SIP Trunk Configuration Guide: Asterisk & FreePBX

SIP trunk configuration is the process of pointing your PBX at a carrier’s SIP proxy, authenticating by IP or credentials, setting codecs and DTMF, handling NAT, and testing calls. The steps are the same on all PBX systems. Only the interface changes. The open-source Asterisk PBX uses pjsip.conf text files (or the legacy sip.conf). FreePBX wraps those same files in a web GUI. This guide walks through both, step by step, plus the basics that apply to any SIP-capable system.

Running VICIdial? Its trunk lives at the Asterisk layer covered here. Campaigns, CID groups, and the carrier entry live in its admin panel. Start with the dedicated VICIdial SIP trunk setup guide instead.

Unlike a PRI trunk or traditional phone lines, a SIP trunk needs no physical circuit. Calls ride your existing internet connection. SIPNEX provides SIP trunking for Asterisk, FreePBX, and every other SIP-capable platform. The carrier side is the same everywhere. Only the settings screens differ.

How do you configure a SIP trunk in Asterisk?

To configure a SIP trunk in Asterisk, define a transport, endpoint, AOR, and identify section in pjsip.conf. Authenticate by IP or digest credentials. Allow G.711 codecs with RFC 2833 DTMF. Add an outbound dial plan. Open firewall ports 5060 and your RTP range (10000-20000 in Asterisk’s sample rtp.conf). Then reload and test.

1. Collect carrier details — SIP proxy address, auth method, codecs, DTMF type, RTP port range.
2. Define the trunk in /etc/asterisk/pjsip.conf — transport, endpoint, AOR, and identify sections.
3. Add auth — an IP whitelist, or a digest auth section plus registration.
4. Build the outbound dial plan in extensions.conf.
5. Open firewall rules for SIP (UDP 5060) and RTP (UDP 10000-20000, the range in Asterisk’s sample rtp.conf).
6. Reload with asterisk -rx "pjsip reload". Test outbound, inbound, DTMF, and caller ID.

What you need from your carrier

Collect these details from your SIP trunk provider before you touch the PBX:

SIPNEX sends all of this when we set up your trunk. We support IP and digest auth, G.711u as the primary codec, and RFC 2833 for DTMF.

Asterisk (sip.conf — legacy chan_sip)

On legacy installs the Asterisk SIP trunk is a peer in /etc/asterisk/sip.conf. One warning first: chan_sip was deprecated for years, then removed in Asterisk 21. Use this section only to maintain an existing Asterisk 16–20 system. For new builds, skip to the PJSIP section below.

IP-based auth:

[sipnex]
type=peer
host=CARRIER_IP
port=5060
disallow=all
allow=ulaw
allow=alaw
dtmfmode=rfc2833
canreinvite=no
nat=force_rport,comedia
qualify=yes
qualifyfreq=60
insecure=invite
context=from-trunk

Digest auth — add credentials and a register line:

[sipnex]
type=peer
host=CARRIER_IP
port=5060
username=YOUR_USER
secret=YOUR_PASS
fromuser=YOUR_USER
disallow=all
allow=ulaw
allow=alaw
dtmfmode=rfc2833
canreinvite=no
nat=force_rport,comedia
qualify=yes
qualifyfreq=60
insecure=invite,port
context=from-trunk

register => YOUR_USER:YOUR_PASS@CARRIER_IP/sipnex

Outbound dial plan in /etc/asterisk/extensions.conf:

[outbound]
exten => _1NXXNXXXXXX,1,Dial(SIP/${EXTEN}@sipnex,,tTo)
exten => _1NXXNXXXXXX,2,Hangup()

After editing, reload: asterisk -rx "sip reload". Then verify: asterisk -rx "sip show peers". The sipnex peer should show OK or Reachable.

Migrating a SIP trunk: Asterisk chan_sip to PJSIP

Every chan_sip setting has a direct PJSIP equivalent. Use this map when you move a trunk between the two:

Asterisk (pjsip.conf — modern installs)

PJSIP has shipped with Asterisk since version 12. With chan_sip removed in Asterisk 21, it is the only option on current releases. The trunk moves to /etc/asterisk/pjsip.conf, split into transport, endpoint, AOR, and identify sections. One trap: res_pjsip creates no default transport. Without the transport block below, the driver cannot bind a socket at all.

IP-based auth:

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060

[sipnex]
type=endpoint
context=from-trunk
disallow=all
allow=ulaw
allow=alaw
dtmf_mode=rfc4733
aors=sipnex
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes

[sipnex]
type=aor
contact=sip:CARRIER_IP:5060
qualify_frequency=60

[sipnex]
type=identify
endpoint=sipnex
match=CARRIER_IP

Digest auth — add an auth section, reference it from the endpoint, and register:

[sipnex-auth]
type=auth
auth_type=userpass
username=YOUR_USER
password=YOUR_PASS

[sipnex-reg]
type=registration
outbound_auth=sipnex-auth
server_uri=sip:CARRIER_IP
client_uri=sip:YOUR_USER@CARRIER_IP
retry_interval=60

Then add outbound_auth=sipnex-auth and from_user=YOUR_USER to the [sipnex] endpoint section. Keep the transport and identify sections from the IP-auth example. Without the identify section, inbound INVITEs fail with “No matching endpoint found.”

