Kamailio

Route calls from Kamailio to Vonyx with digest auth, and accept calls from Vonyx.

Use Vonyx as Kamailio's upstream gateway. Kamailio sends outbound calls to Vonyx and answers its digest challenge with the uac module. Inbound calls from Vonyx are recognised by source IP with ipops.

Before you start

A Vonyx SIP trunk with a number attached
A working kamailio.cfg with tm, sl and rr loaded, as in the default config
Endpoints behind Kamailio that offer PCMU or PCMA. Kamailio doesn't touch the SDP, so codecs come from your endpoints.

Outbound calls

Load the modules

Add these to the module section, skipping any you already load.

kamailio.cfg

loadmodule "dialog.so"
loadmodule "uac.so"
loadmodule "ipops.so"
 
# Credentials are set per call in the failure route.
modparam("uac", "auth_username_avp", "$avp(auser)")
modparam("uac", "auth_password_avp", "$avp(apass)")
modparam("uac", "auth_realm_avp", "$avp(arealm)")
 
# uac_auth() doesn't bump CSeq; the dialog module fixes later in-dialog requests.
modparam("dialog", "track_cseq_updates", 1)

$avp(arealm) is left empty, so the realm is taken from Vonyx's challenge.

Send calls to Vonyx

Call route(TO_VONYX) from request_route for calls that should go out, for example when the dialled number is 91 plus 10 digits.

kamailio.cfg

request_route {
    # ... your existing checks, WITHINDLG handling, etc.
 
    if (is_method("INVITE") && $rU =~ "^91[0-9]{10}$") {
        route(TO_VONYX);
    }
 
    # ...
}
 
route[TO_VONYX] {
    dlg_manage();
    record_route();
    $rd = "43.204.9.41";
    $rp = 5060;
    $du = "sip:43.204.9.41:5060";
    t_on_failure("VONYX_AUTH");
    if (!t_relay()) {
        sl_reply_error();
    }
    exit;
}
 
failure_route[VONYX_AUTH] {
    if (t_is_canceled()) {
        exit;
    }
    if (t_check_status("401|407")) {
        $avp(auser) = "your_trunk_username";
        $avp(apass) = "your_trunk_password";
        if (uac_auth()) {
            t_relay();
        }
        exit;
    }
}

The From user must be one of your Vonyx numbers (91XXXXXXXXXX). Set it on the endpoint or PBX that starts the call.

Inbound calls

Accept calls from Vonyx

Vonyx sends inbound calls from 43.204.9.41. Check the source IP before your auth checks, so these calls aren't challenged, and route them to your PBX or agent.

kamailio.cfg

request_route {
    # ... before route(AUTH)
 
    if (is_method("INVITE") && is_in_subnet("$si", "43.204.9.41/32")) {
        record_route();
        # Send to your PBX or agent, for example:
        $du = "sip:pbx.internal.example:5060";
        route(RELAY);
        exit;
    }
 
    # ...
}

route(RELAY) is the relay route from the default config. Use your own if you have one.

Point Vonyx at Kamailio

In the Vonyx console, open the trunk, turn on Inbound calls, and set Inbound address to Kamailio's public host, for example sip.example.com:5060. See Inbound calls.

Media and NAT

Kamailio only relays signalling. RTP flows straight between Vonyx (UDP 10000–20000) and your endpoint. The endpoint's RTP ports must be reachable from 43.204.9.41, and its SDP must carry a public address. If your endpoints are behind NAT, put an RTP relay such as rtpengine in front of them.

Test the connection

Restart Kamailio after changing the config: kamailio -c checks it first.
Place a call from an endpoint to 91XXXXXXXXXX. In a SIP trace you should see INVITE → 401 or 407 → INVITE with an Authorization header → 200 OK.
Call your Vonyx number from a mobile and check it reaches your PBX.

Limitations

DTMF and call transfer are not available on Vonyx yet.
New accounts make 1 call at a time (raise limits).
No TLS or SRTP: use UDP or TCP on port 5060.
Vonyx has one SIP address, so dispatcher adds nothing over the fixed $du above.

Troubleshooting

Problem	Fix
Second `401` / `407` after the auth retry	Check the username and password in `failure_route[VONYX_AUTH]`.
`429` after auth succeeds	The From user isn't one of your Vonyx numbers.
BYE or re-INVITE rejected after an authenticated call	Make sure `dlg_manage()` runs on the INVITE and `track_cseq_updates` is `1`.
Inbound calls get challenged or `403`	Put the `is_in_subnet` check before your auth route.
One-way or no audio	Open the endpoint's RTP ports to `43.204.9.41`, or add an RTP relay for endpoints behind NAT.

On this page