IAX2 Trunk Between Two Asterisk Servers

IAX2 (Inter-Asterisk Exchange) is a protocol designed specifically for connecting Asterisk systems. It uses a single UDP port (4569), handles NAT better than SIP for server-to-server links, and supports trunking (multiplexing multiple calls into fewer packets). For peering two offices or linking a primary and backup PBX, it is simpler to set up than a PJSIP trunk.

The setup

Two servers: office-a at 10.1.1.10 and office-b at 10.2.2.20. When someone at office-a dials a 3xx extension, the call routes to office-b, and vice versa for 2xx extensions.

iax.conf on office-a

[general]
bindport = 4569
bindaddr = 0.0.0.0
disallow = all
allow = ulaw
allow = alaw

[office-b]
type = friend
username = office-a
secret = a-strong-shared-secret
auth = md5
host = 10.2.2.20
deny = 0.0.0.0/0.0.0.0
permit = 10.2.2.20/255.255.255.255
context = from-iax
peercontext = from-iax
qualify = yes
trunk = yes

iax.conf on office-b

[general]
bindport = 4569
bindaddr = 0.0.0.0
disallow = all
allow = ulaw
allow = alaw

[office-a]
type = friend
username = office-b
secret = a-strong-shared-secret
auth = md5
host = 10.1.1.10
deny = 0.0.0.0/0.0.0.0
permit = 10.1.1.10/255.255.255.255
context = from-iax
peercontext = from-iax
qualify = yes
trunk = yes

The configs mirror each other. Each side defines a friend entry (sends and receives calls) named after the remote server. The secret must match on both sides. auth = md5 hashes the password instead of sending it in plaintext.

trunk = yes enables IAX2 trunking, which packs multiple concurrent calls between the servers into fewer IP packets. Reduces overhead when several calls are active simultaneously.

qualify = yes sends periodic pings so each side knows the other is still reachable. If the remote goes down, Asterisk marks it as unreachable and stops sending calls.

peercontext = from-iax means you can dial IAX2/office-b/300 without specifying the context; it automatically lands in [from-iax] on the remote side.

Dialplan on both servers

Each server needs a [from-iax] context to receive calls from the peer, and outbound routes to send calls to the peer.

On office-a (extensions 200-299, routes 3xx to office-b):

; Incoming from office-b
[from-iax]
exten => _2XX,1,Dial(PJSIP/${EXTEN},30)
same => n,Voicemail(${EXTEN}@default,u)
same => n,Hangup()

; Outbound to office-b
[internal]
exten => _3XX,1,Dial(IAX2/office-b/${EXTEN})
same => n,Hangup()

On office-b (extensions 300-399, routes 2xx to office-a):

[from-iax]
exten => _3XX,1,Dial(PJSIP/${EXTEN},30)
same => n,Voicemail(${EXTEN}@default,u)
same => n,Hangup()

[internal]
exten => _2XX,1,Dial(IAX2/office-a/${EXTEN})
same => n,Hangup()

Verifying the link

Reload IAX2 on both servers:

asterisk -rx "iax2 reload"

Check the peer status:

asterisk -rx "iax2 show peers"

You should see the remote peer listed with a status of OK and a round-trip time in milliseconds. If it shows UNREACHABLE, check firewall rules for UDP port 4569.

Test a call:

# From office-a, call extension 300 at office-b
asterisk -rx "channel originate Local/300@internal application Wait 10"

Firewall rules

IAX2 uses a single UDP port, which makes firewall rules straightforward:

# Allow IAX2 from the remote office
iptables -A INPUT -p udp -s 10.2.2.20 --dport 4569 -j ACCEPT

Unlike SIP, there is no separate RTP port range to open. Audio travels inside the IAX2 protocol on the same port. This is one of the main advantages of IAX2 for server-to-server links, especially across NAT or restrictive firewalls.

When to use IAX2 vs PJSIP trunking

IAX2 is a good fit for Asterisk-to-Asterisk links where both sides are under your control. It uses one port, handles NAT cleanly, and trunking reduces per-call overhead.

PJSIP trunking is better when the remote side is not Asterisk (a SIP provider, a different PBX vendor, or a third-party service). SIP is the universal standard; IAX2 only works between Asterisk systems.

For most multi-site deployments where both sites run Asterisk, IAX2 is the simpler option.

Common problems

"No authority found" on incoming calls. The username on the local side must match the section name on the remote side. If office-a defines [office-b] with username = office-a, then office-b must have a section named [office-a].

Calls connect but no audio. If you accidentally opened SIP ports instead of IAX2 port 4569, or if there is a firewall between the servers blocking UDP. IAX2 carries audio inside the protocol, so if the signaling works, audio should too.

Peer shows UNREACHABLE. Firewall blocking UDP 4569, wrong IP address in host, or the remote Asterisk is not running. Check qualify pings with iax2 show peers.