Flexisip SIP Proxy on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of Flexisip on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Flexisip is Belledonne Communications' open source SIP proxy, registrar and presence server (the server behind Linphone). It routes SIP signalling, registers user agents, authenticates accounts and can act as a push notification gateway, providing the core of a self hosted VoIP and instant messaging platform. It is a headless daemon configured through /etc/flexisip/flexisip.conf and controlled with the flexisip_cli.py command line client.

The image installs the official bc-flexisip package from the Belledonne Communications apt repository (download.linphone.org), so it is dpkg managed and receives upstream security patches, and runs under systemd as the unprivileged flexisip user.

Security by design, digest authentication required. A SIP registrar that accepts unauthenticated registrations or relays calls for anyone is an abuse and toll fraud magnet. This image enables Flexisip's [module::Authentication] with a file backed user database, so every REGISTER and INVITE for the served domain requires SIP digest authentication. There is no anonymous registration and no open relay.

Security by design, no default SIP account. The image ships no fixed or known SIP credential. The single demo account, user 1000, has its SIP secret set to a per instance value generated on the first boot of every VM (openssl rand -hex 18), written to /root/flexisip-credentials.txt (mode 0600, root only). The captured image ships only a placeholder, and the proxy is held disabled until first boot has written the real secret and the resolved SIP domain, so the service never runs with a placeholder.

Security by design, no toll fraud route. There is no PSTN gateway and no outbound trunk configured, so a compromised or unauthenticated endpoint cannot dial out. The [module::MediaRelay] is disabled and presence, conference and back to back user agent servers are not enabled, so the appliance is a lean proxy and registrar that opens only SIP port 5060. The registrar datastore is a local Redis bound to loopback (127.0.0.1) with no public port.

What is included:

• The official bc-flexisip package (installed from the Belledonne apt repository, dpkg managed and security patchable), run under systemd as the unprivileged flexisip user (flexisip-proxy.service)

• A minimal hardened /etc/flexisip/flexisip.conf: [module::Authentication] required (file backed user db), [module::Registrar] with a loopback Redis backend, [module::MediaRelay] disabled, and no outbound gateway

• A per instance SIP secret for demo user 1000, generated on first boot and documented in /root/flexisip-credentials.txt (0600), so no image ever ships a usable or default credential

• A local Redis registrar backend bound to 127.0.0.1 only (no public port), so the appliance is fully standalone with no external service dependency

• The SIP domain (aliases, reg-domains, auth-domains) set from the VM public IP on first boot so remote softphones register against the right address

• A bundled SIP self test client (sipexer) so you can prove a REGISTER round trip from the VM itself

• A tiny nginx on port :80 serving only an unauthenticated /healthz endpoint (HTTP 200) for Azure Load Balancer health probes, which is not a management interface

• Ubuntu 24.04 LTS base with latest security patches applied at build time, and unattended security upgrades kept enabled

• Azure Linux Agent for seamless cloud integration and SSH key injection

• 24/7 cloudimg support with a guaranteed 24 hour response SLA

Prerequisites

• Active Azure subscription, SSH public key, VNet and subnet in the target region

• Subscription to the Flexisip listing on Azure Marketplace

• Network Security Group rules allowing TCP 22 (admin), and UDP and TCP 5060 (SIP signalling). Add TCP 80 if you use the health probe

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) is a comfortable fit for a small proxy and registrar. Flexisip is a lean C++ daemon; on this image the proxy uses roughly 40 MB of RAM at rest. Scale up for very high registration or call setup volumes.

Step 1: Deploy from the Azure Portal

Search Flexisip in Marketplace, select the cloudimg publisher, and click Create. Configure the Network Security Group to allow TCP 22 for administration and UDP and TCP 5060 for SIP signalling. Assign a public IP so remote softphones can register.

Step 2: Deploy from the Azure CLI

RG="voip-prod"; LOCATION="eastus"; VM_NAME="flexisip1"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/flexisip/versions/<version>"

az group create --name "$RG" --location "$LOCATION"

az vm create --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" --size Standard_B2s \
  --admin-username azureuser --generate-ssh-keys --public-ip-sku Standard

# SIP signalling (UDP + TCP 5060) and the optional health probe (TCP 80)
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 5060 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1002

Step 3: First boot

On the first boot of every VM the flexisip-firstboot.service runs once. It resolves the VM public IP from Azure IMDS and writes it as the SIP domain (aliases, reg-domains, auth-domains), generates the per instance SIP secret for demo user 1000, asserts that no outbound gateway route is present, creates a bootstrap ready marker and then starts Flexisip and nginx. Allow about 30 seconds after the VM is first reachable.

Step 4: Confirm the services are running

SSH in and confirm the proxy, its Redis backend and nginx are active, and that Flexisip is running as the unprivileged flexisip user.

sudo systemctl is-active flexisip-proxy redis-server nginx
sudo /opt/belledonne-communications/bin/flexisip --version
curl -s -o /dev/null -w "healthz: %{http_code}\n" http://127.0.0.1/healthz

Step 5: Inspect the SIP configuration

Flexisip listens for SIP on UDP and TCP port 5060. The hardened configuration requires authentication and uses a loopback Redis registrar backend.

