SIP Trunk Configuration Guide: Asterisk & FreePBX

SIP trunk configuration is the process of pointing your PBX at a carrier’s SIP proxy, authenticating by IP or credentials, setting codecs and DTMF, handling NAT, and testing calls. The steps are the same on every platform. Only the interface changes. The open-source Asterisk PBX uses pjsip.conf text files (or the legacy sip.conf). FreePBX wraps those same files in a web GUI. This guide walks through both, plus the basics that apply to any SIP-capable system.

Running VICIdial? Its trunk lives at the Asterisk layer covered here. Campaigns, CID groups, and the carrier entry live in its admin panel. Start with the dedicated VICIdial SIP trunk setup guide instead.

Unlike a PRI trunk or a landline, a SIP trunk needs no physical circuit. Calls ride your existing internet connection. SIPNEX provides SIP trunking for Asterisk, FreePBX, and every other SIP-capable platform. The carrier side is the same everywhere. Only the settings screens differ.

How do you configure a SIP trunk in Asterisk?

To configure a SIP trunk in Asterisk, define a transport, endpoint, AOR, and identify section in pjsip.conf. Authenticate by IP or digest credentials. Allow G.711 codecs with RFC 2833 DTMF. Add an outbound dial plan. Open firewall ports 5060 and 10000-20000. Then reload and test.

1. Collect carrier details — SIP proxy address, auth method, codecs, DTMF type, RTP port range.
2. Define the trunk in /etc/asterisk/pjsip.conf — transport, endpoint, AOR, and identify sections.
3. Add auth — an IP whitelist, or a digest auth section plus registration.
4. Build the outbound dial plan in extensions.conf.
5. Open firewall rules for SIP (UDP 5060) and RTP (UDP 10000-20000).
6. Reload with asterisk -rx "pjsip reload". Test outbound, inbound, DTMF, and caller ID.

What you need from your carrier

Collect these details from your SIP trunk provider before you touch the PBX:

Setting	Typical value	Where it goes
SIP proxy address	Carrier IP or hostname	host= in sip.conf · AOR contact= in pjsip.conf · FreePBX Host field
Auth method	IP whitelist, or digest username and password	insecure=invite or secret= · type=auth section · FreePBX peer details
Codecs	G.711u, G.711a, G.729	allow=ulaw and allow=alaw, every platform
DTMF method	RFC 2833	dtmfmode=rfc2833 · dtmf_mode=rfc4733 in pjsip.conf
SIP port	5060 (5061 for TLS)	port= · transport bind= line
RTP port range	10000-20000	Your firewall rules — see below

SIPNEX sends all of this when we set up your trunk. We support IP and digest auth, G.711u as the primary codec, and RFC 2833 for DTMF.

Asterisk (sip.conf — legacy chan_sip)

On legacy installs the SIP trunk is a peer in /etc/asterisk/sip.conf. One warning first: chan_sip was deprecated for years, then removed in Asterisk 21. Use this section only to maintain an existing Asterisk 16–20 system. For new builds, skip to the PJSIP section below.

IP-based auth:

[sipnex]
type=peer
host=CARRIER_IP
port=5060
disallow=all
allow=ulaw
allow=alaw
dtmfmode=rfc2833
canreinvite=no
nat=force_rport,comedia
qualify=yes
qualifyfreq=60
insecure=invite
context=from-trunk

Digest auth — add credentials and a register line:

[sipnex]
type=peer
host=CARRIER_IP
port=5060
username=YOUR_USER
secret=YOUR_PASS
fromuser=YOUR_USER
disallow=all
allow=ulaw
allow=alaw
dtmfmode=rfc2833
canreinvite=no
nat=force_rport,comedia
qualify=yes
qualifyfreq=60
insecure=invite,port
context=from-trunk

register => YOUR_USER:YOUR_PASS@CARRIER_IP/sipnex

Outbound dial plan in /etc/asterisk/extensions.conf:

[outbound]
exten => _1NXXNXXXXXX,1,Dial(SIP/${EXTEN}@sipnex,,tTo)
exten => _1NXXNXXXXXX,2,Hangup()

After editing, reload: asterisk -rx "sip reload". Then verify: asterisk -rx "sip show peers". The sipnex peer should show OK or Reachable.

Migrating from chan_sip to PJSIP

Every chan_sip setting has a direct PJSIP equivalent. Use this map when you move a trunk between the two:

chan_sip (sip.conf)	PJSIP (pjsip.conf)	What it does
nat=force_rport,comedia	force_rport=yes + rtp_symmetric=yes + rewrite_contact=yes	NAT handling for signaling and audio
dtmfmode=rfc2833	dtmf_mode=rfc4733	RFC 2833 telephone-event DTMF — same standard, new name
insecure=invite	type=identify section	Accepts inbound calls from the carrier IP without an auth challenge
qualify=yes + qualifyfreq=60	qualify_frequency=60 in the AOR	Pings the carrier every 60 seconds to confirm the trunk is up
register => line	type=registration section	Registers with the carrier for digest auth
secret=	type=auth section	Holds the digest username and password

Asterisk (pjsip.conf — modern installs)

PJSIP has been Asterisk’s standard SIP driver since version 13. With chan_sip removed in Asterisk 21, it is the only option on current releases. The trunk moves to /etc/asterisk/pjsip.conf, split into transport, endpoint, AOR, and identify sections. One trap: res_pjsip creates no default transport. Without the transport block below, the driver cannot bind a socket at all.

