Plus
$2/mo
- 1 dedicated IP address
- 10 devices
- 5 open ports
- 100 GBbandwidth
- 20 Mbpsspeed
IP-authenticated SIP trunks need a fixed public address, and CGNAT breaks incoming calls and audio. GetAStatic gives your PBX its own public IPv4 over WireGuard.
Updated
Many SIP trunk providers authenticate by IP address: they only accept calls from, and send calls to, the address you register with them. On a home or small-office line that address changes, or it is shared with other customers through CGNAT.
The result is familiar: the trunk rejects your calls, incoming calls never ring, or a call connects but one side hears nothing. One-way audio usually means the PBX tells the far end to send audio to an address it cannot reach.
Plus for light use, Pro for most people, Ultra for full gigabit.
5× speed · 10× bandwidth · 2 IPs — only $2/mo more
Install WireGuard on the PBX host, or on the router in front of it. The host dials out to our node in Kansas City, Missouri or San Jose, California and gets a public IPv4 that is yours alone. Calls and audio sent to that IP come down the tunnel to the PBX.
You may not need it. A trunk that registers with a username and password usually works behind CGNAT without a fixed IP. The fixed IP matters for IP-authenticated trunks, for reliable delivery of calls to your numbers, and for NAT behaviour that does not change under you.
SIP signalling uses one or two ports. Audio (RTP) uses a range, about two ports per call at once. Shrink the range in the PBX to fit your call volume:
| Port | Protocol | Used for |
|---|---|---|
| 5060 | UDP | SIP signalling (most trunks) |
| 5061 | TCP | SIP over TLS, if your provider supports it |
| 10000-10499 | UDP | RTP audio (example range) |
Defaults differ: FreePBX uses RTP 10000-20000, 3CX uses 9000-10999, and FusionPBX uses 16384-32768 with trunks on port 5080. Open what your PBX actually uses.
Your SIP port (5060 UDP, or 5061 TCP for TLS) and your PBX's RTP range. The table above shows a typical set.
Pro, for almost any PBX. Plus has 5 open ports and a range counts as its size, so after the SIP port there is room for about two calls' audio. Pro and Ultra have unlimited open ports.
It is an ordinary public IPv4 assigned only to you, so it works for IP authentication the same way an office line's static IP does.
Usually. One-way audio behind CGNAT comes from the PBX advertising an address the other side cannot reach. Setting the external address to your static IP and opening the RTP range is the standard cure.
Yes. Point the phones at your static IP. Bots scan for open SIP ports and try to guess passwords all day, so keep SIP closed if you do not need outside phones, and use long passwords and your PBX's firewall if you do.
Have more questions? See the full FAQ →