Getting Started with OpenSIPS on AWS

The CloudSOE OpenSIPS image gives you the OpenSIPS SIP server, installed from the official apt.opensips.org repository (the newest stable release line is auto-detected at build time), on a hardened Ubuntu base — with fail2ban jails for both SSH and SIP ready to go. There is no web UI and no credentials file: OpenSIPS is a SIP proxy, administered through /etc/opensips/opensips.cfg.

What you’ll need

• An AWS account subscribed to the CloudSOE OpenSIPS listing on AWS Marketplace
• An EC2 key pair in your target region (SSH is key-based only; password login is disabled)
• Working knowledge of OpenSIPS routing script — the image deliberately ships the stock config

Step 1 — Launch the instance

1. Open the OpenSIPS listing on AWS Marketplace and click Continue to Subscribe, then Continue to Configuration.
2. Pick your region and click Continue to Launch → Launch through EC2.
3. Choose an instance type. t3.small (2 vCPU, 2 GB RAM) is plenty for a signalling-only proxy handling thousands of registrations.
4. Select your key pair and accept the default root volume.

Prefer the CLI? Once subscribed:

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type t3.small \
  --key-name my-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=opensips-01}]'

Step 2 — Open the firewall ports (carefully)

SIP exposed to the whole internet attracts constant scanning within minutes. Scanners probe port 5060 around the clock. Restrict SIP to the IP ranges of your trunk providers, media servers and edge devices wherever possible. fail2ban helps — it is not a substitute for tight source ranges.

OpenSIPS is a proxy: RTP media flows between your endpoints and media servers, not through this box — so no RTP range is needed here. Only if you add an RTP relay on this host (rtpproxy, rtpengine) do you open its media range.

Step 3 — Let first boot finish

On the very first boot a one-time service (opensips-firstboot) fills your instance’s public IP into the login banner. OpenSIPS and fail2ban start automatically:

ssh ubuntu@<public-ip>
systemctl status opensips-firstboot opensips fail2ban

Step 4 — Verify the proxy

The login banner (MOTD) shows your SIP URI and a quick-start cheat sheet. Confirm the version and that the process is healthy:

opensips -V
sudo journalctl -u opensips --no-pager | tail -20

Configuration lives in /etc/opensips/opensips.cfg; the stock config is a working proxy you can build on.

Step 5 — Know your fail2ban jails — and don’t lock yourself out

The image ships two journald-backed jails: sshd (active immediately) and opensips (5 failures in 10 minutes → 1 hour ban, escalating to 1 week). Before you start testing SIP auth or scripting against the box, whitelist your admin IP:

sudo fail2ban-client set sshd addignoreip <your-ip>
sudo fail2ban-client set opensips addignoreip <your-ip>

The opensips jail only arms itself once your routing script logs failed authentication — see the configuration guide for the one-line xlog you add.

Next steps

• Configure OpenSIPS — opensips.cfg, syntax checking, arming the fail2ban filter
• Tips & tricks — lockout recovery, watching scanners, backups and troubleshooting