IP-based auth:

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060

[sipnex]
type=endpoint
context=from-trunk
disallow=all
allow=ulaw
allow=alaw
dtmf_mode=rfc4733
aors=sipnex
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes

[sipnex]
type=aor
contact=sip:CARRIER_IP:5060
qualify_frequency=60

[sipnex]
type=identify
endpoint=sipnex
match=CARRIER_IP

Digest auth — add an auth section, reference it from the endpoint, and register:

[sipnex-auth]
type=auth
auth_type=userpass
username=YOUR_USER
password=YOUR_PASS

[sipnex-reg]
type=registration
outbound_auth=sipnex-auth
server_uri=sip:CARRIER_IP
client_uri=sip:YOUR_USER@CARRIER_IP
retry_interval=60

Then add outbound_auth=sipnex-auth and from_user=YOUR_USER to the [sipnex] endpoint section. Keep the transport and identify sections from the IP-auth example. Without the identify section, inbound INVITEs fail with “No matching endpoint found.”

Outbound dial plan — the only change from chan_sip is the channel prefix:

[outbound]
exten => _1NXXNXXXXXX,1,Dial(PJSIP/${EXTEN}@sipnex,,tTo)
exten => _1NXXNXXXXXX,2,Hangup()

After editing, reload with asterisk -rx "pjsip reload". That command is a CLI alias. If your build lacks it, use asterisk -rx "module reload res_pjsip.so". Neither reloads transports — restart Asterisk after transport changes. Verify with asterisk -rx "pjsip show endpoints". The sipnex endpoint should list a reachable contact. For digest auth, asterisk -rx "pjsip show registrations" should show Registered.

Routing inbound calls in Asterisk

Every example above sets context=from-trunk. That context must exist in /etc/asterisk/extensions.conf. If it does not, inbound calls dead-end with a CLI warning. The carrier sends your DID as the dialed number. Match it and send the call to an extension:

[from-trunk]
exten => 18065550123,1,Dial(PJSIP/101,20)
 same => n,Voicemail(101@default)
 same => n,Hangup()

Replace the number with your DID, in the format the carrier sends it. Not sure of the format? Run pjsip set logger on and read the INVITE. Add one exten line per DID. On chan_sip, dial SIP/101 instead. FreePBX builds this context for you through Inbound Routes.

Setting outbound caller ID

Set caller ID at the trunk level or per call. In sip.conf, fromuser= sets it for the whole trunk. In pjsip.conf, set from_user= on the endpoint. To set it per call, add a line before the Dial:

exten => _1NXXNXXXXXX,1,Set(CALLERID(num)=18065550123)

In FreePBX, use the trunk’s Outbound CallerID field (step 3 below). Always send a DID that lives on your carrier account. SIPNEX signs outbound calls with its own STIR/SHAKEN certificate. A number we can verify as yours earns full attestation. A number we cannot verify gets a lower attestation level — and more spam-label risk. Why the signing happens at the carrier rather than in your PBX is covered in STIR/SHAKEN on Asterisk and FreePBX.

FreePBX (web GUI)

FreePBX puts a web GUI on Asterisk. Set up the trunk in the admin panel.

1. Navigate to Connectivity → Trunks → Add Trunk → Add SIP Trunk
2. Trunk Name: SIPNEX
3. Outbound CallerID: Your primary DID in E.164 format
4. Peer Details (under SIP Settings → Outgoing):

host=CARRIER_IP
port=5060
type=peer
disallow=all
allow=ulaw&alaw
dtmfmode=rfc2833
canreinvite=no
nat=force_rport,comedia
qualify=yes
insecure=invite

5. For digest auth, add username=YOUR_USER and secret=YOUR_PASS to peer details. Then add the register string in the Registration field: YOUR_USER:YOUR_PASS@CARRIER_IP

6. Submit and Apply Config

7. Configure an Outbound Route (Connectivity → Outbound Routes). Match your dial pattern (11-digit US numbers: 1NXXNXXXXXX) and route it through the SIPNEX trunk.

8. Configure Inbound Routes (Connectivity → Inbound Routes) for each DID. Point each one at its destination — extension, ring group, or IVR.

Running a dialer on top of Asterisk?

VICIdial runs on Asterisk, so the trunk itself is the same peer definition shown above. Everything layered on top lives in the admin panel: the carrier entry, campaigns, CID groups for local presence, AMD settings, and inbound DID routing. The dedicated VICIdial SIP trunk setup guide covers each step.