Outbound dial plan — the only change from chan_sip is the channel prefix:

[outbound]
exten => _1NXXNXXXXXX,1,Dial(PJSIP/${EXTEN}@sipnex,,tTo)
exten => _1NXXNXXXXXX,2,Hangup()

After editing, reload with asterisk -rx "pjsip reload". That command is a CLI alias. If your build lacks it, use asterisk -rx "module reload res_pjsip.so". Neither reloads transports — restart Asterisk after transport changes. Verify with asterisk -rx "pjsip show endpoints". The sipnex endpoint should list a reachable contact. For digest auth, asterisk -rx "pjsip show registrations" should show Registered.

Routing inbound calls in Asterisk

Every example above sets context=from-trunk. That context must exist in /etc/asterisk/extensions.conf. If it does not, inbound calls dead-end with a CLI warning. The carrier sends your DID as the dialed phone number. Match it, then route calls to an extension:

[from-trunk]
exten => 18065550123,1,Dial(PJSIP/101,20)
 same => n,Voicemail(101@default)
 same => n,Hangup()

Replace the number with your DID, in the format the carrier sends it. Not sure of the format? Run pjsip set logger on and read the INVITE. Add one exten line per DID. On chan_sip, dial SIP/101 instead. FreePBX builds this context for you through Inbound Routes.

Setting outbound caller ID

Set caller ID at the trunk level or per call. In sip.conf, fromuser= sets it for the whole trunk. In pjsip.conf, set from_user= on the endpoint. To set it per call, add a line before the Dial:

exten => _1NXXNXXXXXX,1,Set(CALLERID(num)=18065550123)

In FreePBX, use the trunk’s Outbound CallerID field (step 3 below). Always send a DID that lives on your carrier account. SIPNEX signs outbound calls with its own STIR/SHAKEN certificate. A number we can verify as yours earns full attestation. A number we cannot verify gets a lower attestation level — and more spam-label risk. Why the signing happens at the carrier rather than in your PBX is covered in STIR/SHAKEN on Asterisk and FreePBX.

FreePBX (web GUI)

FreePBX puts a web GUI on Asterisk. FreePBX 17 installs Asterisk 21 or newer, which has no chan_sip, so a new install builds the trunk as a PJSIP trunk. Set it up in the admin panel.

1. Navigate to Connectivity → Trunks → Add Trunk → Add SIP (chan_pjsip) Trunk
2. General tab → Trunk Name: SIPNEX
3. General tab → Outbound CallerID: Your primary DID in E.164 format
4. pjsip Settings → General: set SIP Server to CARRIER_IP and SIP Server Port to 5060. Leave Context at its default, from-pstn.
   • IP auth: set Authentication and Registration to None.
   • Digest auth: enter the Username and Secret from your carrier, set Authentication to Outbound, and set Registration to Send.
5. pjsip Settings → Advanced: set DTMF Mode to RFC 4733 and Qualify Frequency to 60. Put the carrier’s signaling IPs in Match (Permit) so inbound calls match the trunk. Behind NAT, set Rewrite Contact, RTP Symmetric, and Force rport to Yes. These are the same three settings as the pjsip.conf example above.
6. pjsip Settings → Codecs: enable ulaw and alaw, with ulaw first.
7. Submit and Apply Config
8. Configure an Outbound Route (Connectivity → Outbound Routes). Match your dial pattern (11-digit US numbers: 1NXXNXXXXXX) and route it through the SIPNEX trunk.
9. Configure Inbound Routes (Connectivity → Inbound Routes) for each DID. Point each one at its destination — extension, ring group, or IVR.

Behind NAT, also enter your external IP and local networks under Settings → Asterisk SIP Settings. Check which port PJSIP listens on there too. The FreePBX installer defaults PJSIP to 5060 and chan_sip to 5160, but older or upgraded systems can differ. Your firewall rules must match the real port.

Legacy chan_sip trunk (FreePBX 16 and earlier). Sangoma strongly discourages chan_sip on FreePBX 17, where it works only after downgrading Asterisk to version 20 or earlier. On an older system that still runs a chan_sip trunk, the Peer Details box (under SIP Settings → Outgoing) holds the same values as sip.conf:

host=CARRIER_IP
port=5060
type=peer
disallow=all
allow=ulaw&alaw
dtmfmode=rfc2833
canreinvite=no
nat=force_rport,comedia
qualify=yes
insecure=invite

For digest auth on a chan_sip trunk, add username=YOUR_USER and secret=YOUR_PASS to the peer details. Then put the register string in the Registration field: YOUR_USER:YOUR_PASS@CARRIER_IP

Running a dialer on top of Asterisk?

