Set up a SIP trunk

In Nuteq, a SIP trunk connects your own phone system or carrier to your agents, so calls to numbers you already have are answered by an AI receptionist. Nuteq accepts a trunk call based on the public IPv4 address it comes from, over an encrypted connection, so there is no SIP username or password to manage.

Before you start

You need a few things in place before you create a trunk. First, you need the owner or admin role in your Nuteq business, because members can view trunks but can't change them or run a test call. Second, each number needs an active agent to answer it. Third, you need someone who can change the settings of your phone system, your carrier account, and your firewall.

SIP trunks also need to be switched on for your business. If a test call says that SIP trunks are not switched on, contact support.

Which settings does your phone system need?

Your phone system sends each call to Nuteq with the settings below. The Carrier settings card on the SIP trunks page shows the same values, and you can copy most of them from there.

Setting	Value	What it means
SIP server	sip.nuteqai.com:5061	Send calls here over TLS.
TLS server name (SNI)	sip.nuteqai.com	Your phone system names this server when it opens the encrypted connection.
Transport	TLS 1.2 or newer over TCP	Calls sent over plain UDP or TCP are not accepted.
Media encryption	SRTP with SDES keys, AES_CM_128_HMAC_SHA1_80	Calls without encrypted audio are refused.
Audio codecs	G.711 u-law (PCMU) or A-law (PCMA)	Offer at least one of the two.
Called number format	+E.164, for example +15550100100	Send the dialed number in the Request-URI or To header.
Audio ports	UDP 10000-10399	Allow audio to and from these ports on Nuteq.

How Nuteq reads the called number

Nuteq picks the agent from the number your phone system dials, so the number has to match a row under Phone numbers. Nuteq reads the number from the Request-URI first, and it reads the To header only when the Request-URI has no number. Send the number in +E.164 format, which is a plus sign, the country code, and the number with no spaces, e.g., +15550100100.

Nuteq never uses the From header to choose a number or an agent. The caller's own number has no effect on where the call goes.

How call audio travels

Nuteq sends and receives call audio directly with the media address that your phone system puts in its call offer, and there is no relay between them. The media address has to be a public IPv4 address, so an offer that asks for audio at a private address, e.g., 192.168.1.20, is refused. The media address can be different from the address that sends the call, e.g., when your carrier uses a separate media gateway.

Nuteq sends audio to the exact address and port in the call offer, and it doesn't switch to the address or port your audio arrives from. So when your phone system is behind a router that translates addresses (NAT), the router has to keep each audio port the same on the public side. For example, give your phone system a small fixed range of audio ports and forward each of those ports to it unchanged.

Your firewall has to let UDP audio travel in both directions between your media address and Nuteq ports 10000 to 10399. If a test call is answered but no audio reaches Nuteq, the firewall is the first thing to check.

How requests during a call travel

After Nuteq answers, your phone system and Nuteq send each other requests during the call, e.g., to put the call on hold or to hang up. Your phone system sends its requests to the address in Nuteq's Record-Route header. Nuteq accepts them whether your phone system keeps the name sip.nuteqai.com or replaces it with Nuteq's IP address, so in Asterisk the rewrite_contact setting can be on or off.

Nuteq sends its own requests, e.g., when your agent hangs up, over the encrypted connection your phone system opened, whether the address in your phone system's Contact header is private or public. So your phone system doesn't have to accept incoming connections from Nuteq, and in Asterisk external_signaling_address can be set or unset. Keep that connection open for the whole call. If it has closed, Nuteq opens a new connection to the Contact address, which works only when your phone system accepts encrypted connections there.

Which source IP addresses can you add?

Source IP ranges are the public IPv4 addresses your carrier or phone system sends calls from, and Nuteq refuses calls from anywhere else. Each range follows these rules:

• A range is a single address, e.g., 203.0.113.10, or a network no wider than /24, e.g., 203.0.113.0/24.
• A network is written with its first address, so 203.0.113.0/24 is accepted and 203.0.113.7/24 is not.
• Private and reserved addresses can't be added, and neither can IPv6 addresses.
• Ranges on one trunk can't overlap each other, and only one active trunk in Nuteq can use an address.

Phone numbers follow a similar rule, because only one active trunk in Nuteq can answer a number. If the page says that another active SIP trunk already uses a range or a number, turn that trunk off or contact support. One trunk holds up to 20 ranges and 100 phone numbers, and a business can have up to 50 trunks.

