The CloudSOE Asterisk image gives you Asterisk 22 from the Ubuntu repositories on a hardened Ubuntu base, with fail2ban pre-configured against wardialers and SIP brute-force. There is no web UI and no credentials file: Asterisk is administered through its console (asterisk -rvvv) and the config files in /etc/asterisk/ — a clean canvas for people who want to build their dialplan by hand.
What you’ll need
- An Azure subscription
- An SSH public key (password login is disabled in the image)
- Working knowledge of Asterisk configuration — this image deliberately ships the stock config
Step 1 — Create the VM
- Find the CloudSOE Asterisk offer in the Azure Marketplace and click Create.
- Choose a resource group, region and VM name.
- Pick a size — 2 vCPU / 2–4 GB (for example
Standard_B2s) handles a small deployment; Asterisk is light until you transcode many concurrent calls. - Under Administrator account, select SSH public key, pick a username (e.g.
azureuser) and paste your key. This is the account you’ll SSH in with. - Attach a public IP, and set it to Static — trunk registrations and phone configs break if the address changes on stop/start.
Step 2 — Open the firewall ports (carefully)
SIP exposed to the whole internet attracts constant scanning within minutes. Wardialers probe port 5060 around the clock looking for weak credentials to route toll fraud through. Restrict the SIP and RTP rules to the IP ranges of your trunk provider and phones wherever possible. The image’s fail2ban jail helps — it is not a substitute for tight source ranges.
In the VM’s network security group, allow inbound:
| Port | Protocol | Purpose |
|---|---|---|
| 22 | TCP | SSH administration (restrict to your admin IPs) |
| 5060 | UDP + TCP | SIP signalling (restrict to trunk provider / phones) |
| 5061 | TCP | SIP over TLS, if you enable it |
| 10000–20000 | UDP | RTP media (audio) |
Azure note: SIP over UDP needs an explicit UDP rule in the NSG, and the RTP range is UDP only — double-check the protocol column after saving. The RTP range is Asterisk’s default from /etc/asterisk/rtp.conf; if you change it there, change the NSG to match.
Step 3 — Let first boot finish
On the very first boot a one-time service (asterisk-firstboot) fills your VM’s public IP into the login banner. Asterisk and fail2ban start automatically:
ssh <admin-user>@<public-ip>
systemctl status asterisk-firstboot asterisk fail2banStep 4 — Reach the Asterisk console
The login banner (MOTD) shows your SIP URI and a quick-start cheat sheet. Open the console:
sudo asterisk -rvvvUseful first commands: core show version, pjsip show endpoints, core show channels. Type exit to leave — Asterisk keeps running. Remember that an Azure VM often cannot reach its own public IP from inside, so test SIP registration from an outside client, not from the VM itself.
Step 5 — Know your fail2ban jail
The image enables Asterisk’s security log and points a pre-tuned fail2ban jail at it: 5 failures in 10 minutes bans an IP for 1 hour, and repeat offenders escalate up to 1 week. Check it:
sudo fail2ban-client status asteriskBefore testing SIP registration from your own IP with deliberately bad credentials, whitelist yourself first:
sudo fail2ban-client set asterisk addignoreip <your-ip>Next steps
- Configure Asterisk — config files, PJSIP, NAT settings and the security log
- Tips & tricks — fail2ban management, one-way audio, backups and troubleshooting