Carrier-Grade SIP Infrastructure: 10-VM Open Source Telecom Stack Architecture

Articles · 2026 · Ioannis (John) Konstas

Architecture, network segmentation, jumbo frames, and call flow for a production VoIP carrier stack built entirely on open source software.

Overview

A production-grade carrier telecom infrastructure built from the ground up on a local virtualization platform.

This article documents the design and implementation of a 10-virtual-machine carrier telecom stack using only open source software. The platform is capable of handling carrier-grade voice traffic, billing, and monitoring — with zero proprietary licensing costs on the core stack.

Platform-agnostic design: everything here maps to any hypervisor or cloud provider. The IPs, hostnames, and sizing are illustrative.

VM Roles and Network Assignments

Ten Ubuntu 22.04 LTS VMs across five functional roles — each with 8 GB RAM, 4 vCPU, 30 GB thin-provisioned disk.

Network Segmentation: Five Isolated Virtual Networks

Five virtual networks serve distinct traffic types — three of them have no physical NIC attachment at all.

Why No Physical Uplink on Internal Networks?

Voice, Data, and Sync have no physical NIC attached. This is a hypervisor-level air gap — not a firewall rule, not an ACL. There is literally no wire connecting these networks to the outside world. MariaDB nodes are physically unreachable from the internet regardless of firewall configuration.

This is the correct approach for database servers in any multi-tier VoIP architecture. A firewall can be misconfigured. An air gap cannot.

Why MTU 9000 (Jumbo Frames) on Internal Networks?

Standard MTU 1500 was designed for shared Ethernet in the 1980s. On an internal virtual switch with no physical limitations, jumbo frames deliver:

• 6× more payload per packet
• Fewer interrupts and context switches per MB transferred
• Measurable improvement on MariaDB replication streams, CDR writes, and SIP/RTP inter-service flows

No routing or firewall changes needed — jumbo frames apply only within the isolated virtual switch.

Call Flow Architecture

Every call traverses the stack in a defined, auditable sequence.

Internet / SIP Carrier
        │
        ▼
┌──────────────────────────────────────┐
│  Kamailio-01 │ Kamailio-02           │
│  SIP Proxy + Load Balancer + SBC     │  ← All SIP enters and exits here
│  STIR/SHAKEN + Fraud Protection      │
└──────────────┬───────────────────────┘
               │ Voice network (MTU 9000, isolated, no uplink)
        ┌──────┴───────────────────────────────────┐
        │  Asterisk-01 · Asterisk-02 · Asterisk-03  │
        │  PBX + Dialplan + AGI + CDR               │
        └──────────────────┬───────────────────────┘
                           │ Data network (MTU 9000, isolated)
        ┌──────────────────┴───────────────────────┐
        │  A2Billing-01 │ A2Billing-02              │
        │  Real-time billing, rate decks, IVR       │
        └──────────────────┬───────────────────────┘
                           │
        ┌──────────────────┴───────────────────────┐
        │  MariaDB-01 │ MariaDB-02                  │
        │  CDRs, accounts, rates, DIDs (Sync net)   │
        └───────────────────────────────────────────┘

Least-Cost Routing

Kamailio's carrierroute module selects the cheapest SIP trunk per destination prefix before dispatching to Asterisk. Multiple trunk providers can be configured with per-prefix rate comparisons updated in real time.

Technology Stack

Total software licensing cost for this stack: $0. All components are open source and production-proven at carrier scale.

← All articles

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.