling. Because the calls are free from and to anywhere in the world, the use case is compelling. The drawbacks, particularly with Asterisk® servers, have primarily centered around the security implications of exposing SIP on a publicly-accessible server. Today we want to take a fresh look at a possible SIP implementation for Asterisk based upon the pioneering work of Dr. Lin Song back in the PBX in a Flash heyday. We’ve embellished Lin’s original IPtables creation with additional security mechanisms now available with Fail2Ban, Asterisk, FreePBX®, and Travelin’ Man 3 as well as a terrific tutorial from JavaPipe. All of Lin’s work and ours is open source GPL3 code which you are more than welcome to use or improve pursuant to the terms of the GPL3 license.
Consider this. If everyone in the world had an accessible SIP address instead of a phone number, every call to every person in the world via the Internet would be free. That pretty much sums up why SIP URIs are important. The syntax for SIP URIs depends upon your platform. With Asterisk they look like this: SIP/somebody@FQDN.yourdomain.com. On SIP phones, SIP URIs look like this: sip:somenameORnumber@FQDN.yourdomain.com. Others use somenameORnumber@FQDN.yourdomain.com. Assuming you have a reliable Internet connection, once you have “dialed” a SIP URI, the destination SIP device will ring just as if the called party had a POTS phone. Asterisk® processes SIP URIs in much the same way as calls originating from commercial trunk providers, but anonymous SIP calls are blocked.
Before we get too deep in the weeds, let us take a moment to stress that we don’t recommend this SIP design for mission-critical PBXs because there still are some security risks with denial of service attacks and other vulnerabilities. For these deployments, Incredible PBX® coupled with the Travelin’ Man 3 firewall which blocks SIP access except from whitelisted IP addresses and FQDNs has no equal. When properly deployed, the bad guys cannot even see your server much less attack it. A typical use case for today’s new SIP design would be a public Asterisk server that provides anonymous SIP access to the general public without any exposure to corporate jewels. For example, we’ve put up a demonstration server that provides news and weather reports. In the corporate world, an equivalent deployment might provide access to a product database with pricing and availability details. Our rule of thumb before deploying today’s platform would be to ask yourself what damage could be inflicted if your server were totally compromised. If the answer is zero, then proceed. Otherwise, stick with Incredible PBX and the Travelin’ Man 3 firewall. The ideal platform for deployment using the same rule of thumb as above is one of these $7 to $15/year OpenVZ cloud platforms.
Overview. There are a number of moving parts in today’s implementation. So let’s briefly go through the steps. Begin with a cloud-based installation of Incredible PBX. Next, we’ll upgrade the Fail2Ban setup to better secure a publicly-accessible Asterisk server. We’ll also customize the port for SSH access to reduce the attack rate on the SSH port. You’ll need a fully-qualified domain name (FQDN) for your server because we’ll be blocking all access to your server by IP address. If you want to allow SIP URI calls to your server, you’ll need this FQDN. If you want to also allow SIP registrations from this same FQDN, then a single FQDN will suffice; however, with OpenVZ platforms, we recommend using a different (and preferably more obscure) FQDN for SIP registrations since registered users have an actual extension on your PBX that is capable of making outbound calls which usually cost money. In this case, the obscure FQDN performs double-duty as the equivalent of a password to your PBX. For example, an FQDN such as hk76dl34z.yourdomain.com would rarely be guessed by an anonymous person while sip.yourdomain.com would be fairly obvious to attempted intruders. But that’s your call.
Using whatever FQDN you’ve chosen for SIP registrations, we’ll add an entry to /etc/asterisk/sip_custom.conf that looks like this: domain=hk76dl34z.yourdomain.com. That will block all SIP registration attempts except from that domain. It will not block SIP invitations! The next step will be to add a new [from-sip-external] context to extensions_override_freepbx.conf. Inside that context, we’ll specify the FQDN used for public SIP URI connections to your server, e.g. sip.yourdomain.com. This will block SIP invitations except SIP URIs containing that domain name. We’ll also define all of the extensions on your Asterisk server which can be reached with SIP URI invitations. These could be actual extensions, or ring groups, or IVRs, or Asterisk applications. The choice is yours. These SIP URI authorizations can be either numeric (701@sip.yourdomain.com) or alpha (weather@sip.yourdomain.com) or alphanumeric (channel7@sip.abc.com). Finally, we’ll put the new IPtables firewall rules in place and adjust your existing iptables-custom setup to support the new publicly-accessible PBX. For example, we’ll still use whitelist entries for web access to your server since anonymous users would cause nothing but mischief if TCP ports 80 and 443 were exposed. It’s worth noting that KVM platforms provide a more robust implementation of IPtables that can block more types of nefarious traffic. We’ve supplemented the original article with a KVM update below. With OpenVZ platforms, we have to rely upon Asterisk to achieve IP address blocking and some types of packet filtering. So why not choose a KVM platform? It’s simple. These platforms typically cost twice as much as equivalent OpenVZ offerings. With this type of deployment, KVM is worth it.
