Getting Started with Kamailio on AWS

The CloudSOE Kamailio image gives you the Kamailio SIP server, installed from the official kamailio.org apt repository (the newest stable branch is auto-detected at build time), on a hardened Ubuntu base — with fail2ban jails for both SSH and SIP ready to go. There is no web UI and no credentials file: Kamailio is a SIP proxy, administered through /etc/kamailio/kamailio.cfg and the kamctl / kamcmd tools.

What you’ll need

• An AWS account subscribed to the CloudSOE Kamailio listing on AWS Marketplace
• An EC2 key pair in your target region (SSH is key-based only; password login is disabled)
• Working knowledge of Kamailio routing script — the image deliberately ships the stock config

Step 1 — Launch the instance

1. Open the Kamailio listing on AWS Marketplace and click Continue to Subscribe, then Continue to Configuration.
2. Pick your region and click Continue to Launch → Launch through EC2.
3. Choose an instance type. t3.small (2 vCPU, 2 GB RAM) is plenty for a signalling-only proxy handling thousands of registrations.
4. Select your key pair and accept the default root volume.

Prefer the CLI? Once subscribed:

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type t3.small \
  --key-name my-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=kamailio-01}]'

Step 2 — Open the firewall ports (carefully)

SIP exposed to the whole internet attracts constant scanning within minutes. Scanners probe port 5060 around the clock. Restrict SIP to the IP ranges of your trunk providers, media servers and edge devices wherever possible. fail2ban helps — it is not a substitute for tight source ranges.

Kamailio is a proxy: RTP media flows between your endpoints and media servers, not through this box — so no RTP range is needed here. Only if you add an RTP relay on this host (rtpengine, rtpproxy) do you open its media range.

Step 3 — Let first boot finish

On the very first boot a one-time service (kamailio-firstboot) fills your instance’s public IP into the login banner. Kamailio and fail2ban start automatically:

ssh ubuntu@<public-ip>
systemctl status kamailio-firstboot kamailio fail2ban

Step 4 — Verify the proxy

The login banner (MOTD) shows your SIP URI and a quick-start cheat sheet. Confirm Kamailio answers:

kamcmd core.version
kamctl stats

Configuration lives in /etc/kamailio/kamailio.cfg; the stock config is a working registrar/proxy you can build on.

Step 5 — Know your fail2ban jails — and don’t lock yourself out

The image ships two journald-backed jails: sshd (active immediately) and kamailio (5 failures in 10 minutes → 1 hour ban, escalating to 1 week). Before you start testing SIP auth or scripting against the box, whitelist your admin IP:

sudo fail2ban-client set sshd addignoreip <your-ip>
sudo fail2ban-client set kamailio addignoreip <your-ip>

The kamailio jail only arms itself once your routing script logs failed authentication — see the configuration guide for the one-line xlog you add.

Next steps

• Configure Kamailio — kamailio.cfg, kamctl/kamcmd, arming the fail2ban filter
• Tips & tricks — lockout recovery, syntax checking, updates and troubleshooting