SIP Unified Communication

     Alice (UAC)              SIP Proxy              Bob (UAS)
         |                       |                       |
         |--- INVITE ---------->|                       |
         |                       |--- INVITE ---------->|
         |                       |<-- 180 Ringing ------|
         |<-- 180 Ringing ------|                       |
         |                       |<-- 200 OK -----------|
         |<-- 200 OK -----------|                       |
         |--- ACK ------------->|                       |
         |                       |--- ACK ------------->|
         |                       |                       |
         |<============= RTP Media Stream ==============>|
         |                       |                       |
         |--- BYE ------------->|                       |
         |                       |--- BYE ------------->|
         |                       |<-- 200 OK -----------|
         |<-- 200 OK -----------|                       |

sip:user@domain.com            - standard SIP (UDP/TCP)
sips:user@domain.com           - SIP over TLS
sip:user@domain.com:5061       - non-standard port
sip:+431234567@gateway.com     - E.164 phone number

UA                              Registrar
 |--- REGISTER ----------------->|
 |    (To: sip:alice@domain.com) |
 |    (Contact: 192.0.2.50:5060) |
 |                                |
 |<-- 401 Unauthorized -----------|
 |    (WWW-Authenticate: Digest) |
 |                                |
 |--- REGISTER ----------------->|
 |    (Authorization: Digest...) |
 |                                |
 |<-- 200 OK --------------------|
 |    (Contact: 192.0.2.50:5060, |
 |     expires=3600)             |

1. Alice sends INVITE sip:bob@domain.com to the proxy
2. Proxy queries registrar: "Where is bob@domain.com?"
3. Registrar returns: "192.0.2.30:5060" (Bob's registered Contact)
4. Proxy forwards INVITE to 192.0.2.30:5060
5. Bob's phone rings

v=0
o=alice 2890844526 2890844526 IN IP4 192.0.2.50
s=Phone Call
c=IN IP4 192.0.2.50
t=0 0
m=audio 49170 RTP/AVP 0 8 96 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:96 opus/48000/2
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv

 0               1               2               3
 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|V=2|P|X| CC    |M|     PT      |       Sequence Number         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                           Timestamp                           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                             SSRC                              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                         Payload Data                          |

# Asterisk default
rtp_start=10000
rtp_end=20000

# FreeSWITCH default
rtp_start=16384
rtp_end=32768

# Firewall rule example (nftables)
# Allow RTP traffic for PBX
nft add rule inet filter input udp dport 10000-20000 accept

Offer (Alice):  m=audio 49170 RTP/AVP 96 0 8      (prefers Opus, then G.711)
Answer (Bob):   m=audio 30000 RTP/AVP 0 8          (supports G.711 only)
Result:         G.711 u-law (payload type 0)

Alice (private: 192.0.2.50)
  |
  NAT Router (public: 203.0.113.1)
  |
  Internet
  |
  SIP Proxy (198.51.100.10)

# Asterisk - /etc/asterisk/rtp.conf
[general]
stunaddr=stun.l.google.com:19302

# FreeSWITCH - vars.xml
<X-PRE-PROCESS cmd="set" data="external_rtp_ip=stun:stun.l.google.com:19302"/>
<X-PRE-PROCESS cmd="set" data="external_sip_ip=stun:stun.l.google.com:19302"/>

Candidate types (in preference order):
  host      - direct LAN IP (fastest, only works on same network)
  srflx     - STUN-discovered public IP (works through most NATs)
  relay     - TURN server relay (always works, highest latency)

# nftables - allow SIP signaling and RTP
nft add rule inet filter input tcp dport 5060 accept   # SIP TCP
nft add rule inet filter input udp dport 5060 accept   # SIP UDP
nft add rule inet filter input tcp dport 5061 accept   # SIP TLS
nft add rule inet filter input udp dport 10000-20000 accept  # RTP

Internal Phones  -->  PBX (Asterisk/FreeSWITCH)  -->  SIP Trunk  -->  ITSP  -->  PSTN
                      (manages extensions,              (internet)
                       voicemail, IVR)

