SIP Trunk — Customer Setup Guide¶

If you've been provisioned with an Astradial SIP trunk, this is the document we sent you. It walks you through plugging the trunk into your Asterisk / FusionPBX / FreePBX install.

The trunk is delivered over WireGuard (a private VPN) — we don't expose SIP on the public internet, which keeps your traffic clean and lets us authenticate you by your tunnel address instead of a password. WireGuard runs on every modern Linux distro and needs no ongoing maintenance after setup.

How auth works — IP-authenticated peer (no password)¶

There is no SIP username or password. Once the WireGuard tunnel is up, we identify your PBX by its tunnel IP address (10.30.0.1). Because WireGuard cryptographically guarantees only the holder of your private key can use that address, this is strong authentication with nothing to leak or rotate. Your PBX trunk is configured with Authentication = None and Register = No.

What you'll receive from us¶

Topology — your PBX is the WireGuard listener¶

Our gateway (the NUC) sits behind a home connection and dials out to you, so your server runs the WireGuard listener and must have a public IP and an open inbound UDP port (default 51821). This is the normal case for a VPS-hosted PBX.

  [Your PBX]  ── public UDP :51821 ──  our gateway connects IN
   10.30.0.1                            (NUC, 10.30.0.2)

If your PBX is behind NAT with no public IP, tell us — we'll arrange an alternative.

Before you start¶

1. You generated a WireGuard keypair on your PBX and sent us the public key. (If not: wg genkey | tee privatekey | wg pubkey > publickey, send us publickey, keep privatekey safe.) We never need your private key.
2. Your firewall allows inbound UDP 51821 (or the port in the conf we sent) so our gateway can establish the tunnel.

Step 1 — Bring up the WireGuard tunnel¶

On the PBX server (root):

apt install -y wireguard           # or yum / dnf equivalent
mv ~/wireguard-peer.conf /etc/wireguard/astradial-trunk.conf
chmod 600 /etc/wireguard/astradial-trunk.conf
wg-quick up astradial-trunk
systemctl enable wg-quick@astradial-trunk    # survive reboots

The conf we send you looks like this (your PBX is the listener; our gateway is the peer that connects in):

[Interface]
Address = 10.30.0.1/32
ListenPort = 51821
PrivateKey = <your private key>

[Peer]
# Astradial gateway (NUC) — it initiates; no Endpoint line needed here
PublicKey = <our gateway public key>
AllowedIPs = 10.30.0.2/32

Verify (our gateway will connect within a minute or two of provisioning):

wg show astradial-trunk          # expect a recent handshake + transfer
ping -c 3 10.30.0.2              # the trunk host (our gateway)

If ping fails: confirm your firewall lets UDP 51821 in, and that the public key you sent us matches the private key in this conf.

Step 2 — Add the trunk in your PBX (no registration, no password)¶

The trunk host is 10.30.0.2:5070. Authentication is by tunnel IP — do not configure a username, password, or registration.

Asterisk (PJSIP, plain pjsip.conf)¶

[astradial-aor]
type = aor
contact = sip:10.30.0.2:5070
qualify_frequency = 30

[astradial-endpoint]
type = endpoint
transport = transport-udp
context = from-astradial
disallow = all
allow = ulaw,alaw
aors = astradial-aor
direct_media = no
force_rport = yes
rewrite_contact = yes
rtp_symmetric = yes
from_domain = 10.30.0.2

[astradial-identify]
type = identify
endpoint = astradial-endpoint
match = 10.30.0.2          ; trust calls coming FROM our gateway

No [registration] and no [auth] section — that's intentional. Reload: asterisk -rx 'pjsip reload', then asterisk -rx 'pjsip show endpoints' should list astradial-endpoint as Not in use (Avail).

FusionPBX¶

Accounts → Gateways → Add Gateway

Save → start the gateway. With Register=False there is no REGED state to wait for; the gateway is usable immediately.

FreePBX (Asterisk + GUI)¶

Connectivity → Trunks → Add Trunk → Add SIP (chan_pjsip) Trunk

• General: Trunk Name = astradial
• pjsip Settings → General:
• Username = (leave blank)
• Secret = (leave blank)
• Authentication = None
• Registration = None
• SIP Server = 10.30.0.2
• SIP Server Port = 5070
• pjsip Settings → Advanced: Context = from-trunk (or your inbound context)

Submit → Apply Config.

Step 3 — Route your DIDs¶

We allocated specific DIDs to you. Tell your PBX what to do when those ring in.

Asterisk dialplan (extensions.conf)¶

[from-astradial]
exten => +918065080710,1,NoOp(Incoming on first allocated DID)
 same => n,Dial(PJSIP/101)
 same => n,Hangup()

exten => +918065080711,1,NoOp(Incoming on second allocated DID)
 same => n,Dial(PJSIP/102)
 same => n,Hangup()

FusionPBX¶

Dialplan → Inbound Routes → one row per allocated DID.

FreePBX¶

Connectivity → Inbound Routes → Add Inbound Route → DID Number = +918065080710 (one route per DID) → Set Destination.

Step 4 — Set CallerID for outbound¶

Our gateway requires the outbound From-header to be one of your allocated DIDs. Any other CallerID is rejected with 403 before it reaches the carrier — this is the anti-spoofing rule that protects everyone on the platform. You can present only the DIDs we allocated, not any other number in our range.

Asterisk¶

exten => _9X.,1,Set(CALLERID(num)=+918065080710)
 same => n,Dial(PJSIP/${EXTEN:1}@astradial-endpoint)

FusionPBX¶

Accounts → Extensions → Edit → Outbound Caller ID Number = an allocated DID.

FreePBX¶

Applications → Extensions → Edit → Outbound CID = your DID, e.g. <+918065080710>.

Step 5 — Test¶

• Outbound — dial a PSTN number you control; confirm it rings, audio is two-way, and the callee sees your allocated DID.
• Inbound — call +918065080710; your routed extension should ring.
• Channel limit — your plan is N concurrent channels. Placing more than N simultaneous calls returns busy/congestion on the over-limit call. That's the cap working, not a bug.

Common issues¶

What's NOT supported (yet)¶

• Picking which extension a DID routes to — your PBX decides; we just deliver the call.
• More than one PBX per customer — ask us about adding a second peer.
• TCP/TLS transport — UDP only for now.
• T.38 faxing — use a SIP-fax-to-email integration instead.

What to send us if you need help¶

- Trunk name we issued you
- `wg show astradial-trunk` output (redact the private key)
- `pjsip show endpoints` output (or your PBX's equivalent)
- Outbound failure: a `pjsip set logger on` capture of the call
- Inbound failure: the caller's number + the time (to match our log)

Email support@astradial.in with the above; we usually turn around within one business day.