Kamailio SIP Server: Proxy, Load Balancer, and Session Border Controller

Articles · 2026 · Ioannis (John) Konstas

Architecture, core modules, dispatcher load balancing, fraud protection, TLS, and RTPEngine integration for Kamailio in a production VoIP platform.

What Is Kamailio

A high-performance open source SIP proxy, registrar, load balancer, and Session Border Controller.

Kamailio is an open source SIP server that processes millions of SIP messages per second on modest hardware. In a carrier-grade VoIP platform it sits in front of all Asterisk PBX nodes and performs signaling-plane functions — it does not process media (audio), which is handled by RTPEngine.

Core Functions

• Load balancing — distributes SIP calls across Asterisk nodes via the dispatcher module
• SIP proxy — routes all SIP signaling between carriers and PBX nodes
• SBC (Session Border Controller) — NAT traversal, topology hiding, TLS termination
• STIR/SHAKEN — digitally signs outbound calls for caller ID authentication
• Fraud protection — rate limiting via the pike module, IP blocklisting
• Failover — automatically removes failed Asterisk nodes from rotation

Architecture Position

Internet / SIP Trunk Provider
         │
         ▼
   ┌─────────────┐
   │  KAMAILIO   │  ← All SIP signaling enters and exits here
   │  SBC/Proxy  │    TLS termination, NAT traversal, fraud filtering
   └──────┬──────┘
          │ dispatcher module — round-robin, failover
    ┌─────┼──────┬──────┐
    ▼     ▼      ▼      ▼
  Ast-1  Ast-2  Ast-3  ... N
  (Asterisk PBX nodes — stateless from Kamailio's perspective)

Each Asterisk node is stateless — Kamailio can route any call to any node. If a node fails, Kamailio's health-check removes it from rotation within seconds.

Core Modules

Load Balancing: dispatcher Module

Kamailio distributes calls across Asterisk nodes and removes failed nodes automatically.

# dispatcher.list — format: id  flags  priority  uri
1  0  0  sip:10.10.1.10:5060   # Asterisk Node 1
1  0  0  sip:10.10.1.11:5060   # Asterisk Node 2
1  0  0  sip:10.10.1.12:5060   # Asterisk Node 3

# kamailio.cfg — dispatcher routing logic
route[DISPATCH] {
    if (!ds_select_dst(1, 4)) {   # Group 1, round-robin (algorithm 4)
        send_reply("503", "Service Unavailable");
        exit;
    }
    t_relay();
}

Kamailio pings each Asterisk node with SIP OPTIONS every 10 seconds. If a node fails to respond, it is automatically removed from rotation until it recovers — zero manual intervention required.

Algorithm 4 is round-robin. Alternatives: 0 (hash over Call-ID), 6 (random), 10 (load distribution based on active calls). Choose based on your traffic pattern.

Fraud Protection: pike Module

Rate limiting blocks IPs that generate abnormal SIP request volumes — the first line of defence against toll fraud.

# Block IPs sending more than 20 SIP requests per 2-second window
modparam("pike", "sampling_time_unit", 2)
modparam("pike", "reqs_density_per_unit", 40)
modparam("pike", "remove_latency", 4)

route[ANTIFLOOD] {
    if (!pike_check_req()) {
        xlog("L_ALERT","ANTI-FLOOD blocked $rm from $si
");
        drop;
    }
}

The htable module can extend this with stateful counters — tracking failed authentication attempts per IP and auto-blocking after a threshold. Kamailio can also write blocked IPs to a database table shared with fail2ban or iptables for system-level blocking.

TLS Configuration

SIP/TLS encrypts the signaling channel — required for carrier interconnection and compliance.

# /etc/kamailio/tls.cfg
[server:default]
method = TLSv1.2+
verify_certificate = no
require_certificate = no
private_key = /etc/kamailio/tls/server.key
certificate = /etc/kamailio/tls/server.pem

[client:default]
method = TLSv1.2+
verify_certificate = no

Set verify_certificate = yes for production interconnects with known carriers. Use no only during lab testing.

RTPEngine Integration

Kamailio controls RTPEngine to proxy all media streams through the platform.

modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:2223")

route[RTPENGINE] {
    if (is_method("INVITE")) {
        rtpengine_offer("replace-origin replace-session-connection");
    }
    if (is_method("BYE")) {
        rtpengine_delete();
    }
}

Kamailio rewrites the SDP (Session Description Protocol) in SIP INVITE messages to replace the endpoint's real IP/port with RTPEngine ports. The caller and called party both send audio to RTPEngine, which relays it bidirectionally — enabling call recording, transcoding, and NAT traversal.

NAT Traversal

Most SIP devices are behind NAT. Kamailio detects and handles this transparently.

route[NATDETECT] {
    force_rport();
    if (nat_uac_test("19")) {
        if (is_method("REGISTER")) {
            fix_nated_register();
        } else {
            fix_nated_contact();
        }
        setflag(FLT_NATS);
    }
}

The nat_uac_test("19") bitmask checks for: private IP in Contact header, private IP in Via header, and source IP different from Contact IP — the three classic NAT indicators.

Capacity Reference

A single Kamailio node far exceeds the signaling requirements of a launch-phase carrier. A second node for high availability can be added later using the usrloc replication feature to share registration state.

← All articles

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.