VoIP.infoThe independent guide to business communications.
VoIP.info Guide

Asterisk PJSIP ACLs: source-address and Contact boundaries

Separate all-PJSIP, endpoint, named and REGISTER Contact ACLs before permitting an address or diagnosing a rejected request.

Reviewed 2026-10-08Current Asterisk 22 res_pjsip and res_pjsip_acl references, configuration relationships, sample configuration and diagnostic logging guidance were reviewed October 8, 2026; no Asterisk or FreePBX host, module, generated configuration, endpoint, ACL, source address, Contact address, registration, authentication exchange, firewall, request, packet flow, availability, compatibility or call was inspected or testedAdvancedDocumentation based · not lab tested

Choose the boundary before writing an address rule

Inventory the running Asterisk branch, configuration owner, listening transports and the exact traffic to constrain. Preserve the observed packet source address and port, transport, request method, identified endpoint and, for REGISTER, the Contact URI host. Those are different inputs even when they happen to contain the same address in one capture.

An operating-system firewall, provider allow-list, PJSIP endpoint-identification rule, SIP authentication object and PJSIP ACL make different decisions. Passing one control does not imply that another control accepted the request, and an ACL match does not authenticate a SIP identity or authorize dialplan access.

Distinguish the module-wide ACL object from endpoint controls

The Asterisk 22 res_pjsip_acl reference describes an ACL object that is independent of endpoints and operates on all inbound PJSIP communication. Its permit and deny options evaluate source IP addresses; its Contact variants evaluate Contact header addresses in incoming REGISTER requests. A broad module-wide object can therefore affect traffic before an operator has proved which endpoint or service was intended.

The endpoint object also exposes acl, permit, deny, contact_acl, contact_permit and contact_deny. Record where each rule is declared and which configuration object owns it. Do not copy a correct network into every layer or remove a global rule merely because one endpoint needs a narrower exception.

Keep packet source and REGISTER Contact evidence separate

A REGISTER can arrive from one packet source while advertising another host in its Contact URI because of NAT, a proxy, a load balancer or a client configuration error. Source-address ACLs answer whether the sender may reach this PJSIP boundary. Contact ACLs answer whether the address advertised for later requests is permitted. The latter is evaluated for Contact headers in incoming REGISTER requests, not as a universal replacement for source filtering.

Preserve the original Contact, any supported rewrite behavior, stored AoR contact and later request destination separately. Permitting the public NAT address as a packet source does not automatically justify a private, loopback, link-local or unrelated Contact target.

Use named ACLs for reuse without hiding their contents

Asterisk lets PJSIP rules reference named IP or Contact ACL sections from acl.conf through acl or contact_acl. The current sample documents acl show, acl show <name> and reload acl for inspecting and reloading named ACLs. Preserve the name and expanded entries with the PJSIP object that references them; a name alone is not evidence of the effective network set.

The sample also shows ordered allow and deny expressions, subnets and a negated address inside a permit expression. Review the actual loaded result rather than inferring behavior from a copied fragment. A single address exception should remain bounded and documented instead of widening an entire provider or office range.

Test positive and negative controls with rollback

Before change, retain the loaded objects, named ACL contents, relevant log event and a bounded packet capture with sensitive values protected. Apply the smallest change through standalone Asterisk or the FreePBX-managed interface that owns the generated configuration. Confirm that the intended source and Contact pass, an unrelated source and an unsafe Contact still fail, authentication remains required and the expected dialplan context is unchanged.

Use pjsip set logger on only for an authorized short reproduction and disable it immediately, following Asterisk's logging guidance. Do not publish credentials or full customer numbers. No ACL, registration, firewall path, endpoint or call was tested for this guide.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Examples require adaptation to your topology. No live PBX or hardware testing is claimed.

Continue your research

Hub

Asterisk

Understand the programmable PBX and follow the Asterisk 22 LTS documentation baseline.

Explore topic →
Guide · Asterisk 22 LTS

Asterisk PJSIP: understand the configuration objects

Connect endpoint behavior, authentication, contacts and transport without collapsing them into one account setting.

Read guide →
Guide · Asterisk 22 LTS res_pjsip and endpoint-identifier references, the Asterisk endpoint-identification article and GHSA-qqxj-v78h-hrf9 were reviewed October 8, 2026; no PBX, package, module, configuration, endpoint, identify object, address, DNS answer, request, security event, registration, authentication, route, media path or live call was inspected or tested

Asterisk PJSIP endpoint identification: order, scope and evidence

Control how Asterisk 22 maps an incoming SIP request to an endpoint before authentication and dialplan routing.

Read guide →
Guide · Current Asterisk res_pjsip, PJSIP troubleshooting, dialing and management-interface references reviewed October 6, 2026; no Asterisk host, endpoint, AoR, contact, registration, device, network path or call was inspected or tested

Asterisk PJSIP AoRs and contacts: registration, limits and dialing

Follow a PJSIP endpoint through its AoR and live contacts, then keep admission limits, reachability and first-versus-all-contact dialing as separate decisions.

Read guide →
Guide

Should a PBX be exposed to the public internet?

Separate necessary carrier and phone reachability from administrative exposure.

Read guide →
Guide · Operational guidance; Asterisk 22 / FreePBX 17 where applicable

Least privilege for PBX users and integrations

Separate the right to register, place calls, administer the PBX and read sensitive data.

Read guide →
Diagnostic · Current Asterisk 22 res_pjsip and res_pjsip_acl references, configuration relationships, sample configuration and diagnostic logging guidance were reviewed October 8, 2026; no Asterisk or FreePBX host, module, generated configuration, endpoint, ACL, source address, Contact address, registration, authentication exchange, firewall, request, packet flow, availability, compatibility or call was inspected or tested

Asterisk PJSIP ACL rejects a request or REGISTER Contact

Locate whether a PJSIP request failed a module-wide source ACL, an endpoint rule or a REGISTER Contact-address policy before widening access.

Read guide →
Troubleshooting · Asterisk 22 LTS res_pjsip and endpoint-identifier references, the Asterisk endpoint-identification article, current object-relationship and troubleshooting guidance and GHSA-qqxj-v78h-hrf9 were reviewed October 8, 2026; the installed branch, patches, modules, generated configuration, endpoints, identify objects, DNS, provider signaling addresses, proxy path and SIP transactions require runtime verification

Asterisk PJSIP cannot identify an inbound request: endpoint-matching diagnosis

Trace the rejected SIP message through loaded identifier modules, global order, endpoint permissions and exact IP, username, header or request-URI evidence before changing authentication or routing.

Read guide →