PJSIP IP ACL

Restrict which IP addresses can register or send calls through your Asterisk system using PJSIP ACLs. This is a first line of defence against SIP scanning and brute-force registration attacks.

Requirements

• PJSIP stack (not legacy chan_sip)
• acl.conf or pjsip.conf ACL section

Configuration

acl.conf

[trusted-networks]
deny=0.0.0.0/0.0.0.0
permit=10.0.0.0/255.0.0.0
permit=172.16.0.0/255.240.0.0
permit=192.168.0.0/255.255.0.0
; Add your SIP trunk provider IPs here
permit=203.0.113.50/255.255.255.255

pjsip.conf: apply the ACL to a transport or endpoint

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0

[my-endpoint]
type=endpoint
; ... other endpoint settings ...
acl=trusted-networks

How it works

1. Deny all: The deny=0.0.0.0/0.0.0.0 rule blocks every source IP by default.
2. Permit trusted ranges: Subsequent permit lines whitelist your LAN subnets and SIP trunk provider addresses.
3. ACL binding: Setting acl=trusted-networks on an endpoint (or transport) causes Asterisk to drop SIP packets from non-permitted sources before authentication is even attempted.

Tips

• Combine ACLs with fail2ban for defence in depth: ACLs block unknown IPs, while fail2ban catches brute-force attempts from permitted ranges.
• Use asterisk -rx "pjsip show aors" and "pjsip show contacts" to verify which peers are registered.
• For SIP trunk providers, always whitelist their specific IPs rather than broad ranges.
• Consider also enabling TLS (protocol=tls) and SRTP to protect signalling and media.