Configuring Kamailio as anEnterprise Session Border Controller

# Load modules
loadmodule "topoh.so"

# Topology hiding parameters
modparam("topoh", "mask_key", "a_very_secret_key_32chars_long!!")
modparam("topoh", "mask_ip", "203.0.113.10")  # Your SBC public IP
modparam("topoh", "mask_callid", 1)           # Also obfuscate Call-IDs

# In request_route — apply for INVITE and all non-ACK requests:
route[TOPOLOGY_HIDE] {
    if (!topology_hiding()) {
        xlog("L_WARN", "Topology hiding failed for $ci\n");
    }
}

loadmodule "pike.so"
modparam("pike", "sampling_time_unit", 2)
modparam("pike", "reqs_density_per_unit", 30)  # 30 req/2sec max per IP
modparam("pike", "remove_latency", 120)         # unblock after 120s

route[DOS_PROTECT] {
    if (!pike_check_req()) {
        xlog("L_ALERT","DoS from $si — blocking\n");
        # Kernel-level block — stops flood before reaching Kamailio
        exec_cmd("iptables -A INPUT -s $si -j DROP &");
        sl_send_reply(503, "Flood Detected");
        exit;
    }
}

# IP allowlist — skip rate limiting for trusted carrier IPs
route[ALLOWLIST_CHECK] {
    if (src_ip == "1.2.3.4" || src_ip == "5.6.7.8") {
        return; # trusted carrier, skip DOS_PROTECT
    }
    route(DOS_PROTECT);
}

modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:22222")

route[RTPENGINE] {
    if (is_method("INVITE") || is_method("ACK")) {
        # External (SRTP) → Internal (RTP) bridge
        rtpengine_manage(
          "replace-origin replace-session-connection SRTP",  # external leg
          "replace-origin replace-session-connection RTP"   # internal leg
        );
    }
}