Practicing Safe SIP: Adding SIP URI Connectivity with a Zero Internet Footprint

PBX in a Flash™ has a long (safe) history in the VoIP community, and the major reason is that we constantly preach never directly exposing any ports on your Asterisk® server to the Internet without implementing a WhiteList of safe IP addresses. This Zero Internet Footprint™ design keeps everybody out except a trusted, defined group on your WhiteList. For everyone else, they never see your server. So how do you receive calls? You do it with phone numbers (DIDs) tied to registered Google Voice, SIP, and IAX trunks from reputable providers. Because these trunks have constant registrations with safe service providers on the Internet, calls to these DIDs can flow in and out of your server without exposing your server directly to the Internet.

The drawback of this design is that it rules out inbound SIP URI calls to your server, and these calls typically are free. If you do a lot of international business or have family in far away places, that matters. Using a SIP proxy with Asterisk means anybody with a SIP telephone or a SIP-enabled web app anywhere in the world can punch in a SIP URI such as 1234567@nerdvittles.com, and your phones start ringing.

Practice Safe SIP! Today we’ll show you how easy it is to set up a hybrid SIP URI facility for your server while totally preserving your server’s Zero Internet Footprint. It’s not quite free, but it’s close. If paying 6¢ an hour for incoming calls is too rich for your blood, then stop reading now. For us, it’s a small price to pay to sleep well and avoid a $100,000 phone bill because someone hacked your server through an anonymous SIP attack in the middle of the night. There’s more good news. You may not even be charged the 6¢ an hour tariff.

How It Works. Today’s design works like this. We’ll set up an account with VoIP.ms and then create a standard SIP subaccount. As part of that setup, you can create a random extension on their server and tie that extension to a SIP URI for your subaccount. On our server, we’ll create a new SIP trunk and register to the voip.ms SIP subaccount we just created. This gets us a safe tunnel to make and receive calls using this trunk OR the SIP URI we just created. With this 2-layer SIP design, we’re basically using voip.ms as our anonymous SIP firewall. They get to worry about anonymous SIP attacks, and we pay them 6¢ an hour for inbound SIP URI calls that they pass along and we choose to answer.

There are also some collateral benefits using the hybrid SIP URI approach. First, it means that, instead of paying $1 a month and a penny a minute for calls using an actual DID from voip.ms, you now can take advantage of IPkall’s free DIDs in Washington state. By signing up for one of these, you now have a regular phone number that people can call to reach your server without your having to pay a monthly fee for the DID. In this cellphone era, it doesn’t much matter what the area code of your number happens to be since nationwide cellphone calls are all priced the same. The only cost to you is 6¢ an hour for the inbound calls. Oddly enough, VoIP.ms hasn’t been charging for the calls at least during the last couple weeks of our testing. Don’t count on it forever, but it is good to see they are at least considering a different pricing structure for SIP URI calls.

There’s a security advantage with hybrid SIP URIs as well. By never activating auto-replenishment on a VoIP provider account, your maximum financial exposure if something goes horribly wrong is limited to the prepay balance in your account. Finally, for those that want multiple SIP URIs and multiple DIDs, nothing precludes your repeating this drill. Just add another subaccount to your voip.ms account. So let’s get started.

VoIP.ms Setup. Register for a new account at VoIP.ms if you don’t already have one. This gets you an account with an account number such as 1234567. Don’t ever use your main account. Instead, create a subaccount:

Create a username for this subaccount. It will be your account number, an underscore, and a name of your choosing (up to 12 characters). Make up a very secure password. These are the two pieces you will need to create a SIP trunk on your server so write them down. Leave CallerID Number blank. We can handle that on your Asterisk server. Be sure to select Asterisk for the Device Type. The remaining entries at the top of the form are self-explanatory. Just make your settings match ours.