Installing Incredible PBX Base Platform
Today’s design requires an Incredible PBX platform on a cloud-based server. Start by following this tutorial to put the pieces in place. We recommend you also install the Whole Enchilada addition once the base install is finished. Make sure everything is functioning reliably before continuing.
Upgrading the Fail2Ban Platform
Because this will be a publicly-accessible server, we’re going to tighten up the Asterisk configuration in Fail2Ban and lengthen the bantime and findtime associated with Fail2Ban’s Asterisk log monitoring. We also recommend that you whitelist the IP addresses associated with your server and PCs from which you plan to access your server so that you don’t inadvertently block yourself.
Log into your server as root and issue the following commands. When the jail.conf file opens in the nano editor, scroll down to line 34 and add the IP addresses you’d like to whitelist to the existing ignoreip settings separating each IP address with a space. Then press Ctrl-X, Y, then Enter to save your changes. Verify that Fail2Ban restarts successfully.
cd /etc/fail2ban wget http://incrediblepbx.com/fail2ban-public.tar.gz tar zxvf fail2ban-public.tar.gz rm -f fail2ban-public.tar.gz nano -w jail.conf service fail2ban restart
If you ever get locked out of your own server, you can use the Serial Console in your VPS Control Panel to log into your server. Then verify that your IP address has been blocked by issuing the command: iptables -nL. If your IP is shown as blocked, issue this command with your address to unblock it: fail2ban-client set asterisk unbanip 12.34.56.78
Obtaining an FQDN for Your Server
Because we’ll be blocking IP address SIP access to your server, you’ll need to obtain one or perhaps two FQDNs for your server. If you manage DNS for a domain that you own, this is easy. If not, you can obtain a free FQDN from ChangeIP here. Thanks, @mbellot.
For the FQDN that you’ll be using for SIP registrations on your server, configure Asterisk to use it by logging into your server as root and issuing the following command using your new FQDN, e.g. xyz.yourdomain.com. Thanks, @ou812.
echo "domain=xyz.yourdomain.com" >> /etc/asterisk/sip_custom.conf
SECURITY ALERT: Never use the SIP URI MOD on a server such as this one with a publicly-exposed SIP port as it is possible for some nefarious individual to spoof your FQDN in the headers of a SIP packet and easily gain outbound calling access using your server’s trunk credentials.
Customizing the [sip-external-custom] Context
All FreePBX-based servers include a sip-external-custom context as part of the default installation; however, we need a customized version to use for a publicly-accessible PBX. You can’t simply update the context in /etc/asterisk/extensions.conf because FreePBX will overwrite the changes the next time you reload your dialplan. Instead we have to copy the context into extensions_override_freepbx.conf and make the changes there. So let’s start by copying the new template there with the following commands:
cd /tmp wget http://incrediblepbx.com/from-sip-external.txt cd /etc/asterisk cat /tmp/from-sip-external.txt >> extensions_override_freepbx.conf rm -f /tmp/from-sip-external.txt nano -w extensions_override_freepbx.conf
When the nano editor opens the override file, navigate to line #10 of the [from-sip-external] context and replace xyz.domain.com with the FQDN you want to use for SIP invites to your server. These are the connections that are used to actually connect to an extension on your server (NOT to register). As noted previously, this can be a different FQDN than the one used to actually register to an extension on your server. Next, scroll down below line #24, and you will see a series of lines that actually authorize anonymous SIP connections with your server. There are two numeric entries and also two alpha entries to access the News and Weather apps on your server. The 13th position in the dialplan is required for all authorized calls.
exten => 947,13,Dial(local/947@from-internal) exten => 951,13,Dial(local/951@from-internal) exten => news,13,Dial(local/951@from-internal) exten => weather,13,Dial(local/947@from-internal)
You can leave these in place, remove them, or add new entries depending upon which extensions you want to make publicly accessible on your server. Here are some syntax examples for other types of server access that may be of interest.
; Call VoIP Users Conference
exten => 882,13,Dial(SIP/vuc@vuc.me)
exten => vuc,13,Dial(SIP/vuc@vuc.me)
; Call Default CONF app
exten => 2663,13,Dial(local/${EXTEN}@from-internal)
exten => conf,13,Dial(local/2663@from-internal)
; Call Bob at Local Extension 701
exten => 701,13,Dial(local/${EXTEN}@from-internal)
exten => bob,13,Dial(local/701@from-internal)
; Call Default Inbound Route thru Time Condition
exten => home,13,Goto(timeconditions,1,1)
; Call Inbound Trunk 8005551212
exten => 8005551212,13,Goto(from-trunk,${DID},1)
; Call Lenny
exten => 53669,13,Dial(local/${EXTEN}@from-internal)
exten => lenny,13,Dial(SIP/2233435945@sip2sip.info)
; Call any toll-free number (AT&T Directory Assistance in example)
exten => information,13,Dial(SIP/18005551212@switch.starcompartners.com)
Once you’ve added your FQDN and authorized SIP URI extensions, save the file: Ctrl-X, Y, then Enter.
