Documentation

Connect OpenSIPS to Open Voice Shield

In your OpenSIPS routing script, set $du to sip:sip.ovs.telecomsxchange.com:5060 for the initial INVITEs you want analyzed and t_relay() them; whitelist the server's public IP on the Network page first. Each call is relayed to your destination and the verdict appears after hang-up.

Before you start#

• An Open Voice Shield account. Signup is self-serve and starts you with US$5 of credit.
• The public IP address your OpenSIPS sends SIP from, the address after NAT, not the one on its interface.
• A destination, the carrier or SBC the calls were already going to. We relay each accepted call on to it.
• Firewall: UDP or TCP 5060 to the ingress, and UDP 30000–40000 open in both directions for the RTP your media endpoints exchange with our relay. See the firewall rules.

Step 1: whitelist your server's IP#

Open the Network page in the portal and add the public address your OpenSIPS sends from as a CIDR entry (a single host is a /32). The whitelist is the authentication: there are no credentials, and an INVITE from any other address is answered 403.

Step 2: relay every initial INVITE to the ingress#

Your OpenSIPS stays the routing brain, and Open Voice Shield is one more hop it relays through. Setting $du (the destination URI) sends the request to the ingress without touching the Request-URI, so the dialled number and caller ID arrive unchanged. Act on initial INVITEs only. In-dialog requests follow the record-route set.

if (is_method("INVITE") && !has_totag()) {
    $du = "sip:sip.ovs.telecomsxchange.com:5060;transport=udp";
    t_relay();
    exit;
}

Verified against the OpenSIPS 3.x core documentation ($du) and tm module documentation. Fold the branch into your own route rather than pasting it wholesale, and keep your existing record-routing in place.

• The INVITE must carry SDP, an early offer. An INVITE without SDP is answered 488.
• Offer G.711 (PCMU or PCMA) first; G.722, G.729 and G.723.1 are decoded as well. Any other codec is relayed but produces no transcript and no verdict.
• Send no REGISTER at the ingress: it is answered 403. Calls are authorized by source IP alone.

Or relay a deterministic sample#

You do not have to move all your traffic: sampling is a supported pattern. This example is deterministic rather than random because it uses only documented core string transformations, so it works on any OpenSIPS 3.x with no extra module. The first hex digit of the Call-ID's MD5 is uniformly distributed, so comparing it to "0" selects about one call in sixteen.

if (is_method("INVITE") && !has_totag()) {
    # first hex digit of MD5(Call-ID): "0" is ~1 call in 16
    if ($(ci{s.md5}{s.substr,0,1}) == "0") {
        $du = "sip:sip.ovs.telecomsxchange.com:5060;transport=udp";
    }
    t_relay();
    exit;
}

Verified against the OpenSIPS 3.x transformations documentation ({s.md5}, {s.substr}). Adapt it to your version. Accept more leading digits to widen the share: a first digit of 0 or 1 is about one call in eight. If your version provides a probabilistic branching function you already trust, it drops into the same place. What matters is which initial INVITEs get $du set.

Step 3: place a test call#

Send a real call through the new branch and keep both parties talking for at least 30 seconds. A leg that never speaks produces a one-sided transcript. After hang-up the call appears in Calls in the console with its recording, per-channel transcript and verdict, usually within a minute.

• Rejected 403? The source address is not whitelisted. Compare your own SIP trace with the CIDR entries on the Network page.
• One-way audio? A firewall rule on UDP 30000–40000 between your media endpoints and the ingress, not a signalling problem.
• A 483? The relayed request looped back to the ingress. Check that your record-routing is intact and the branch fires once.

Anything else: Troubleshooting lists every rejection code and the check that clears it.

Frequently asked questions#

Ready to try it? Create an account. Signup is self-serve and comes with US$5 of credit, enough to analyze your first test calls.