# the proxy listens on UDP + TCP 5060
sudo ss -lun 'sport = :5060'; sudo ss -ltn 'sport = :5060'

# authentication is required, the registrar uses a loopback Redis backend, no gateway
sudo grep -E '^\[module|^enabled|^auth-domains|^reg-domains|^db-implementation|^redis-server' /etc/flexisip/flexisip.conf

Step 6: Register the demo account and prove authentication

Read the per instance SIP secret (unique to this VM) from the root only credentials file, then register with the bundled sipexer client. A desktop or mobile softphone (for example Linphone, Zoiper or MicroSIP) registers the same way from your network.

sudo cat /root/flexisip-credentials.txt

# self test from the VM itself: read this VM's SIP domain, bind address and per instance
# secret from the root only credentials file, then register demo user 1000
DOMAIN=$(sudo grep '^sip.domain=' /root/flexisip-credentials.txt | cut -d= -f2-)
BIND=$(sudo grep '^sip.bind=' /root/flexisip-credentials.txt | cut -d= -f2-)
SECRET=$(sudo grep '^sip.demo.secret=' /root/flexisip-credentials.txt | cut -d= -f2-)
OUT=$(sudo /usr/local/bin/sipexer -register -fuser 1000 -fdomain "$DOMAIN" \
  -au 1000 -ap "$SECRET" -ex 300 -vl 1 udp:$BIND:5060 2>&1 || true)
echo "$OUT" | grep -aE 'SIP/2.0 200' && echo "OK: demo user 1000 registered (200 OK)"

To register a softphone from your own device, point it at the VM public IP on port 5060, username 1000, domain the VM public IP (the sip.host value in the credentials file), and the secret from the file above. A wrong secret is rejected with 401, and an unauthenticated registration is refused, because digest authentication is required and there is no open relay.

Step 7: The hardened, no open relay configuration

The shipped configuration is deliberately minimal. Every registration requires the per instance secret, the registrar datastore is a loopback bound Redis, media relay is disabled, and there is no outbound gateway, so the appliance cannot be abused for toll fraud out of the box.

# the registrar backend is a LOCAL Redis bound to loopback only, no public port
sudo systemctl is-active redis-server
sudo ss -ltn 'sport = :6379'

# no outbound gateway / trunk route in the active configuration
sudo grep -vE '^[[:space:]]*(#|;)' /etc/flexisip/flexisip.conf | grep -iE 'fallback-route|outbound-proxy|static-targets' || echo "no outbound route configured"

# the demo user database (secret redacted)
sudo sed -E 's/clrtxt:[^ ]+/clrtxt:************/' /etc/flexisip/users.db.txt

Step 8: Add your own users and SIP domain

To run a real registrar, set your own SIP domain and add your own accounts. Edit the domain lines in /etc/flexisip/flexisip.conf and add users to /etc/flexisip/users.db.txt, then restart the proxy.

# add a user (clear text password shown; md5:HA1 form is also supported)
echo 'alice@<your-domain> clrtxt:<a-strong-password> ;' | sudo tee -a /etc/flexisip/users.db.txt
sudo systemctl restart flexisip-proxy

Use a real DNS SIP domain (with the appropriate SRV and A records) rather than a bare IP for production, and give every account a strong, unique secret.

Step 9: TLS, media relay and push for production

The default image is a lean signalling proxy on UDP and TCP 5060. For production consider:

• SIP over TLS on port 5061. Add a sips: transport in [global] transports with a certificate for your SIP domain so signalling is encrypted, and open TCP 5061 in your NSG.

• Media relay. Enable [module::MediaRelay] and open an RTP port range if you need the proxy to relay media through NAT. Keep the range as small as your concurrent call volume requires.

• Registration persistence and scale. The registrar already uses a local Redis; point redis-server-domain at an external or clustered Redis to share registrations across multiple Flexisip nodes for high availability.

• Push notifications. Configure [module::PushNotification] with your APNS and FCM credentials so mobile clients receive incoming calls while backgrounded.

Step 10: Support and Licensing

Flexisip is licensed under the GNU Affero General Public License v3 (AGPL 3.0). This image installs the official bc-flexisip package unmodified from the Belledonne Communications repository, plus a minimal hardened configuration and the open source sipexer self test client (MIT). cloudimg provides the packaging, hardening and Azure integration, with 24/7 support and a guaranteed 24 hour response SLA.

Trademark notice. Flexisip and Linphone are marks of Belledonne Communications. cloudimg is not affiliated with or endorsed by Belledonne Communications. This image packages the open source Flexisip software for convenient deployment on Azure.

Deploy on Azure

Find Flexisip SIP Proxy on Ubuntu 24.04 LTS by cloudimg on the Azure Marketplace and click Create, or deploy from the Azure CLI as shown above.

Need Help?

Contact cloudimg support at support@cloudimg.co.uk for deployment assistance, configuration guidance, or licensing questions.