The bottom section of the form needs to be filled out to create a SIP URI. Make up an extension number for this subaccount, 1010 in our example. Ignore the leading 10 which is only used to make calls between voip.ms subaccounts. This would mean your SIP URI for this subaccount is 12345671010@atlanta.voip.ms where 1234567 is your account number, 1010 is your extension, and atlanta.voip.ms is one of the voip.ms POPs. For the list of available POPs, go to Main Menu -> Account Settings -> Default DID Routing in your Customer Portal. Click Create Account when you’re finished and wait a minute for your settings to propagate to all of the voip.ms servers.

FreePBX 2.10 Setup. Using a web browser, log into FreePBX® on your server. We’ll need to create three items to get everything working. First, we’ll add a new SIP trunk with your voip.ms credentials. Second, we’ll add an Inbound Route to process incoming calls. Third, we’ll add an Outbound Route so that you can make calls using your voip.ms trunk.

1. Connectivity -> Trunks -> Add SIP Trunk
2. Connectivity -> Inbound Routes -> Add Incoming Route
3. Connectivity -> Outbound Routes -> Add Route

Adding VoIP.ms SIP Trunk. While logged into FreePBX 2.10, choose Connectivity -> Trunks -> Add SIP Trunk. Fill out the form like this using your correct subacctname, subacctpassword, desired VoIP.ms host, and whatever 10-digit number you’d like your server to use to identify inbound calls from this VoIP.ms subaccount (12345671010 in the example below). If you plan to use this trunk for outbound calls, enter a CallerID number. Legally, it must be a number that you own, i.e. don’t use the White House number or you may get a call you don’t want. Also be aware that for outbound calls, VoIP.ms rejects 10-digit numbers so you must prepend a 1 to 10-digit calls destined for the U.S. and Canada.

1. Trunk Name: VoIPms
2. Outbound Caller ID: any number you own
3. Dial Pattern: Prepend: 1  Match Pattern: NXXNXXXXXX
4. Trunk Name: voipms
5. Trunk Details:
• canreinvite=nonat
• nat=yes
• context=from-trunk
• host=atlanta.voip.ms
• secret=yourpassword
• type=friend
• username=1234567_subacctname
• disallow=all
• allow=ulaw
• fromuser=1234567_subacctname
• trustrpid=yes
• sendrpid=yes
• insecure=port,invite
• qualify=yes
6. Register String: 1234567_subacctname:yourpassword@atlanta.voip.ms/12345671010

Finally, in Settings:SIP Settings, add the following entry at the bottom in the Other SIP Settings field: match_auth_username=yes. Save your changes and reload your dialplan when prompted.

Adding VoIP.ms Inbound Route. While logged into FreePBX 2.10, choose Connectivity -> Inbound Routes -> Add Incoming Route. The only trick to this is the DID Number you enter must match the 10-digit number you chose for the end of the SIP registration string in the last step. The numbers really don’t matter, but they must match because this is what FreePBX uses to identify calls as originating from this SIP Trunk. You use the Inbound Route to tell FreePBX how to route the incoming calls once they hit your PBX. For example, you could ring an extension, a ring group, or route the call to an IVR where the caller was given a list of choices from which to pick their own call routing option. Don’t put your CallerID Number in here or only calls from your number would be accepted! Here’s a typical setup to route the calls to an IVR. Leave the other options at their defaults.

1. Description: VoIPms
2. DID Number: 12345671010
3. CallerID Number: leave blank
4. CID Source: Caller ID Superfecta
5. Destination:
• IVR: nv-ivr

Adding VoIP.ms Outbound Route. How you set up the Outbound Route to handle outgoing calls depends upon what you already have in place. Unless you don’t already have outbound trunks on your PBX, our recommendation is to add a prefix to force certain calls to go out through your VoIP.ms trunk. For example, a caller might dial 9-1-404-555-1212 or 9-404-555-1212 to force the call out through VoIP.ms. We’ll strip off the 9 before passing the number to VoIP.ms, and our Trunk setup will take care of adding the 1 if only 10-digits are dialed. Here’s how to set that up. While logged into FreePBX 2.10, choose Connectivity -> Outbound Routes -> Add Route.