Set up the trunk

1. Collect the public IPv4 addresses your phone system or carrier sends calls from, and the numbers you want your agents to answer.
2. Open the SIP trunks page in your dashboard, at the address that ends in /dashboard/settings/sip-trunks. The page doesn't have a tab in Settings. Click New trunk and enter a Trunk name, e.g., "Head office phone system".
3. Under Source IP ranges, enter each address or network, and click Add range for more rows. Under Phone numbers, enter each number with its country code, choose the agent that answers it, and click Add phone number for more rows. Click Save draft. A draft trunk doesn't accept any calls.
4. Give the values in the Carrier settings card to whoever manages your phone system or carrier account, and open the audio ports in your firewall.
5. Click Activate. The button is available once the draft is saved with at least one range and one number and has no unsaved changes, and activating starts answering calls from these IP ranges right away.
6. In the Test call card, choose a number under Number to call and click Start test call. When the card says "Call +15550100100 now from your phone system.", with your number in place of the example, call that number through the trunk within 15 minutes.
7. Stay on the line until your agent speaks, then hang up. The card shows "Ready. Calls to this trunk reach your agent." once Nuteq has checked the call.

If the test call is refused or doesn't finish, the card tells you what went wrong and what to change. Read SIP trunk test call results explains every message.

What does Ready mean?

Ready means a test call to one of the trunk's numbers went all the way through. For example, the call came from an allowed address, matched an agent, and was answered, and then audio travelled in both directions, your agent spoke, and Nuteq saved the call. A trunk that is on but hasn't passed a test call shows Active instead of Ready.

An active trunk answers calls whether or not it shows Ready, so run a test call before real callers use the trunk. Ready goes away when you change the trunk's ranges or numbers, deactivate it, or activate it again, and a new test call brings it back. Renaming the trunk keeps Ready. A test call checks one number, so test the other numbers too when they use different agents or come through a different carrier.

Which greeting and voice does a trunk call use?

A trunk call uses the agent's call settings, e.g., the greeting, voice, and language. If the agent also answers a Nuteq phone number, a trunk call uses the same settings as that number. Otherwise it uses the settings you choose in the agent editor.

Change, deactivate, or delete a trunk

You can change an active trunk and click Save changes. The change applies to the next call, and a call already in progress keeps going. Saving also ends any open test call, and a change to the ranges or numbers removes Ready until a new test call passes.

Deactivate stops Nuteq from answering new calls from the trunk right away, and the trunk needs a new test call after you activate it again. Delete also stops calls right away and removes the trunk's settings, and it can't be undone. Both ask you to confirm first.

A trunk set up earlier with a SIP username and password shows Unsupported legacy. You can only delete it, and then add an IP-authenticated trunk in its place.

What don't SIP trunks support?

A SIP trunk carries calls in one direction, from your phone system to your agents, with the settings above. The following are not supported:

• Registering with a SIP username and password. Nuteq refuses registration requests, so your phone system has to send calls without registering.
• Plain SIP over UDP or TCP on port 5060, and unencrypted audio (plain RTP). Only TLS on port 5061 with SDES-SRTP is accepted.
• Audio codecs other than PCMU and PCMA, e.g., Opus, and IPv6 addresses for calls, audio, or source ranges.
• Outgoing calls from Nuteq through your trunk, and transfers of a trunk call back into your phone system.

Which phone systems and carriers have been tested?

Each phone system or carrier has one of three statuses. Verified means Nuteq has completed a test call with it using the settings on this page. Known limitation means it can't work with a Nuteq SIP trunk as described in the notes. Untested means Nuteq hasn't tested it, so it may work if it meets every setting above, but Nuteq has not confirmed it.

Only Asterisk 22.10.1 is verified, and only with the settings in its notes. Other versions of Asterisk and the other phone systems and carriers below are untested, apart from the rows marked as a known limitation.

Phone system or carrier	Status	Notes
Asterisk 22.10.1 (PJSIP)	verified	TLS transport with method tlsv1_2, verify_server on, and the system certificate list. Endpoint with media_encryption sdes, allow ulaw and alaw, rtp_symmetric, force_rport, and direct_media off. Behind NAT, external_media_address set to the public address and a fixed audio port range forwarded unchanged. Tested with rewrite_contact and external_signaling_address both off and both on, with PCMU and PCMA, hold and resume, and hang up from either side.
Asterisk, other versions	untested
FreePBX	untested
FreeSWITCH	untested
3CX	untested
Cisco Unified Border Element (CUBE)	untested
Twilio Elastic SIP Trunking	untested
Telnyx SIP trunking	untested
Bandwidth	untested
Any system that can only register with a username and password	known limitation	Nuteq doesn't accept registration.
Any system that can only send plain SIP on port 5060 or unencrypted audio	known limitation	Nuteq accepts only TLS on port 5061 with SDES-SRTP.
Any carrier that sends calls from addresses shared with other businesses, or from ranges wider than /24	known limitation	Only one active trunk can use an address, and each range can be no wider than /24.

Get help with a trunk

Each call in the Test call card shows a Call-ID for support, which is the identifier your phone system gave the call. When you contact support, send the Call-ID, the trunk name, the number you called, the time of the call, and the message the card showed. Support can find the same call from the Call-ID.