Connect Your Phone System
Network requirements, firewall rules and configuration recipes for Asterisk, FreePBX, 3CX and other SIP platforms — in both directions.
Once a trunk exists, the remaining work is on your side: point your phone system at us, or let us reach it, and open the right ports. This page covers what to configure and where.
In the app: Dashboard → Automation → Calls → Trunks → (click a trunk)
Network requirements
Everything terminates on one host:
sip.pingmate.app| Leg | Direction | Protocol and port |
|---|---|---|
| WhatsApp → us | Inbound to us | TLS 5061 — handled entirely by us |
| Your phone system → us | Outbound calls you place | UDP 5060 |
| Us → your phone system | Inbound calls we deliver | The transport and port in your destination URI, usually UDP 5060 |
| Audio (RTP) | Both ways | UDP 20000–29999 |
Firewall rules
For an inbound trunk, your firewall must accept SIP signalling on the port in your destination URI, and RTP on your own media port range, from our signalling address.
For an outbound trunk, your firewall must allow outbound UDP to sip.pingmate.app:5060, and must allow the return audio on UDP 20000–29999. Stateful firewalls usually handle the return path automatically; strict ones need an explicit rule.
Ask us to open 5060 for your PBX
The tenant-facing SIP port is closed by default and opened per account, restricted to your PBX's public address. Until that is done, anything you point at it — a PBX or a softphone — gets no reply at all and reports a 408 Request Timeout. That is not a credential problem. Send support the public IP your phone system signals from before you start testing.
Allowlisting our address
If your firewall needs a specific IP rather than a hostname, resolve sip.pingmate.app and allow the result — or ask support for the current signalling address. Do not hard-code an address you found elsewhere; it can change, and a stale rule looks exactly like a broken trunk.
Audio and signalling are separate
Opening 5060 alone gets you calls that ring, connect, and then have no sound in one or both directions. The media range must be open too. This is the single most common setup fault.
Inbound — receive WhatsApp calls
We send the call to the SIP targets on your trunk. Your phone system has to accept it and route it somewhere useful.
Add your phone system as a destination
Edit the inbound trunk and set Deliver calls to with the public SIP address of your system, for example sip:pbx.example.com:5060. Add a second target for failover if you have one — see Destinations.
Accept our calls on your side
Create a trunk, peer or endpoint on your platform that accepts SIP from us. Match the trunk's Transport and Media settings, and make sure the codecs it offers overlap with the trunk's codec list.
Route the incoming number
The call arrives addressed to your WhatsApp business number. Point that number at a queue, ring group, IVR or extension — whatever should ring when a customer calls.
Open the firewall
Allow SIP and RTP inbound from our signalling address, as above.
Outbound — place WhatsApp calls
Your phone system dials the endpoint we issued for the trunk.
Copy the dial-out endpoint
Open the trunk's side panel and copy the URI under Dial-out endpoint. It looks like sip:office-3cx-a1b2c3@sip.pingmate.app.
Create a credential
If the trunk's authentication is Digest credential or IP + credential, add a credential and copy the username and password. See Credentials.
Configure a SIP trunk on your platform
Point it at sip.pingmate.app on UDP 5060, using that username, password and the realm sip.pingmate.app.
Dial in E.164
Dial the customer as +<country code><number> — for example +919876543210. Add a dial rule that strips your internal prefix and prepends + if your users dial short codes.
Check permission first
The customer must have granted your business permission to call them, or we refuse the call before it reaches WhatsApp. See Call permissions.
Platform recipes
The field names differ, the values do not.
Outbound trunk — a PJSIP trunk in pjsip.conf, or Connectivity → Trunks → Add SIP (chan_pjsip) Trunk in FreePBX:
| Field | Value |
|---|---|
| Trunk name | Anything, e.g. whatsapp-calls |
| SIP server / host | sip.pingmate.app |
| SIP server port | 5060 |
| Transport | udp — or match your trunk's Transport setting |
| Username / auth username | Your credential's username |
| Secret / password | Your credential's password |
| Realm / auth realm | sip.pingmate.app |
| Registration | None. We do not use SIP registration — authenticate per call |
| Codecs | ulaw, alaw, opus — in the order your trunk lists them |
| DTMF mode | rfc4733 (this is RFC 2833), unless the trunk says otherwise |
Add an outbound route that sends +. (or your own pattern) to this trunk, dialling PJSIP/+${EXTEN}@whatsapp-calls.
Inbound — set your trunk's destination to sip:your-asterisk.example.com:5060, then add an inbound route matching your WhatsApp number as the DID and point it at a queue or extension.
Do not enable registration
A trunk that tries to register will retry forever and log failures. There is nothing to register to — authentication happens on each call.
Outbound — SIP Trunks → Add SIP Trunk → Generic SIP Trunk:
| Field | Value |
|---|---|
| Name | e.g. WhatsApp Calls |
| SIP server hostname or IP | sip.pingmate.app |
| SIP server port | 5060 |
| Outbound proxy | Leave blank |
| Type of authentication | Do not require registration / Authentication by IP if your trunk is IP-only, otherwise account-based |
| Authentication ID / user | Your credential's username |
| Authentication password | Your credential's password |
| Number of simultaneous calls | Match the trunk's Max calls |
Add an outbound rule that routes calls beginning + to this trunk, stripping nothing and prepending nothing.
Inbound — set the trunk's destination to your 3CX public SIP address, then add an inbound rule for your WhatsApp number pointing at a queue, ring group or extension.
Any SIP platform works. Map these values onto whatever the vendor calls them:
| Concept | Value |
|---|---|
| Host / proxy / domain | sip.pingmate.app |
| Port | 5060 (UDP), unless your trunk uses TCP or TLS |
| Auth username | Your credential's username |
| Auth password | Your credential's password |
| Realm / auth domain | sip.pingmate.app |
| Registration | Not used — authentication is per call |
| Dialled number format | +<country code><number> |
| Codecs | Whatever your trunk lists, in that order |
| DTMF | RFC 2833 by default |
| Media | RTP by default; SRTP if the trunk says SRTP |
For inbound, the vendor needs to accept SIP from our signalling address and route the dialled WhatsApp number to an agent destination.
An outbound trunk is not a phone line
It is worth being blunt about this, because it shapes how you design your dial plan:
- You can only call WhatsApp users, not arbitrary phone numbers.
- The customer must have granted permission first, and that permission expires.
- Calls are capped at one hour.
- WhatsApp caps you at 100 connected calls per 24 hours for any one customer.
If your dial plan treats this trunk as a cheap PSTN route, most calls will be refused. Route only WhatsApp conversations to it.
What's next
Test a trunk
Work through the pre-flight checklist and place a real call in each direction.
Call permissions
Get permission to call a customer before your first outbound test.
Common setup mistakes
How is this guide?
Authentication
Secure a trunk with a digest credential, an IP allowlist, or both — how each mode works, how to manage credentials, and which credential belongs to which leg of a call.
Test a Trunk
A pre-flight checklist, then place a real test call in each direction, read the result in call history, and work out what to fix when it fails.