PJSIP IP ACL

Restrict which IP addresses can register or send calls through your Asterisk system using PJSIPThe modern SIP channel driver in Asterisk (chan_pjsip), replacing the older chan_sip. Configured in pjsip.conf using endpoints, AORs, auths, and transports. ACLs. This is a first line of defence against SIPSession Initiation Protocol, the standard signaling protocol used to set up, manage, and tear down VoIP calls between Asterisk and phones or carriers. scanning and brute-force registration attacks.

Requirements

• PJSIP stack (not legacy chan_sip)
• acl.conf or pjsip.conf ACL section

Configuration

acl.conf

[trusted-networks]
deny=0.0.0.0/0.0.0.0
permit=10.0.0.0/255.0.0.0
permit=172.16.0.0/255.240.0.0
permit=192.168.0.0/255.255.0.0
; Add your SIP trunk provider IPs here
permit=203.0.113.50/255.255.255.255

pjsip.conf: apply the ACL to a transport or endpoint

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0

[my-endpoint]
type=endpoint
; ... other endpoint settings ...
acl=trusted-networks

How it works

1. Deny all: The deny=0.0.0.0/0.0.0.0 rule blocks every source IP by default.
2. Permit trusted ranges: Subsequent permit lines whitelist your LAN subnets and SIP trunkA connection between Asterisk and another PBX or an ITSP/carrier, used to send and receive external calls. provider addresses.
3. ACL binding: Setting acl=trusted-networks on an endpointIn PJSIP configuration, the SIP entity Asterisk communicates with: a phone, trunk, or other user agent. Defined by an endpoint section in pjsip.conf. (or transport) causes Asterisk to drop SIP packets from non-permitted sources before authentication is even attempted.

Tips

• Combine ACLs with fail2ban for defence in depth: ACLs block unknown IPs, while fail2ban catches brute-force attempts from permitted ranges.
• For the main deployment instructions, see Fail2ban for Asterisk. Debian 12+ systems without rsyslog should use the systemd variant.
• Use asterisk -rx "pjsip show aors" and "pjsip show contacts" to verify which peers are registered.
• For SIP trunk providers, always whitelist their specific IPs rather than broad ranges.
• Consider also enabling TLS (protocol=tls) and SRTP to protect signalling and media.