1. Route Name: VoIPms
2. Dial Pattern: Prefix: 9  Match Pattern: NXXNXXXXXX
3. Trunk Sequence: 0 VoIPms

If you have a default Outbound Route that already uses another Trunk such as Google Voice or Vitelity, then you can add a little redundancy to your system by adding VoIPms as an additional option at the end of the Default Trunk Sequence. Then, if the primary outbound route is out of service, the calls will automatically be routed out through VoIP.ms.

Adding an IPkall DID for Your SIP URI. We’ve now completed all the steps necessary to receive incoming SIP URI calls using our example VoIP.ms SIP URI: 12345671010@atlanta.voip.ms. Anyone in the world can dial that SIP URI from a SIP phone, and the calls will be answered by our sample IVR, nv-ivr. But suppose we’d also like folks to be able to pick up a Plain Old Telephone and call us using VoIP.ms to route the incoming call through our SIP URI at the 6¢ per hour calling rate. Here’s the easy way to do it. Just sign up for a free DID at www.ipkall.com. After choosing an area code for your free number, you’ll be prompted for the following information. Here’s what you’d enter using today’s example:

• SIP Phone Number: 12345671010
• SIP Proxy: atlanta.voip.ms
• Email Address: your-email-address
• Password: some-password-to-get-back-into-your-account

Once you’ve completed the form, submit it and wait for your new phone number to be delivered in your email. You should get it within a couple minutes so check your spam folder if you don’t see it. Congratulations! You’ve done everything you need to do for anyone to call you using either your SIP URI or your new DID number from IPkall.

It’s worth noting that IPkall recycles DIDs that aren’t used for 30 days. If you use Incredible PBX, the easiest way to assure that you don’t lose your number is to set up a recurring Telephone Reminder that calls your own number once a week.

Free iNum DID. There’s another important benefit from signing up for a VoIP.ms account. You’re also eligible for a free iNum DID. This lets people around the world call you by dialing a local number in most countries. And iNum calls are always free with Google Voice. You can read all about how it works and how to set up your free iNum DID in this Nerd Vittles article.

Test Drive. The proof is in the pudding, as they say. So we invite you to take our SIP URI, iNum DID, and IPkall DID for a test drive. They’re all running on a $35 Raspberry Pi with Incredible PBX 3.3 with its Applications AutoAttendant. You can try a news, weather, or stock report as well as checking the current East Coast time. Or you can try a text-to-speech call from the AsteriDex phone book by choosing option 5 and saying one of the airlines in the default install, e.g. American Airlines. Enjoy!

• SIP URI: 10159521010@raspi.mundy.org
• iNum DID: 883510009901997
• IPkall DID: 1-425-998-2778
• GVoice DID: 1-843-284-6844

Don’t forget to List Yourself in Directory Assistance so everyone can find you by dialing 411. And add your new number to the Do Not Call Registry to block telemarketing calls. Or just call 888-382-1222 from your new number.

Originally published: Thursday, 10/11/12

Astricon 2012. Astricon 2012 will be in Atlanta at the Sheraton beginning October 23 through October 25. We hope to see many of you there. We called Atlanta home for over 25 years so we’d love to show you around. Be sure to tug on my sleeve and mention you’d like a free PIAF Thumb Drive. We’ll have a bunch of them to pass out to our loyal supporters. Nerd Vittles readers also can save 20% on your registration by using coupon code: AC12VIT.

Need help with Asterisk? Visit the PBX in a Flash Forum.

whos.amung.us If you’re wondering what your fellow man is reading on Nerd Vittles these days, wonder no more. Visit our new whos.amung.us statistical web site and check out what’s happening. It’s a terrific resource both for us and for you.

Special Thanks to Our Generous Sponsors

FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 

Some Recent Nerd Vittles Articles of Interest…