One final piece is required to enabled anonymous SIP URI connections to your server:
echo "allowguest=yes" >> /etc/asterisk/sip_general_custom.conf
Now restart Asterisk: amportal restart
UPDATE for DialPlan Junkies: We received a few inquiries following publication inquiring about the dialplan design. We’ve taken advantage of a terrific feature of Asterisk which lets calls fall through to the next line of a dialplan if there is no match on a Goto(${EXTEN},13) command. For example, if a caller dials ward@sip.domain.com and there is a line 12 in the dialplan directing the call to ward,13 which exists, call processing will continue there. However, if the extension does not exist, the call will not be terminated. Instead, if there exists a more generic line 13 in the dialplan, e.g. exten => _X.,13,Goto(s,1), call processing will continue there. We use this trick to then redirect the call to an ‘s’ extension sequence to announce that the called extension could not be reached. It’s the reason all of the whitelisted extensions have to have the same line 13 designation so that call processing can continue with the generic line 13 when a specific extension match fails.
Configuring IPtables for Public SIP Access
You may recall that, with Incredible PBX, we bring up the basic IPtables firewall using the /etc/sysconfig/iptables rules. Then we add a number of whitelist entries using /usr/local/sbin/iptables-custom. We’re going to do much the same thing with today’s setup except the rule sets are a bit different. Let’s start by putting the default iptables-custom file in place:
cd /usr/local/sbin wget http://incrediblepbx.com/iptables-custom-public.tar.gz tar zxvf iptables-custom-public.tar.gz rm -f iptables-custom-public.tar.gz nano -w iptables-custom
When the nano editor opens, scroll to the bottom of the file. You’ll note that we’ve started a little list of notorious bad guys to get you started. Fail2Ban will actually do a pretty good job of managing these, but for the serious recidivists, blocking them permanently is probably a good idea. In addition to the bad guys, you’ll want to whitelist your own IP addresses and domains so that you don’t get blocked from FreePBX web access to your server. The syntax looks like the following two examples:
/usr/sbin/iptables -I INPUT -s pbxinaflash.dynamo.org -j ACCEPT /usr/sbin/iptables -I INPUT -s 8.8.8.8 -j ACCEPT
Whenever you make changes to your IPtables configuration, remember to restart IPtables using the following command ONLY: iptables-restart
Now let’s put the final IPtables piece in place with the default IPtables config file:
cd /etc/sysconfig wget http://incrediblepbx.com/iptables-public.tar.gz tar zxvf iptables-public.tar.gz rm -f iptables-public.tar.gz nano -w iptables
When the nano editor opens the file, scroll down to line 51 which controls the TCP port for SSH access to your server. We strongly recommend you change this from 22 to something in the 1000-2000 range. HINT: Your birth year is easy to remember. In the next step, we’ll make the change in your SSH configuration as well.
Next, scroll down to lines 143 and 144. Replace YOUR_HOSTNAME.no-ip.com on both lines with the FQDN of your server that will be used to accept SIP invitations (connections) on your server. These entries have no effect on SIP registrations which we covered above!
Once you’ve made these changes, save the file BUT DO NOT RESTART IPTABLES JUST YET.
Securing the SSH Access Port
TCP port 22 is probably one of the most abused ports on the Internet because it controls access to SSH and the crown jewels by default. Assuming you changed this port in the IPtables firewall setup above, we now need to change it in your SSH config file as well. Edit /etc/ssh/sshd_config and scroll down to line 12. Change the entry to: Port 1999 assuming 1999 is the port you’ve chosen. Be sure to remove the comment symbol (#) at the beginning of the line if it exists. Then save the file. Now reboot your server, and you should be all set.
Dealing with the Bad Guys
You’ll be amazed how quickly and how many new friends you’ll make on the public Internet within the first few hours. You can watch the excitement from the Asterisk CLI by logging into your server as root and issuing the command: asterisk -rvvvvvvvvvv. Another helpful tool is to monitor your IPtables status which will show IP addresses that have been temporarily blocked by Fail2Ban: iptables -nL. This will catch most of the bad guys and block them. But some are smarter than others, and many know how to spoof IP addresses in SIP packets as you will quickly see. Unlike on KVM platforms, IPtables on most OpenVZ platforms cannot search packets for text strings which is a simple way to block many of these attackers. HINT: You get what you pay for. And, in some cases, attackers disguise their address or use yours. We’ve now found that ${SIPURI} holds the caller’s true identity so we’ve updated the code accordingly. Whether to permanently block these guys is completely up to you. A typical SIP INVITE before such a call is dropped only consumes about 100 bytes so it’s usually not a big deal. You also can manually block callers using the Fail2Ban client with the desired IP address: fail2ban-client set asterisk banip 12.34.56.78.
Additional Security on KVM Platforms
As we mentioned above, a KVM platform provides considerably more security for your public-facing server because you can block entire countries using the ipset extension to IPtables. You can read all about it here. After considerable discussion and suggestions on the PIAF Forum, we would offer the following code which blocks the countries we have identified as causing the majority of problems. First, modify your /etc/sysconfig/iptables configuration and insert the following code in the IPSPF section of the script around line 93. You can change the list of blocked countries to meet your own needs. Just be sure to make the same country-code changes in the blockem.sh script which we will cover in step 2. A list of available country codes can be found here. Save your changes, but do NOT restart IPtables just yet.
