CPaaS Guide
Twilio SIP Trunk Configuration
8 min read · Updated April 2026
Twilio Elastic SIP Trunking connects your PBX, SBC, or custom SIP application to the PSTN. Setup is straightforward but the failure modes are specific — authentication errors, IP ACL mismatches, and number format issues cause most problems.
SIPSymposium is an independent diagnostic platform not affiliated with or endorsed by Twilio Inc. Twilio is a registered trademark of Twilio Inc.
1. Twilio Elastic SIP Trunking overview
Twilio Elastic SIP Trunking provides PSTN connectivity for SIP-capable PBX systems, SBCs, and custom SIP applications. Unlike traditional fixed-channel trunks, Twilio's elastic model scales concurrent calls automatically — you pay per minute used rather than for reserved capacity.
Twilio SIP trunks support both inbound (PSTN to your SIP endpoint) and outbound (your SIP endpoint to PSTN) calling. Inbound calls are routed to your SIP URI or webhook. Outbound calls are sent from your SIP endpoint to Twilio's SIP termination endpoint.
Twilio SIP trunking is part of the Programmable Voice product, meaning you can combine SIP trunking with TwiML, Studio, and other Twilio Voice features for advanced routing logic.
2. Creating and configuring a Twilio SIP trunk
- Twilio Console → Elastic SIP Trunking → Trunks → Create new SIP Trunk
- Give it a friendly name (e.g., "Production PBX Trunk")
- Note the Termination SIP URI — this is where you send outbound calls:
yourtrunk.pstn.twilio.com
- Configure Origination — add your PBX/SBC URI for inbound calls
- Configure Authentication — either Credential List or IP Access Control List
- Associate Phone Numbers — assign DIDs to route inbound calls to this trunk
Twilio SIP termination endpoint
; Outbound calls from your PBX to Twilio
; Point your SIP trunk to:
yourtrunkname.pstn.twilio.com (your unique subdomain)
; Or use the global termination endpoint:
pstn.twilio.com
; Twilio supports UDP (5060), TCP (5060), and TLS (5061)
; Test connectivity:
sipsak -s sip:+12025551234@yourtrunk.pstn.twilio.com
3. Authentication — Credential Lists vs IP ACL
Twilio supports two authentication methods for outbound calls from your PBX to Twilio:
Method A
Credential List (digest auth)
Create username/password credentials in the Twilio Console and assign to the trunk. Your PBX authenticates using SIP digest authentication (401 → REGISTER/INVITE with credentials). Works with dynamic IP addresses. Most flexible for multi-site deployments.
Method B
IP Access Control List
Add your PBX/SBC public IP addresses to an IP ACL and assign to the trunk. Calls from allowlisted IPs are accepted without credentials. Simpler and no credential management. Requires static IP. Best for single-site PBX deployments with stable IP.
; Asterisk PJSIP — Twilio credential auth
[twilio-auth]
type=auth
auth_type=userpass
username=your-twilio-credential-username
password=your-twilio-credential-password
[twilio-trunk]
type=endpoint
outbound_auth=twilio-auth
aors=twilio-trunk
context=from-twilio
disallow=all
allow=ulaw
allow=alaw
dtmf_mode=rfc4733
direct_media=no
4. Call routing and phone numbers
Inbound routing
For inbound calls, Twilio routes the call to your Origination URI. The Request-URI contains the called DID in E.164 format. Your PBX must match on this number and route to the correct extension.
; Asterisk — handle inbound from Twilio
; Twilio sends INVITE to your SBC/PBX with:
; Request-URI: sip:+12025551234@yoursbc.example.com
; From: sip:+15558675309@pstn.twilio.com
[from-twilio]
exten => _+1NXXXXXXXXX,1,NoOp(Inbound from Twilio: ${EXTEN})
same => n,Set(DID=${EXTEN:2}) ; Strip +1
same => n,Goto(internal,${DID},1)
Outbound caller ID
For outbound calls, Twilio validates the caller ID. The From/CLI must be a Twilio-verified number or a number purchased from Twilio. Unverified numbers are replaced with your Twilio number or rejected.
