Documentation

Connect Kamailio to Open Voice Shield

Updated 30 Sept 2026 4 min read

Ask AI about this page

In your Kamailio routing script, set $du to sip:sip.ovs.telecomsxchange.com:5060 for the initial INVITEs you want analyzed and t_relay() them; whitelist the server's public IP on the Network page first. Each call is relayed to your destination and the verdict appears after hang-up.

Before you start#

An Open Voice Shield account. Signup is self-serve and starts you with US$5 of credit.
The public IP address your Kamailio sends SIP from, the address after NAT, not the one on its interface.
A destination, the carrier or SBC the calls were already going to. We relay each accepted call on to it.
Firewall: UDP or TCP 5060 to the ingress, and UDP 30000–40000 open in both directions for the RTP your media endpoints exchange with our relay. See the firewall rules.

Step 1: whitelist your server's IP#

Open the Network page in the portal and add the public address your Kamailio sends from as a CIDR entry, a single host is a /32. The whitelist is the authentication: there are no credentials, and an INVITE from any other address is answered 403.

Step 2: relay every initial INVITE to the ingress#

Your Kamailio stays the routing brain. Open Voice Shield is one more hop it relays through. Setting $du (the destination URI) sends the request to the ingress without touching the Request-URI, so the dialled number and caller ID arrive unchanged. Act on initial INVITEs only. In-dialog requests follow the record-route set.

kamailio.cfg: add to your Kamailio's request_route, after the usual sanity checks

if (is_method("INVITE") && !has_totag()) {
    $du = "sip:sip.ovs.telecomsxchange.com:5060;transport=udp";
    route(RELAY);    # the default config's t_relay() wrapper
    exit;
}

Verified against the Kamailio 5.x core cookbook ($du) and tm module documentation. Fold the branch into the request_route your Kamailio already runs rather than pasting it wholesale, and keep your existing record-routing in place.

The INVITE must carry SDP, an early offer. An INVITE without SDP is answered 488.
Offer G.711 (PCMU or PCMA) first. G.722, G.729 and G.723.1 are decoded as well. Any other codec is relayed but produces no transcript and no verdict.
Do not send REGISTER to the ingress: it is answered 403. Calls are authorized by source IP alone.

Or relay a random share#

You do not have to move all your traffic. Sampling is a supported pattern. cfgutils gives your routing script a probability primitive: rand_event() fires with the configured probability, so only that share of initial INVITEs takes the extra hop.

kamailio.cfg: a 1-in-10 sample in your Kamailio's request_route

loadmodule "cfgutils.so"
modparam("cfgutils", "initial_probability", 10)   # percent

# in request_route, initial INVITEs only
if (is_method("INVITE") && !has_totag()) {
    if (rand_event()) {
        $du = "sip:sip.ovs.telecomsxchange.com:5060;transport=udp";
    }
    route(RELAY);
    exit;
}

Verified against the Kamailio 5.x cfgutils module documentation (initial_probability, rand_event, rand_set_prob); adapt to the version your Kamailio runs. rand_set_prob() changes the share from script logic without a restart.

Step 3: place a test call#

Send a real call through the new branch and keep both parties talking for at least 30 seconds. A leg that never speaks produces a one-sided transcript. After hang-up the call appears in Calls in the console with its recording, per-channel transcript and verdict, usually within a minute.

Rejected 403? The source address is not whitelisted. Compare your own SIP trace with the CIDR entries on the Network page.
One-way audio? A firewall rule on UDP 30000–40000 between your media endpoints and the ingress, not a signalling problem.
A 483? The relayed request looped back to the ingress. Check that your record-routing is intact and the branch fires once.

Anything else: Troubleshooting lists every rejection code and the check that clears it.

Frequently asked questions#

Does Kamailio need a special module to work with Open Voice Shield?

No. Setting $du is core Kamailio, and the relay is the tm module's t_relay(). cfgutils is only needed if you want random sampling.

Does Open Voice Shield register to my Kamailio?

No. Nothing registers in either direction. Your Kamailio relays initial INVITEs to the ingress, a REGISTER sent there is answered 403, and calls are authorized by the source IP you whitelist on the Network page.

Can I send only a share of my traffic through it?

Yes. cfgutils rand_event() with initial_probability set to 10 routes about one initial INVITE in ten through the ingress and the rest down your normal path, the dialplan equivalent of a 1-in-10 sample.

Ready to try it? Create an account. Signup is self-serve and comes with US$5 of credit, enough to analyze your first test calls.