-A IPSPF -m set --match-set cn src -j DROP -A IPSPF -m set --match-set ru src -j DROP -A IPSPF -m set --match-set ps src -j DROP -A IPSPF -m set --match-set kp src -j DROP -A IPSPF -m set --match-set ua src -j DROP -A IPSPF -m set --match-set md src -j DROP -A IPSPF -m set --match-set nl src -j DROP -A IPSPF -m set --match-set fr src -j DROP
Second, we want to add a new /etc/blockem.sh script and make it executable (chmod +x /etc/blockem.sh). Make sure the country list in line #5 matches the dropped countries list you added to IPtables in step #1 above.
#!/bin/bash cd /etc wget -qO - http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz| tar zxvf - for i in \\ cn ru ps kp ua md nl fr do /usr/sbin/ipset create -exist $i hash:net for j in $(cat $i.zone); do /usr/sbin/ipset add -exist $i $j; done done wait sleep 5 service iptables restart wait service fail2ban restart exit 0
Third, try things out by running the script: /etc/blockem.sh. Verify that IPtables is, in fact, blocking the listed countries: iptables -nL.
BUG: Some early releases had a missing line which caused the IPSPF section of code in the IPtables script not to be executed. You can test whether you’re missing the necessary line by issuing the following command:
grep "INPUT -j IPSPF" /etc/sysconfig/iptables
If the result is a blank line, then issue the following command to fix the problem:
sed -i 's|-A INPUT -j ASIP|-A INPUT -j IPSPF\\n-A INPUT -j ASIP|' /etc/sysconfig/iptables
Finally, we recommend adding the script to /etc/rc.d/rc.local so that it gets run whenever you reboot your server.
In choosing a KVM platform, we’ve had good luck with the $5/month Digital Ocean platform where you still can get a $100 credit to kick the tires for 60 days, Vultr (similar pricing to D.O. without the 60-day credit). With either of these providers, you can add automatic backups for an extra dollar a month. In the bargain basement (may not be here tomorrow) category, we like (and use) both the SnowVPS KVM $15/year and AlphaRacks KVM $22/year offerings. Many other low-cost options are documented on the LowEndBox site. Just don’t invest more than you can afford to lose… and make a backup.1
Connecting a SIP Phone to Kamailio or LinPhone
If you followed along in our initial Kamailio adventure, then it’s easy to test some SIP URI calls to your new server. You can connect virtually any kind of SIP telephone or endpoint to Kamailio. Another easy way to try out SIP calling is to first set up a free LinPhone SIP Account.
You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum. For today we’ll get you started with one of our favorite (free) softphones, YateClient. It’s available for almost all desktop platforms. Download YateClient from here. Run YateClient once you’ve installed it and enter the credentials for your Kamailio or LinPhone account you’ve previously created. You’ll need the IP address of your Kamailio server or LinPhone’s FQDN (sip.linphone.org) plus your account’s password. Fill in the Yate Client template using the IP address or FQDN as well as your Username and whatever Password you assigned to the account when you created it. Click OK to save your entries.
Once the Yate softphone shows that it is registered, try a test call to one of the SIP URIs you authorized on your new Asterisk server: sip:947@sip.yourdomain.com.
If you don’t happen to have a Kamailio server or a LinPhone SIP account to play with but you have another Asterisk server, then the simple way to enable SIP URI extensions is by editing /etc/asterisk/extensions_custom.conf. In the [from-internal-custom] context, add an extension that can be used to contact any desired SIP URI. Then reload your dialplan: asterisk -rx "dialplan reload". Now dial that extension (2468 in the following example) from any phone connected to your Asterisk server. The entry would look something like this to call the SIP URI on your new server for the latest weather forecast:
exten => 2468,1,Dial(SIP/weather@sip.yourdomain.com)
Originally published: Monday, January 28, 2019 Updated: Wednesday, February 6, 2019
Need help with Asterisk? Visit the VoIP-info Forum.
Special Thanks to Our Generous Sponsors
FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.
BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.
The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.
VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
- Digital Ocean and Vultr provide modest referral credits to Nerd Vittles for those that use our referral code. It in no way colors our recommendations regarding these two providers, both of whom we use extensively. [↩]
SIP Happens! And Kamailio Makes It Easy, Part I
If ever there was a Swiss Army Knife for SIP, Kamailio (a.k.a. OpenSER) is the hands-down winner. The flexibility of this open source SIP server is legendary. Whether it’s secure communications, insulation from brute force attacks, load balancing, failover, WebRTC, or the return of shared line appearances on your office phone system, Kamailio can handle it while processing thousands of call setups per second on minimal hardware platforms.
