Whitelisting your VICIdial server IP with a carrier

To whitelist your VICIdial server with a carrier, give them your server's static public IP, then build the carrier entry with the host set to the carrier's IP and no register line. Once the carrier trusts your address, calls flow without any per-call login.

What IP authentication does

IP authentication means the Carrier trusts any call arriving from a known IP address instead of checking a username and secret on every call. You tell the carrier the public IP of your VICIdial server, they add it to their allowed list, and the trust runs in both directions: your server accepts inbound calls from the carrier's IP, and the carrier accepts outbound calls from yours.

Because there's no Registration string involved, there's nothing to re-register and no credentials to expire. This is why static-IP servers favor it.

The catch is that the trust is tied entirely to the address. If your server's IP ever changes, every IP-auth trunk breaks at once until the carrier re-whitelists the new address. That almost never happens on a fixed-IP box, but it's the reason carriers offer registration as the alternative for servers that move around.

Setting it up

1. Find your server's static public IP and send it to your carrier. Ask them to whitelist it for both inbound and outbound.
2. In VICIdial, go to Admin then Carriers and add the carrier. In the account entry, set host to the carrier's IP (not dynamic) and leave the registration string blank.
3. Pin your Codec in the same block — disallow all, then allow ulaw — and set the type so calls run both ways. Set context to trunkinbound so inbound calls land in DID handling.
4. Set Active to Y, save, and wait about a minute for the conf files to regenerate.

The handshake (no REGISTER)

With IP auth there's no login step. The carrier simply recognizes your server's address when a call arrives:

sequenceDiagram
  participant V as VICIdial server
  participant C as Carrier
  Note over V,C: No REGISTER sent
  V->>C: INVITE from whitelisted IP
  C->>C: Match source IP to allow list
  C-->>V: 200 OK
  V->>C: ACK
  Note over V,C: Call connected
  C->>V: INVITE inbound from carrier IP
  V->>V: Match carrier IP, route DID

Verifying the peer

After the conf files regenerate, check the peer on the Asterisk CLI. With SIP that's sip show peers; with PJSIP it's pjsip show endpoints. A reachable SIP peer means the trunk is up. Then place one test call from the Campaign Detail screen, confirm two-way audio, and check that your caller ID arrives. Only point production campaigns at the trunk once that test connects cleanly.

If the peer never goes reachable, the usual culprits are a typo in the carrier IP, a firewall blocking SIP, or the carrier not having finished whitelisting your address — give them a moment and re-check. It's worth confirming both directions: place an outbound test call and have someone dial one of your DIDs inbound, because a carrier can whitelist your IP for one direction and miss the other.

Where this fits

IP-auth is one half of the carrier authentication picture. For the full setup, see the VICIdial carrier integration guide, and to know exactly which IP to hand over, see your VICIdial carrier server IP.

Every VICIfast server ships with a fixed public IP, so handing it to a carrier for whitelisting is a one-time job — and the box is online in under 40 seconds. See pricing to get started.