VICIdial runs on Asterisk, so the trunk itself is the same peer definition shown above. Everything layered on top lives in the admin panel: the carrier entry, campaigns, CID groups for local presence, AMD settings, and inbound DID routing. The dedicated VICIdial SIP trunk setup guide covers each step.

SIP trunk configuration on other platforms

The settings in this guide appear on every SIP-capable PBX. Only the menus change. Here is where the trunk lives on common platforms:

Whatever the platform, the carrier-side values stay the same: proxy, auth, codecs, DTMF, ports.

Firewall rules (all platforms)

Whatever the platform, open these rules and nothing more:

• UDP 5060, out and in — SIP signaling, to and from your carrier’s proxy IP only.
• UDP 10000-20000, out and in — RTP, the Real-time Transport Protocol that carries call audio, to and from your carrier’s media IPs. That is the range in Asterisk’s sample rtp.conf. If your rtpstart and rtpend differ, open your range instead.
• TCP 5061 — only if you use TLS.

Block everything else. An open SIP port on the public internet draws brute-force registration attacks within hours. Allow SIP only from known carrier IPs.

Testing your SIP trunk configuration

After setup, place real calls through the trunk. Work through this list:

1. Outbound call: Call a known number. Verify it connects and audio is clear both ways.
2. DTMF: During the call, press keys. Confirm the far end receives them.
3. Inbound call: Call your DID from an outside line. It should ring the right destination with two-way audio.
4. Caller ID: Place an outbound call. The recipient should see the DID you set.
5. Registration (digest auth): Run pjsip show registrations — or sip show registry on chan_sip. Status should read Registered.
6. Trunk status: Run pjsip show endpoints — or sip show peers. The trunk should show reachable, with a qualify time.

One more step before production calling: register your service address with your carrier — SIPNEX provisions E911 service in the 50 US states. Where your carrier offers a 933 test line, dial it to confirm the address on file without placing a live 911 call.

If a test fails, turn on debug logs (pjsip set logger on, or sip set debug on on chan_sip). Repeat the failing call and watch the CLI in real time. Look up the SIP response codes you find there. Then match the symptom in the table below.

Troubleshooting common trunk failures

Frequently asked questions

Is SIP trunk configuration the same on every PBX?

The SIP protocol is the same everywhere, and so are the settings: proxy address, auth, codecs, DTMF, NAT. What differs is where each setting lives. Asterisk uses text files. FreePBX puts a web GUI on those files. VICIdial adds a carrier layer for campaigns. 3CX, Cisco, and Avaya each have their own interfaces. Learn one platform and the concepts carry to all of them. You only need to find each setting in the new menu.

What is the most common SIP trunk configuration mistake?

Bad NAT settings that cause one-way audio. Most PBXs sit behind a NAT router. Without NAT settings, your system offers audio from a private IP address. The carrier sends return audio to the address in the SIP headers — which may be that private IP. Its audio never reaches you. You hear the other party; they cannot hear you, or the reverse. The fix: nat=force_rport,comedia in sip.conf, or rtp_symmetric=yes plus force_rport=yes in pjsip.conf.

How long does SIP trunk setup take?

Two parts: the carrier side and the PBX side. SIPNEX provides credentials within 24 hours. The PBX side takes 30 minutes to 2 hours, depending on the platform and your skill with it.

On Asterisk, adding a trunk peer and dial plan takes 15 to 30 minutes. The FreePBX GUI is slightly faster. VICIdial adds carrier and campaign steps on top. Testing adds another 30 to 60 minutes. With IP auth, the whole process — credentials to first test call — can land under an hour.

Is there a free SIP trunk for Asterisk?

Usually it is a carrier’s limited free trial or an inbound-only test tier. That is enough to validate your pjsip.conf in a lab. It is not enough for production calling. Free SIP trunking rarely includes a phone number you can keep, real outbound capacity, or STIR/SHAKEN signing. Test on a free tier if you like. Then move the same settings in this guide to a production carrier — the trunk settings do not change.

Why is my SIP trunk registered but calls still fail?

Registration only proves your credentials work. Outbound calls also need a dial plan and a route that points at the trunk. Inbound calls need two more things: the carrier’s IP matched (the identify section in pjsip.conf) and a DID route in your from-trunk context. Check the layers in order — registration, outbound route, inbound routing. The troubleshooting table above maps each layer’s most common failure to its fix.

---

SIPNEX provides trunk credentials and VICIdial carrier support for Asterisk, FreePBX, VICIdial, and any SIP-compliant platform. Get trunk credentials or see our rates.