IAX2 Trunk Between Two Asterisk Servers

IAX2Inter-Asterisk eXchange protocol version 2. A lightweight Asterisk-native VoIP protocol that carries signaling and media over a single UDP port (4569). (Inter-Asterisk Exchange) is a protocol designed specifically for connecting Asterisk systems. It uses a single UDP port (4569), handles NAT better than SIPSession Initiation Protocol, the standard signaling protocol used to set up, manage, and tear down VoIP calls between Asterisk and phones or carriers. for server-to-server links, and supports trunking (multiplexing multiple calls into fewer packets). For peering two offices or linking a primary and backup PBXPrivate Branch Exchange, a private telephone switch. Asterisk is a software PBX that routes calls between internal extensions and the outside world., it is simpler to set up than a PJSIPThe modern SIP channel driver in Asterisk (chan_pjsip), replacing the older chan_sip. Configured in pjsip.conf using endpoints, AORs, auths, and transports. trunkA connection between Asterisk and another PBX or an ITSP/carrier, used to send and receive external calls..

The setup

Two servers: office-a at 10.1.1.10 and office-b at 10.2.2.20. When someone at office-a dials a 3xx extensionA dialplan entry that matches a dialed number or pattern within a context and triggers a sequence of prioritized steps., the call routes to office-b, and vice versa for 2xx extensions.

This assumes office-a and office-b already have a routable path to each other, for example a site-to-site VPN, MPLS link, or leased line. Private addresses like these are not reachable across the public internet on their own. If there is no private link between the sites, use each server's public IP in host= instead, and make sure your firewall and any NAT forward UDP 4569 to the Asterisk box.

iax.conf on office-a

[general]
bindport = 4569
bindaddr = 0.0.0.0
disallow = all
allow = ulaw
allow = alaw

[office-b]
type = friend
username = office-a
secret = a-strong-shared-secret
auth = md5
host = 10.2.2.20
deny = 0.0.0.0/0.0.0.0
permit = 10.2.2.20/255.255.255.255
context = from-iax
peercontext = from-iax
qualify = yes
trunk = yes

iax.conf on office-b

[general]
bindport = 4569
bindaddr = 0.0.0.0
disallow = all
allow = ulaw
allow = alaw

[office-a]
type = friend
username = office-b
secret = a-strong-shared-secret
auth = md5
host = 10.1.1.10
deny = 0.0.0.0/0.0.0.0
permit = 10.1.1.10/255.255.255.255
context = from-iax
peercontext = from-iax
qualify = yes
trunk = yes

The configs mirror each other. Each side defines a friend entry (sends and receives calls) named after the remote server. The secret must match on both sides. auth = md5 hashes the password instead of sending it in plaintext.

trunk = yes enables IAX2 trunking, which packs multiple concurrent calls between the servers into fewer IP packets. Reduces overhead when several calls are active simultaneously.

qualify = yes sends periodic pings so each side knows the other is still reachable. If the remote goes down, Asterisk marks it as unreachable and stops sending calls.

peercontext = from-iax means you can dial IAX2/office-b/300 without specifying the contextA named section of the dialplan that groups extensions. Calls enter a specific context and can only reach extensions visible from it, making contexts the basic unit of call routing and security.; it automatically lands in [from-iax] on the remote side.

Dialplan on both servers

Each server needs a [from-iax] context to receive calls from the peer, and outbound routes to send calls to the peer.

On office-a (extensions 200-299, routes 3xx to office-b):

; Incoming from office-b
[from-iax]
exten => _2XX,1,Dial(PJSIP/${EXTEN},30)
same => n,Voicemail(${EXTEN}@default,u)
same => n,Hangup()

; Outbound to office-b
[internal]
exten => _3XX,1,Dial(IAX2/office-b/${EXTEN})
same => n,Hangup()

On office-b (extensions 300-399, routes 2xx to office-a):

[from-iax]
exten => _3XX,1,Dial(PJSIP/${EXTEN},30)
same => n,Voicemail(${EXTEN}@default,u)
same => n,Hangup()

[internal]
exten => _2XX,1,Dial(IAX2/office-a/${EXTEN})
same => n,Hangup()

Verifying the link

Reload IAX2 on both servers:

asterisk -rx "iax2 reload"

Check the peer status:

asterisk -rx "iax2 show peers"

You should see the remote peer listed with a status of OK and a round-trip time in milliseconds. If it shows UNREACHABLE, check firewall rules for UDP port 4569.

Test a call:

# From office-a, call extension 300 at office-b
asterisk -rx "channel originate Local/300@internal application Wait 10"

Firewall rules

IAX2 uses a single UDP port, which makes firewall rules straightforward:

# Allow IAX2 from the remote office
iptables -A INPUT -p udp -s 10.2.2.20 --dport 4569 -j ACCEPT

Unlike SIP, there is no separate RTPReal-time Transport Protocol. Carries the actual audio (media) of a VoIP call after SIP signaling has set it up. port range to open. Audio travels inside the IAX2 protocol on the same port. This is one of the main advantages of IAX2 for server-to-server links, especially across NAT or restrictive firewalls.

When to use IAX2 vs PJSIP trunking

IAX2 is a good fit for Asterisk-to-Asterisk links where both sides are under your control. It uses one port, handles NAT cleanly, and trunking reduces per-call overhead. It also supports native call encryption with encryption = aes128 on both sides, encrypting signaling and audio at the protocol level without a separate TLS listener or SRTP setup. This is worth turning on if the trunk crosses a link you do not fully control.

PJSIP trunking is better when the remote side is not Asterisk (a SIP provider, a different PBX vendor, or a third-party service). SIP is the universal standard; IAX2 only works between Asterisk systems.

For most multi-site deployments where both sites run Asterisk, IAX2 is the simpler option.

Common problems

"No authority found" on incoming calls. The username on the local side must match the section name on the remote side. If office-a defines [office-b] with username = office-a, then office-b must have a section named [office-a].

Calls connect but no audio. If you accidentally opened SIP ports instead of IAX2 port 4569, or if there is a firewall between the servers blocking UDP. IAX2 carries audio inside the protocol, so if the signaling works, audio should too.

Peer shows UNREACHABLE. Firewall blocking UDP 4569, wrong IP address in host, or the remote Asterisk is not running. Check qualify pings with iax2 show peers.