5. Common Twilio SIP trunk issues
Issue 01
403 Forbidden on outbound calls
Authentication failure. Either credentials are wrong, the IP is not in the ACL, or both. Check that the credential username/password in your PBX exactly matches the Twilio Console. For IP ACL: verify your current public IP is listed — dynamic IPs change. Twilio also returns 403 if your account has no funds or is suspended.
Issue 02
Calls connect but no audio
NAT issue — your PBX is advertising a private IP in the SDP. Twilio sends RTP to the private IP which is unreachable. Set your PBX external IP in the SIP/PJSIP transport config. Enable direct_media=no so your PBX proxies media and rewrites SDP with the correct public IP.
Issue 03
Inbound calls not reaching PBX
Origination URI not reachable from Twilio. Your SBC/PBX must be accessible from Twilio's IP ranges on the configured port. Check firewall rules allow inbound SIP from Twilio's IP ranges (published at help.twilio.com/articles/223136067). Also verify the Origination URI in the trunk matches your SBC address exactly.
Issue 04
DTMF not working
Codec or DTMF mode mismatch. Twilio uses RFC 2833 (payload type 101). Ensure your PBX is configured for rfc4733 (Asterisk PJSIP) or rfc2833 (chan_sip). Never use in-band DTMF with Twilio — codec compression makes in-band tones unreliable.
6. Debugging with Twilio Debugger and logs
Twilio Console Debugger
Twilio Console → Monitor → Debugger. Shows real-time errors including SIP response codes, authentication failures, and call routing errors. Each error links to documentation explaining the cause.
Twilio SIP call logs
Console → Elastic SIP Trunking → your trunk → Calls tab. Per-call records show SIP call-ID, response codes, duration, and originating IP. Filter by date range or phone number.
Twilio Insights
Console → Monitor → Insights → Voice. Detailed per-call analytics including codec negotiated, DTMF events, media quality metrics (where available), and carrier routing path.
; Test Twilio SIP trunk from command line
; Outbound test call (requires sipp)
sipp -sn uac -s +12025551234 yourtrunk.pstn.twilio.com:5060 -au your-username -ap your-password -m 1
; Or use sipsak for OPTIONS test
sipsak -s sip:yourtrunk.pstn.twilio.com
Frequently asked questions
How do I set up a Twilio SIP trunk?
In the Twilio Console go to Elastic SIP Trunking → Trunks → Create new SIP Trunk. Note the Termination SIP URI (yourtrunk.pstn.twilio.com) and point your PBX outbound calls there. Configure authentication via Credential List (username/password) or IP ACL (static IP allowlist). Add phone numbers and set the Origination URI to your PBX/SBC address for inbound call routing.
Why am I getting 403 on Twilio SIP trunk calls?
Twilio returns 403 Forbidden when authentication fails — credentials are wrong, the sending IP is not in the ACL, the account has no funds, or the account is suspended. For credential auth: verify username and password exactly match the Twilio Console credential list. For IP ACL: check your current public IP is listed (dynamic IPs change). Also check account balance in the Twilio Console.
How do I fix no audio on Twilio SIP trunk calls?
No audio on Twilio calls is a NAT issue — your PBX is advertising a private RFC 1918 IP in the SDP and Twilio is sending RTP to that unreachable address. Fix by setting your PBX external/public IP in the SIP transport configuration. In Asterisk PJSIP set external_media_address and external_signaling_address in the transport. Also set direct_media=no on the Twilio trunk endpoint.
Troubleshooting Twilio SIP trunk issues?
Capture SIP from your PBX and upload to SIPSymposium. The analyzer checks authentication flow, NAT issues in the SDP, codec negotiation, and DTMF configuration against Twilio SIP trunk requirements.