Our plan for today is to walk you through setting up a Debian-based Kamailio server on an inexpensive cloud platform that is suitable for making thousands of free SIP phone calls worldwide. Down the road, we’ll walk you through using Kamailio as a frontend for one or more Asterisk® servers to insulate your communications workhorses without sacrificing network security. If, like us, you managed an office which migrated from key telephones to a platform like Asterisk, then you will most certainly appreciate the ability to once again let your managers and secretaries share phone lines without the aggravation of call parking and pickup. Other than removing a free office coffee machine, I can’t think of any single event that ever prompted a staff and management revolt quite like the one we experienced with the removal of key telephones. Little wonder that it’s part of all Cisco and Avaya phone systems as well as cloud offerings from Vonage, 8X8, Jive, and probably others.
Before we begin our adventure, let me caution everyone that this is an experimental platform with a tutorial prepared by a Kamailio novice. While we’ve done our homework, digging out information on Kamailio is a challenge because many of the experts depend upon Kamailio consulting for their livelihood. It’s quite similar to the early Asterisk years. We also don’t vouch for the longevity of any of these VPS providers. Reread our article for details.
SIP URI (Free) Calling Opportunities
We mentioned free SIP phones in our introduction of Kamailio. But let that sink in for a moment. As we have stressed for many years, SIP calls to anyone with a public SIP URI (somebody@somewhere.com) are entirely free to anyone worldwide. And you can talk as long as you like. All that’s required is an Internet connection, a SIP phone or softphone, and a SIP URI. As part of the Kamailio implementation, we’ll show you how easy it is to create SIP URIs for all your friends and business acquaintances securely… in seconds. First, let’s take a moment to consider what SIP URI (free) calling opportunities are available. There literally are millions of SIP URI resources that await. But, unless you want to be one of the "don’t call us, we’ll call you" folks, you also will need one or more SIP URIs for yourself. YOU DON’T NEED A KAMAILIO SERVER TO OBTAIN A SIP URI. Here are just a few of the possibilities. Using SIP Broker, you can call anyone on more than 2,000 VoIP networks around the globe. Using a softphone and a free or almost free registration with VoIP.ms, CallCentric, or LocalPhone, you not only get a SIP URI, but you also can request an iNUM number which also doubles as a SIP URI by coupling it with @81.201.82.50. 3CX and pbxes.org also offer SIP URIs to complement their free offerings. All of these companies will let you connect a softphone or SIP endpoint directly to their service without the need for an Asterisk PBX in the middle.1 You can even refer your favorite spam callers to Lenny via SIP URI: 2233435945@sip2sip.info.
Deploying a Cloud-Based Debian Server
We hope you took advantage of one of the special VPS offerings we highlighted to start the New Year. Some are still available with annual pricing that’s less than the cost of most lunches these days. We recommend a cloud platform because (1) it’s cheap, (2) it’s easy to set up a Debian platform, and (3) it provides a static IP4 address for your server. When you sign up or if you wish to reconfigure an existing VPS that you may have gathering dust, just choose the Debian 8/64 operating system and assign an FQDN to your server. Once you get your credentials, log into the server as root with the password that was provided. Immediately change your root password and issue the following commands to bring Debian up to date. We also strongly recommend changing the SSH port to deter would-be attackers. A TCP port in the 1000-2000 range works wonders. Simply edit /etc/ssh/sshd_config and change the Port 22 entry before rebooting. HINT: Birth years make the SSH port easy to remember.
passwd apt-get update apt-key update apt-get dist-upgrade apt-get -y install gcc flex bison libmysqlclient-dev make libssl-dev nano apt-get -y install libcurl4-openssl-dev libxml2-dev libpcre3-dev ntp ntpdate reboot
Once the reboot is complete, log back into your server’s new SSH port using this syntax where 1234 is the port number you chose.
ssh -p 1234 root@server-ip-address
Now we’re ready to install the necessary packages to support Kamailio:
apt -y install mysql-server mysql_secure_installation apt -y install kamailio kamailio-mysql-modules apt -y install kamailio-dbg apt -y install kamailio-extra-modules apt -y install kamailio-outbound-modules apt -y install kamailio-presence-modules apt -y install kamailio-tls-modules apt -y install kamailio-utils-modules apt -y install kamailio-websocket-modules
Configuring Kamailio’s kamctlrc File
For today, we’ll be configuring Kamailio to allow user logins from SIP endpoints including SIP phones and softphones. Down the road, we’ll change things up to let Kamailio serve as the front-end to one or more Asterisk PBXs. But let’s learn to walk before we start running. We’ll be editing three configuration files and then adding a SIP account to support logging in from a SIP phone. Let’s begin with kamctlrc.
(1) Edit kamctlrc: nano -w /etc/kamailio/kamctlrc
(2) Start by uncommenting SIP_DOMAIN and insert the FQDN you associated with your VPS.
(3) Uncomment DBENGINE line and make certain it points to MYSQL.
(4) Uncomment the following line: DBRWUSER="kamailio".
(5) Uncomment the DBRWPW line and insert your own password between the quotes.
(6) Uncomment the following line: DBROUSER="kamailioro".
(7) Uncomment the DBROPW line and insert a different password between the quotes.
(8) Uncomment the DBACCESSHOST line and insert the IP address of your server.
