Configuring Kamailio on Your CloudSOE Instance

This guide covers the layout and day-two configuration of the CloudSOE Kamailio image on both AWS and Azure. It assumes you’ve finished one of the getting-started guides (AWS, Azure).

File locations

Kamailio is installed from the official kamailio.org apt repository; the newest stable branch for the OS release is auto-detected at image build time (check yours with kamailio -v).

Services

sudo systemctl status kamailio fail2ban
sudo systemctl restart kamailio     # after config changes

Always syntax-check before restarting — a broken config leaves you with no proxy:

sudo kamailio -c -f /etc/kamailio/kamailio.cfg

The one-time kamailio-firstboot service only fills the public IP into the login banner; it exits immediately on later boots thanks to its marker file (/var/lib/kamailio-firstboot.done).

kamctl and kamcmd

Two management tools ship with the package:

kamcmd core.version          # RPC into the running process
kamcmd core.uptime
kamctl stats                 # statistics summary
kamctl ul show               # user location (registrations), once usrloc is enabled

Arming the fail2ban SIP filter

The kamailio jail is enabled out of the box (5 failures in 10 minutes → 1 hour ban, escalating to 1 week), but Kamailio’s stock config does not log failed SIP authentication — so the filter has nothing to match until you feed it. In the auth-failure branch of your kamailio.cfg routing script, add:

xlog("L_NOTICE", "AUTH FAILURE: user=$fU ip=$si\n");

That exact AUTH FAILURE ... ip= shape is what /etc/fail2ban/filter.d/kamailio.conf matches (it also catches common community phrasings like auth failed ... from). The jails read the systemd journal directly (backend = systemd) — no log files to rotate or point at.

Whitelist yourself first (sudo fail2ban-client set kamailio addignoreip <your-ip>), or persist it by uncommenting the ignoreip line in /etc/fail2ban/jail.d/kamailio.local and restarting fail2ban.

NAT and the public IP

On both clouds the instance knows only its private IP while the world sees the public one. For a proxy this matters in two places:

• Advertised address — if Kamailio should present the public IP in Via/Record-Route headers, set advertise on the listen directive in kamailio.cfg, e.g. listen=udp:<private-ip>:5060 advertise <public-ip>:5060.
• Far-end NAT traversal — clients behind their own NATs need the nathelper module and rport/received handling; the stock config ships with a NAT block you can enable.

The login banner shows the public IP captured at first boot.

Where media goes

Kamailio proxies signalling only. RTP flows directly between your endpoints and media servers. If you need this host to relay media (e.g. for clients behind symmetric NAT), install and integrate rtpengine or rtpproxy — and only then open a media port range in your security group / NSG, matching the relay’s configured range.

Next steps

• Tips & tricks — lockout recovery, watching scanners, backups and updates