In FusionPBX, a carrier SIP trunk is a Gateway: Accounts › Gateways › Add, put the carrier’s SIP server in the Proxy field, set Register to true for credential auth or false for IP auth, save, and start the gateway. There is no license gate — FusionPBX is the open-source GUI over FreeSWITCH, and any carrier that speaks SIP can be added on any install.
The platform is powerful and literal: it does exactly what its fields say, which is why most broken gateways trace to three specific fields. This guide — from SIPNEX, an FCC-licensed carrier — walks the setup and flags each one.
Adding the gateway
Navigate to Accounts › Gateways, click +, and fill in:
- Gateway: a name (your carrier’s name works).
- Proxy: the carrier’s SIP server address. Field flag #1: this — not “Hostname” — is where the carrier address goes. Hostname pins the gateway to a specific server in a multi-server cluster and should normally stay blank.
- Register = true for a credentialed account: fill Username and Password (plus Auth Username if your carrier issues one distinct from the username).
- Register = false for IP authentication — and see the next section, because two more steps make IP auth actually work.
- Context: public (the default). Field flag #2: inbound carrier calls land in the public context; changing this breaks the Destinations workflow below.
- Profile: external (the default carrier-facing SIP profile).
Save, then start the gateway from the toolbar. A registered gateway shows REGED; watch its state on the Gateways list or Status › Registrations.
IP authentication done right
Setting Register to false is only a third of the job:
- In practice the gateway still wants placeholder Username/Password values — community consensus is that blank credentials misbehave, so enter dummies.
- Add every carrier IP under Advanced › Access Controls (CIDR format). Without the ACL entry, unauthenticated carrier INVITEs are rejected and inbound simply never rings.
- A healthy IP-auth gateway shows NOREG — that is its normal state, not an error. Stopped is an error.
After any gateway edit, stop and start it; after ACL changes, reload the ACL. “It worked until the carrier added an IP” is always the ACL.
Inbound DIDs and outbound routes
Inbound is elegant: Dialplan › Destinations › Add, enter the DID — FusionPBX auto-creates the inbound route as you save, and you pick the target (extension, ring group, IVR) right there. This works because carrier calls arrive in the public context; if inbound dies, check Context (flag #2) before anything else.
Outbound: Dialplan › Outbound Routes › Add — select the gateway, set the dial pattern, done.
Caller ID is field flag #3. Outbound CID normally flows from the extension’s effective caller ID, not the gateway. Two gateway-level fields interact with carriers: some carriers validate the SIP From user, so setting From User fixes rejected calls — but then pins that value on every call’s identity. And when caller ID doesn’t display at all, FusionPBX’s own docs point at the “Caller ID In From” toggle — setting it true “will often fix the problem.”
Codecs, DTMF, and NAT
- Codecs: per-gateway via the Codec Preferences field (e.g.
PCMU,PCMA,G722,OPUS— put G.711u first for US carrier trunks); global defaults live in Advanced › Variables (global_codec_prefs). - DTMF: there is no per-gateway DTMF selector — FreeSWITCH speaks RFC 2833 telephone-event on trunks by default, which is what carriers expect. Only touch the SIP-profile DTMF variables if a carrier explicitly requires it.
- NAT: FusionPBX runs two SIP profiles — internal (5060/5061, authenticated) and external (5080/5081, the clean port to have your carrier send inbound calls to). If the carrier can only target 5060, whitelist its IPs in Access Controls instead. Behind NAT with a static public IP, set
external_sip_ipandexternal_rtp_ip(Advanced › Variables) or the external profile’s ext-sip-ip/ext-rtp-ip. Forward FreeSWITCH’s RTP range on the firewall (the FreeSWITCH default is UDP 16384–32768), enable the gateway’s Ping option to keep NAT pinholes alive, and disable SIP ALG on the router.
Testing
Confirm the gateway state first (REGED for register, NOREG for IP auth). Then outbound to a mobile — verify caller ID — and inbound to each Destination. One-way audio is NAT: re-check external_rtp_ip and the forwarded RTP range.
Frequently asked questions
What’s the difference between Proxy and Hostname in a FusionPBX gateway?
Proxy is the carrier’s SIP server — the field every gateway needs. Hostname pins the gateway to one specific FusionPBX server in a multi-server deployment and should stay blank on a typical single-server install. Putting the carrier address in Hostname instead of Proxy is a classic dead-gateway mistake.
Why does my FusionPBX gateway show NOREG?
If the gateway has Register set to false, NOREG is the correct, healthy state — an IP-authentication gateway never registers. It is only a problem on a credentialed gateway that should show REGED, where it means registration is failing (check Proxy, credentials, and whether the gateway was restarted after editing).
How do I route a DID to an extension in FusionPBX?
Dialplan › Destinations › Add: enter the DID and choose the target. FusionPBX creates the matching inbound route automatically. This depends on carrier calls arriving in the public context via the external profile — if Destinations aren’t matching, verify the gateway’s Context is still “public.”
Does FusionPBX support IP-authenticated carrier trunks?
Yes: set Register to false, keep placeholder credentials in the username/password fields, and add the carrier’s IPs under Advanced › Access Controls so unauthenticated INVITEs are accepted. The gateway will sit in NOREG state and carry calls normally.
SIPNEX provisions SIP trunks for any PBX — register or IP auth, unlimited channels, A-level STIR/SHAKEN attestation under our own certificate, and engineers comfortable in a FreeSWITCH console. Connect your PBX or see rates.
Keep reading.
The carrier built by operators, for operators.
FCC-licensed carrier with its own STIR/SHAKEN SP certificate. Operator-owned. SIP trunks built for operators who dial at volume.