(9) Drop down near the bottom of the file and uncomment the PID_FILE line.
(10) Save the file.
Configuring Kamailio’s kamailio.cfg Startup File
(1) Edit kamailio.cfg: nano -w /etc/kamailio/kamailio.cfg
(2) Make the top of the startup file look like the following:
#!KAMAILIO #!define WITH_MYSQL #!define WITH_AUTH #!define WITH_USRLOCDB #!define WITH_ANTIFLOOD #!define WITH_PRESENCE # change next line to comment to disable logging #!define WITH_ACCDB # # Kamailio (OpenSER) SIP Server v4.2 - default configuration script
(3) Find the line: #!define DBURL "mysql://kamailio:kamailiorw@localhost/kamailio"
(4) Change the kamailiorw entry to the password you entered in step #5 above.
(5) Tighten up security a bit by searching for the line containing friendly-scanner.
(6) Immediately above that line, cut-and-paste this addition from Fred Posner at AstriCon:
### Posner additions
if ($ua =~ "(friendly-scanner|sipvicious|sipcli)") {
xlog("L_INFO","script kiddies from IP:$si:$sp - $ua \n");
$sht(ipban=>$si) = 1;
sl_send_reply("200", "OK");
exit;
}
if($au =~ "(\=)|(\-\-)|(')|(\#)|(\%27)|(\%24)" and $au != $null) {
xlog("L_INFO","[R-REQINIT:$ci] sql injection from IP:$si:$sp - $au \n");
$sht(ipban=>$si) = 1;
exit;
}
###
(7) Save the file.
(8) Generate the MySQL database and tables to support Kamailio: kamdbctl create
(9) At every prompt, type Y to add the feature.
(10) Open MySQL as root using the actual MySQL password you assigned when adding the MySQL package:
mysql -u root -ppassw0rd kamailio
(11) At the MySQL prompt, cut-and-paste the following commands:
ALTER TABLE acc ADD COLUMN src_user VARCHAR(64) NOT NULL DEFAULT ''; ALTER TABLE acc ADD COLUMN src_domain VARCHAR(128) NOT NULL DEFAULT ''; ALTER TABLE acc ADD COLUMN src_ip varchar(64) NOT NULL default ''; ALTER TABLE acc ADD COLUMN dst_ouser VARCHAR(64) NOT NULL DEFAULT ''; ALTER TABLE acc ADD COLUMN dst_user VARCHAR(64) NOT NULL DEFAULT ''; ALTER TABLE acc ADD COLUMN dst_domain VARCHAR(128) NOT NULL DEFAULT ''; ALTER TABLE missed_calls ADD COLUMN src_user VARCHAR(64) NOT NULL DEFAULT ''; ALTER TABLE missed_calls ADD COLUMN src_domain VARCHAR(128) NOT NULL DEFAULT ''; ALTER TABLE missed_calls ADD COLUMN src_ip varchar(64) NOT NULL default ''; ALTER TABLE missed_calls ADD COLUMN dst_ouser VARCHAR(64) NOT NULL DEFAULT ''; ALTER TABLE missed_calls ADD COLUMN dst_user VARCHAR(64) NOT NULL DEFAULT ''; ALTER TABLE missed_calls ADD COLUMN dst_domain VARCHAR(128) NOT NULL DEFAULT ''; quit
Configuring Kamailio Defaults in /etc/default/kamailio
(1) Edit Kamailio defaults: nano -w /etc/default/kamailio
(2) Make the startup defaults look like the following:
# # Kamailio startup options # # Set to yes to enable kamailio, once configured properly. RUN_KAMAILIO=yes # User to run as USER=kamailio # Group to run as GROUP=kamailio # Amount of shared and private memory to allocate # for the running Kamailio server (in Mb) SHM_MEMORY=128 PKG_MEMORY=4 # Config file CFGFILE=/etc/kamailio/kamailio.cfg
(3) Save the file.
Managing Kamailio Startups & Shutdowns
With all the pieces in place, here’s how to start, restart, stop, and check status of Kamailio:
systemctl start kamailio systemctl restart kamailio systemctl stop kamailio systemctl status kamailio
Adding Users/Accounts to Kamailio
Now we’re ready to add accounts to Kamailio. These can be numeric, alphanumeric, or purely alpha entries. They become the user’s respective SIP URIs when coupled with @FQDN where FQDN is the fully-qualified domain name assigned to your server:
kamctl add username userpw
As you probably have guessed, kamctl is the main management tool for Kamailio. Issuing the command by itself will list all of the possible options that are available.
Monitoring Kamailio Access
There are a number of ways to monitor access (both legitimate and otherwise) to your Kamailio server. Here are a few of our favorites:
systemctl status kamailio cat /var/log/syslog | grep kamailio mysql -u root -ppassw0rd kamailio -e "select * from acc" mysql -u root -ppassw0rd kamailio -e "select * from missed_calls"
Connecting a SIP Phone to Kamailio
You can connect virtually any kind of SIP telephone or endpoint to Kamailio. You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum. For today we’ll get you started with one of our favorite (free) softphones, YateClient. It’s available for almost all desktop platforms.
