The CloudSOE Kamailio image gives you the Kamailio SIP server, installed from the official kamailio.org apt repository (the newest stable branch is auto-detected at build time), on a hardened Ubuntu base — with fail2ban jails for both SSH and SIP ready to go. There is no web UI and no credentials file: Kamailio is a SIP proxy, administered through /etc/kamailio/kamailio.cfg and the kamctl / kamcmd tools.
What you’ll need
- An Azure subscription
- An SSH public key (password login is disabled in the image)
- Working knowledge of Kamailio routing script — the image deliberately ships the stock config
Step 1 — Create the VM
- Find the CloudSOE Kamailio offer in the Azure Marketplace and click Create.
- Choose a resource group, region and VM name.
- Pick a size — 2 vCPU / 2–4 GB (for example
Standard_B2s) is plenty for a signalling-only proxy handling thousands of registrations. - Under Administrator account, select SSH public key, pick a username (e.g.
azureuser) and paste your key. This is the account you’ll SSH in with. - Attach a public IP, and set it to Static — a SIP proxy whose address changes on stop/start breaks every device registered against it.
Step 2 — Open the firewall ports (carefully)
SIP exposed to the whole internet attracts constant scanning within minutes. Scanners probe port 5060 around the clock. Restrict SIP to the IP ranges of your trunk providers, media servers and edge devices wherever possible. fail2ban helps — it is not a substitute for tight source ranges.
In the VM’s network security group, allow inbound:
| Port | Protocol | Purpose |
|---|---|---|
| 22 | TCP | SSH administration (restrict to your admin IPs) |
| 5060 | UDP + TCP | SIP signalling |
| 5061 | TCP | SIP over TLS, if you enable it |
Azure note: SIP over UDP needs an explicit UDP rule in the NSG — double-check the protocol column after saving. Kamailio is a proxy: RTP media flows between your endpoints and media servers, not through this box, so no RTP range is needed here unless you add an RTP relay (rtpengine, rtpproxy) on this host.
Step 3 — Let first boot finish
On the very first boot a one-time service (kamailio-firstboot) fills your VM’s public IP into the login banner. Kamailio and fail2ban start automatically:
ssh <admin-user>@<public-ip>
systemctl status kamailio-firstboot kamailio fail2banStep 4 — Verify the proxy
The login banner (MOTD) shows your SIP URI and a quick-start cheat sheet. Confirm Kamailio answers:
kamcmd core.version
kamctl statsRemember that an Azure VM often cannot reach its own public IP from inside — test SIP from an outside client, not from the VM itself. Configuration lives in /etc/kamailio/kamailio.cfg; the stock config is a working registrar/proxy you can build on.
Step 5 — Know your fail2ban jails — and don’t lock yourself out
The image ships two journald-backed jails: sshd (active immediately) and kamailio (5 failures in 10 minutes → 1 hour ban, escalating to 1 week). Before you start testing SIP auth or scripting against the box, whitelist your admin IP:
sudo fail2ban-client set sshd addignoreip <your-ip>
sudo fail2ban-client set kamailio addignoreip <your-ip>The kamailio jail only arms itself once your routing script logs failed authentication — see the configuration guide for the one-line xlog you add.
Next steps
- Configure Kamailio — kamailio.cfg, kamctl/kamcmd, arming the fail2ban filter
- Tips & tricks — lockout recovery, syntax checking, updates and troubleshooting