SIP trunk configuration on other platforms

The settings in this guide appear on every SIP-capable PBX. Only the menus change. Here is where the trunk lives on the platforms we see most:

Platform	Where trunk settings live
Asterisk	/etc/asterisk/pjsip.conf text file
FreePBX	Connectivity → Trunks
VICIdial	Admin → Carriers, then campaign wiring
3CX (V20)	Admin → Voice & Chat → Add Trunk — see the 3CX V20 custom trunk guide
Yeastar P-Series	Extension and Trunk → Trunk → Add — see the Yeastar P-Series trunk guide
UniFi Talk	Settings → System → Third-Party SIP Setup — see UniFi Talk with a third-party SIP trunk

Whatever the platform, the carrier-side values stay the same: proxy, auth, codecs, DTMF, ports.

Firewall rules (all platforms)

Whatever the platform, open these rules and nothing more:

• UDP 5060, out and in — SIP signaling, to and from your carrier’s proxy IP only.
• UDP 10000-20000, out and in — RTP, the protocol that carries call audio, to and from your carrier’s media IPs.
• TCP 5061 — only if you use TLS.

Block everything else. An open SIP port on the public internet draws brute-force registration attacks within hours. Allow SIP only from known carrier IPs.

Testing your SIP trunk configuration

After setup, place real calls through the trunk. Work through this list:

1. Outbound call: Call a known number. Verify it connects and audio is clear both ways.
2. DTMF: During the call, press keys. Confirm the far end receives them.
3. Inbound call: Call your DID from an outside line. It should ring the right destination with two-way audio.
4. Caller ID: Place an outbound call. The recipient should see the DID you set.
5. Registration (digest auth): Run pjsip show registrations — or sip show registry on chan_sip. Status should read Registered.
6. Trunk status: Run pjsip show endpoints — or sip show peers. The trunk should show reachable, with a qualify time.

One more step before production calling: register your service address with your carrier — SIPNEX provisions E911 service in the 50 US states. Where your carrier offers a 933 test line, dial it to confirm the address on file without placing a live 911 call.

If a test fails, turn on debug logs (pjsip set logger on, or sip set debug on on chan_sip). Look up the SIP response codes you find there. Then match the symptom in the table below.

Troubleshooting common trunk failures

Symptom	Likely cause	Fix
401 or 403 on REGISTER	Wrong auth username or password, or your IP is not whitelisted	Re-enter credentials; confirm the carrier has your current IP
One-way audio	NAT	nat=force_rport,comedia (chan_sip) or rtp_symmetric=yes + force_rport=yes (PJSIP)
“No matching endpoint found” on inbound	No type=identify match for the carrier IP	Add the identify section with match=CARRIER_IP
488 Not Acceptable Here	Codec mismatch	Add allow=ulaw; confirm the carrier’s codec list
Peer shows UNREACHABLE	Qualify packets blocked by the firewall	Open UDP 5060 both ways to the carrier IP

Frequently asked questions

Is SIP trunk configuration the same on every PBX?

The SIP protocol is the same everywhere, and so are the settings: proxy address, auth, codecs, DTMF, NAT. What differs is where each setting lives. Asterisk uses text files. FreePBX puts a web GUI on those files. VICIdial adds a carrier layer for campaigns. 3CX, Cisco, and Avaya each have their own interfaces. Learn one platform and the concepts carry to all of them. You only need to find each setting in the new menu.

What is the most common SIP trunk configuration mistake?

Bad NAT settings that cause one-way audio. Most PBXs sit behind a NAT router. Without NAT settings, your system offers audio from a private IP address. The carrier sends return audio to the address in the SIP headers — which may be that private IP. Its audio never reaches you. You hear the other party; they cannot hear you, or the reverse. The fix: nat=force_rport,comedia in sip.conf, or rtp_symmetric=yes plus force_rport=yes in pjsip.conf.

How long does SIP trunk setup take?

Two parts: the carrier side and the PBX side. SIPNEX provides credentials within 24 hours. The PBX side takes 30 minutes to 2 hours, depending on the platform and your skill with it.

On Asterisk, adding a trunk peer and dial plan takes 15 to 30 minutes. The FreePBX GUI is slightly faster. VICIdial adds carrier and campaign steps on top. Testing adds another 30 to 60 minutes. With IP auth, the whole process — credentials to first test call — can land under an hour.

Is there a free SIP trunk for Asterisk?

Usually it is a limited trial or an inbound-only test tier. That is enough to validate your pjsip.conf in a lab. It is not enough for production calling. Free SIP trunking rarely includes a number you can keep, real outbound capacity, or STIR/SHAKEN signing. Test on a free tier if you like. Then move the same settings in this guide to a production carrier — the trunk settings do not change.

Why is my SIP trunk registered but calls still fail?

Registration only proves your credentials work. Outbound calls also need a dial plan and a route that points at the trunk. Inbound calls need two more things: the carrier’s IP matched (the identify section in pjsip.conf) and a DID route in your from-trunk context. Check the layers in order — registration, outbound route, inbound routing. The troubleshooting table above maps each layer’s most common failure to its fix.

---

SIPNEX provides trunk credentials and VICIdial carrier support for Asterisk, FreePBX, VICIdial, and any SIP-compliant platform. Our support team has configured these platforms on their own systems. Get trunk credentials or see our rates.