Download YateClient from here. Run YateClient once you’ve installed it and enter the credentials for the account you created above. You’ll need the IP address of your server plus your account’s password. Fill in the Yate Client template using the IP address or FQDN of your Server as well as your Username and whatever Password you assigned to the account when you created it. Click OK to save your entries.
Once the Yate softphone shows that it has registered with Kamailio, try a test call to Lenny by dialing sip:2233435945@sip2sip.info.
Next week, we’ll tackle security. If you run systemctl status kamailio for a few days, you’ll understand why. We’ll also get your Kamailio server interconnected with Asterisk so that inbound calls to your new SIP URI pass through to Asterisk transparently. Enjoy!
Originally published: Monday, January 14, 2019
Need help with Asterisk? Visit the VoIP-info Forum.
Special Thanks to Our Generous Sponsors
FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.
BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.
The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.
VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
- Some of our links refer users to sites or service providers when we find their prices are competitive for the recommended products. Nerd Vittles receives a small referral fee from these providers to help cover the costs of our blog. We never recommend particular products solely to generate commissions. [↩]
R.I.P. GVSIP: A Final Farewell to Google Voice
It’s been a death by a thousand cuts, but today marks the end of the Google Voice era with Asterisk®. Since Google removed XMPP support and transitioned to their new GVSIP platform, many have held out hope that Google hadn’t moved to a purely commercial platform with their ObiHai deal. Yesterday, the head of the Google Voice project requested that all Asterisk GVSIP implementations be discontinued citing Google’s Terms of Service. We hinted this was coming back in July and have reproduced our tweet below. We have since removed all of our articles pertaining to GVSIP, and we would encourage all of our readers to honor Google’s wishes and move on. We’ve made it easy with a $50 gift certificate from Skyetel (expires March 31, 2019). It will buy you many months of free VoIP service.
You still have several options with your Google Voice trunks. First, you can forward all incoming calls to Google Voice to another phone or DID of your choosing. This costs you nothing other than a minute to set it up. Second, you can port out your Google Voice number to another provider. Skyetel will cover your porting expense at their end during your first 60 days of service. Google charges $3 to port out your number unless you originally ported it into Google in which case it is free. Here’s how. Although we’re not big fans, a third option is to purchase an OBi200 device and continue to use your Google Voice trunk with Asterisk. Our tutorial from last May will show you how. Effective 10/1/2023, $25/month minimum spend at Skyetel is required.
As we’ve mentioned often, the beauty of VoIP is not having to put all of your telephony eggs in a single basket. Google’s latest move reinforces how important it actually is to configure several VoIP trunks on your server. While Skyetel and Vitelity are both excellent primary trunks and rarely experience an outage, it’s still a good idea to have a backup. VoIP.ms (free iNUM), CircleNet, CallCentric ($1/mo. DID and iNUM), LocalPhone (25¢/mo. iNUM), Future-Nine, AnveoDirect, and V1VoIP are excellent options. Most don’t cost you anything unless you make calls. Review our complete SIP tutorial here: Developing a Cost-Effective SIP Strategy.
Dale Carnegie Award: ObiHai Man of the Year
Originally published: Friday, November 16, 2018
Need help with Asterisk? Join our new MeWe Support Site.
Special Thanks to Our Generous Sponsors
FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.
BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.
The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.
VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
VoIP 101: Developing a Cost-Effective SIP Strategy
In the lead up to the demise of Google Voice XMPP service next week, we wanted to offer what we have found to be a cost-effective SIP strategy which takes advantage of the best of all worlds. We would divide SIP offerings into five broad categories: business-class unlimited SIP trunks, Old Faithful SIP providers, Mom-and-Pop SIP services, dirt-cheap termination services, and Gee Whiz SIP providers. As we have said many times, the beauty of setting up an Asterisk® PBX such as Incredible PBX® is you don’t have to put all your VoIP eggs in one basket. In our particular case, that has included a mix of Google Voice trunks plus all five of the SIP categories above. Today we want to document why we’ve personally made the selections we’ve made and hope that it provides a roadmap for your own VoIP setup while encouraging you to venture out of your safe zone and try some new VoIP options.
The all-you-can-eat business plans, which we previously have covered, make little sense for most home and small business users. Then there are the rock-solid, long term pay-as-you-go providers such as Vitelity and CallCentric that make perfect sense as your primary DID and SIP provider. While they may not always be the cheapest VoIP providers, the tradeoff is dependability and long-term reliability for your VoIP platform. In the case of Vitelity, it turns out the Nerd Vittles DID special (detailed below) from our Platinum Sponsor is perhaps one of the best VoIP deals on the planet.