; /etc/asterisk/pjsip.conf - Registration trunk to ITSP

[itsp-trunk]
type=registration
transport=transport-udp
outbound_auth=itsp-auth
server_uri=sip:sip.provider.com
client_uri=sip:myaccount@sip.provider.com
retry_interval=60

[itsp-auth]
type=auth
auth_type=userpass
username=myaccount
password=secretpassword

[itsp-endpoint]
type=endpoint
transport=transport-udp
context=from-itsp
disallow=all
allow=ulaw
allow=alaw
allow=opus
outbound_auth=itsp-auth
aors=itsp-aor

[itsp-aor]
type=aor
contact=sip:sip.provider.com

[itsp-identify]
type=identify
endpoint=itsp-endpoint
match=sip.provider.com

# Install on Debian/Ubuntu
apt install -y asterisk

# Install on Arch
pacman -S asterisk

# Key configuration files
# /etc/asterisk/pjsip.conf    - SIP endpoints, trunks, transports
# /etc/asterisk/extensions.conf - Dialplan (call routing logic)
# /etc/asterisk/voicemail.conf  - Voicemail configuration

# Start
systemctl enable --now asterisk

# CLI access
asterisk -rvvv

# Install on Debian (official repo)
apt install -y gnupg2 wget lsb-release
wget -O - https://files.freeswitch.org/repo/deb/debian-release/fscomm-signing-key.asc | gpg --dearmor > /usr/share/keyrings/freeswitch.gpg
echo "deb [signed-by=/usr/share/keyrings/freeswitch.gpg] https://files.freeswitch.org/repo/deb/debian-release/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/freeswitch.list
apt update && apt install -y freeswitch-meta-all

# Key configuration
# /etc/freeswitch/autoload_configs/   - Module configs
# /etc/freeswitch/dialplan/           - Call routing
# /etc/freeswitch/directory/          - User/extension definitions

# CLI access
fs_cli

# Install chan_dongle
git clone https://github.com/wdoekes/asterisk-chan-dongle.git
cd asterisk-chan-dongle
./configure --with-astversion=20
make && make install

# Configuration - /etc/asterisk/dongle.conf
# [dongle0]
# audio=/dev/ttyUSB1
# data=/dev/ttyUSB2
# imei=123456789012345
# context=from-dongle

# Install DAHDI (Digium Asterisk Hardware Device Interface)
apt install -y dahdi-linux dahdi-tools
dahdi_genconf
dahdi_cfg -vv

SIP Phone --> Asterisk/FreeSWITCH --> matrix-appservice-voip --> Matrix Room

SIP Trunk (ITSP) --> SBC (Session Border Controller) --> Teams Direct Routing --> Teams Client

; Asterisk pjsip.conf - TLS transport
[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
cert_file=/etc/asterisk/keys/asterisk.pem
priv_key_file=/etc/asterisk/keys/asterisk.key
method=tlsv1_2

; Asterisk pjsip.conf - require SRTP
[endpoint-template](!)
type=endpoint
media_encryption=sdes
media_encryption_optimistic=no

; /etc/fail2ban/jail.d/asterisk.conf
[asterisk]
enabled=true
filter=asterisk
action=iptables-allports[name=asterisk, protocol=all]
logpath=/var/log/asterisk/messages
maxretry=3
bantime=3600

table inet sip_protect {
  chain input {
    type filter hook input priority filter; policy accept;
    udp dport 5060 ct state new limit rate 20/second burst 50 packets accept
    udp dport 5060 ct state new drop
  }
}

# Asterisk - check registrations
asterisk -rx "pjsip show registrations"

# Asterisk - show active channels (calls)
asterisk -rx "core show channels"

# Asterisk - enable SIP debug
asterisk -rx "pjsip set logger on"

# FreeSWITCH - show registrations
fs_cli -x "show registrations"

# FreeSWITCH - enable SIP trace
fs_cli -x "sofia loglevel all 9"

# Network - capture SIP traffic
tcpdump -i eth0 -n -s0 port 5060 -w /tmp/sip.pcap

# Analyze with sngrep (real-time SIP message viewer)
sngrep -d eth0