Getting Started with Asterisk on AWS

The CloudSOE Asterisk image gives you Asterisk 22 from the Ubuntu repositories on a hardened Ubuntu base, with fail2ban pre-configured against wardialers and SIP brute-force. There is no web UI and no credentials file: Asterisk is administered through its console (asterisk -rvvv) and the config files in /etc/asterisk/ — a clean canvas for people who want to build their dialplan by hand.

What you’ll need

• An AWS account subscribed to the CloudSOE Asterisk listing on AWS Marketplace
• An EC2 key pair in your target region (SSH is key-based only; password login is disabled)
• Working knowledge of Asterisk configuration — this image deliberately ships the stock config

Step 1 — Launch the instance

1. Open the Asterisk listing on AWS Marketplace and click Continue to Subscribe, then Continue to Configuration.
2. Pick your region and click Continue to Launch → Launch through EC2.
3. Choose an instance type. t3.small (2 vCPU, 2 GB RAM) handles a small deployment comfortably; Asterisk is light until you transcode many concurrent calls.
4. Select your key pair and accept or grow the root volume.

Prefer the CLI? Once subscribed:

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type t3.small \
  --key-name my-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=asterisk-01}]'

Step 2 — Open the firewall ports (carefully)

SIP exposed to the whole internet attracts constant scanning within minutes. Wardialers probe port 5060 around the clock looking for weak credentials to route toll fraud through. Restrict the SIP and RTP rules to the IP ranges of your trunk provider and phones wherever possible. The image’s fail2ban jail helps — it is not a substitute for tight source ranges.

The RTP range is Asterisk’s default from /etc/asterisk/rtp.conf — if you change it there, change your security group to match.

Step 3 — Let first boot finish

On the very first boot a one-time service (asterisk-firstboot) fills your instance’s public IP into the login banner. Asterisk and fail2ban start automatically:

ssh ubuntu@<public-ip>
systemctl status asterisk-firstboot asterisk fail2ban

Step 4 — Reach the Asterisk console

The login banner (MOTD) shows your SIP URI and a quick-start cheat sheet. Open the console:

sudo asterisk -rvvv

Useful first commands: core show version, pjsip show endpoints, core show channels. Type exit to leave — Asterisk keeps running.

Step 5 — Know your fail2ban jail

The image enables Asterisk’s security log and points a pre-tuned fail2ban jail at it: 5 failures in 10 minutes bans an IP for 1 hour, and repeat offenders escalate up to 1 week. Check it:

sudo fail2ban-client status asterisk

Before testing SIP registration from your own IP with deliberately bad credentials, whitelist yourself first:

sudo fail2ban-client set asterisk addignoreip <your-ip>

Next steps

• Configure Asterisk — config files, PJSIP, NAT settings and the security log
• Tips & tricks — fail2ban management, one-way audio, backups and troubleshooting