The third category of SIP providers and our personal favorite is what we would call the mom-and-pop providers. These are typically one or two-person operations that offer incredible deals on all-you-can-eat VoIP plans for home users. Included in this category are Vestalink (available to existing customers only), Future-Nine and CircleNet. VestaLink originally began as OBiVoice and morphed over trademark issues. While the service is no longer available to new customers, it remains the best bargain at $72 for two years of unlimited inbound and outbound residential calling services. A close second goes to Future-Nine and their "Future 5 Grey" plan which provides 1,500 inbound and 1,500 outbound minutes a month for only $5. You can sign up here. Be sure to read the Terms of Services carefully, especially item #18. The New Kid on the Block is CircleNet. In addition to very attractive pay-by-the-minute offerings of $.005 per minute to most of the U.S. and Canada, they also have an $8 a month all-you-can-eat plan for residential customers that includes a very reasonable 5,000 minutes a month for calls to the following countries: United States, Canada, Australia, Bangladesh, Belgium, Brazil, Chile, Cyprus, Denmark, Finland, France, Germany, Greece , Guam, Hungary, India,Ireland, Italy, Japan, Latvia, Mexico, Netherlands, New Zealand, Norway, Poland, Puerto Rico, Singapore, Spain, Sweden, Taiwan, Thailand, United Kingdom, and Vatican City. Just let them know that you plan to use it with an Asterisk-based PBX. CircleNet also is offering Nerd Vittles readers a free month of the $8/month service to kick the tires. Simply send an email to sales@circlenet.us with your valid email address to take advantage of the offer. One free trial per customer/email address. CircleNet also offers a $15 a month business plan with even more minutes.
A fourth class of VoIP providers is the dirt-cheap termination services including Anveo Direct, TelecomsXchange, V1VoIP and the Betamax companies for low-cost international calling. These providers make terrific additions for supplementing your other VoIP services. TelecomsXchange is our personal favorite because of the special deal they have extended to Incredible PBX users. You get access to 300 VoIP wholesalers and can read about their services in this Nerd Vittles article. V1VoIP also has some terrific deals with 15¢/mo. DIDs from 13,000 Rate Centers and incoming and outgoing U.S. call pricing as low as $.003 per minute (not a typo!). Anveo Direct was perhaps the first provider to offer wholesale pricing to consumers, and they remain a terrific service both for DID and origination services with T.38 fax support as well as many of the lowest cost SIP terminations worldwide featuring user-configurable least-cost routing. Check out their pricing and rates here.
Finally, there are the SIP providers such as VoIP.ms that offer a rich collection of special features that you won’t find in many places and certainly not under the same roof. These features include SMS messaging, SIP URI proxying and iNUM for free worldwide calling, and fax support. Every one of these features is free when you sign up for an account at VoIP.ms. We encourage you to take advantage of these little known free services to enhance your PBX.
Putting It All Together. Now that we’ve covered the options, let’s go over how we would actually implement this. For the inbound trunk and primary DID, we’d recommend a SIP trunk from either Vitelity, VoIP.ms, or CallCentric. If you have multiple, simultaneous inbound calls, then the Nerd Vittles Vitelity special below can’t be beat because it provides four call paths. In addition, you get SMS support on the same trunk. Many people now assume your primary number supports SMS. We actually get dozens of unsolicited SMS messages on our home number from schools, churches, and political groups. If incoming call volume isn’t an issue, then VoIP.ms and CallCentric also offer a free iNUM number for your account. And VoIP.ms throws in a SIP URI as well.
For outbound calling for home and SOHO deployments, we recommend at least one of the mom-and-pop, all-you-can-eat providers: Future-Nine or CircleNet. If international calling is a requirement, you can’t beat the CircleNet offering. In addition to using your primary incoming provider, we also recommend you set up SIP accounts with a couple of the dirt-cheap termination providers. These don’t cost you anything other than a modest deposit unless you actually use them to place calls. And, when your primary outbound service has an outage, your PBX will never miss a beat.
The icing on the cake always has been several Google Voice trunks which work well for IVRs, Stealth AutoAttendants with DISA support, and faxing. While this may change with the demise of XMPP support, it appears that Bill Simon’s SIP Gateway to Google Voice will live on. With the Nerd Vittles sign-up link, you can migrate your existing Google Voice XMPP connections to the Simonics gateway for $4.99 each should the need arise. Enjoy!
Originally published: Monday, June 11, 2018
CircleNet SIP Setup for FreePBX/IncrediblePBX/VitalPBX/Issabel:
username=acct-id type=friend trustrpid=yes sendrpid=yes secret=acct-pword qualify=yes nat=yes insecure=port,invite host=sip.circlenet.biz fromuser=acct-id context=from-trunk disallow=all allow=ulaw Registration String: acct-id:acct-pword@sip.circlenet.biz:5060/did-num
Future-Nine SIP Setup for FreePBX/IncrediblePBX/VitalPBX/Issabel:
username=acct-num type=friend trustrpid=yes sendrpid=yes secret=acct-pword qualify=yes nat=yes insecure=port,invite host=incoming.future-nine.com fromuser=acct-num context=from-trunk canreinvite=no disallow=all allow=ulaw Registration String: acct-num:acct-pword@incoming.future-nine.com/acct-num
Need help with Asterisk? Visit the PIAF Forum.
Special Thanks to Our Generous Sponsors
FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.
BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.
The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.
VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
Some Recent Nerd Vittles Articles of Interest…
Free Asterisk Solutions
