[general]
context=public                  ; Default context for incoming calls. Defaults to 'default'
allowguest=no                   ;for twilio , secured                  ; Allow or reject guest calls (default is yes)
                                ; If your Asterisk is connected to the Internet
                                ; and you have allowguest=yes
                                ; you want to check which services you offer everyone
                                ; out there, by enabling them in the default context (see below).
allowoverlap=no                 ; Disable overlap dialing support. (Default is yes)
realm=xxx.xxx.com             ; Realm for digest authentication
                                ; defaults to "asterisk". If you set a system name in
                                ; asterisk.conf, it defaults to that system name
                                ; Realms MUST be globally unique according to RFC 3261
                                ; Set this to your host name or domain name
udpbindaddr=0.0.0.0             ; IP address to bind UDP listen socket to (0.0.0.0 binds to all)
                                ; Optionally add a port number, 192.168.1.1:5062 (default is port 5060)
tcpenable=yes                   ; Enable server for incoming TCP connections (default is no)
tcpbindaddr=0.0.0.0             ; IP address for TCP server to bind to (0.0.0.0 binds to all interfaces)
                                ; Optionally add a port number, 192.168.1.1:5062 (default is port 5060)
tlsenable=yes                   ; Enable server for incoming TLS (secure) connections (default is no)
tlsbindaddr=x.x.x.x     ; IP address for TLS server to bind to (0.0.0.0) binds to all interfaces)
tlscertfile=/etc/asterisk/keys/cert.pem
tlscafile=/etc/asterisk/keys/cert_chained.crt
tlscipher=ALL
tlsclientmethod=tlsv1 ;none of the others seem to work with Blink as the client
transport=udp,ws,tls                   ; Set the default transports.  The order determines the primary default transport.
srvlookup=yes                   ; Enable DNS SRV lookups on outbound calls
tos_sip=cs3                    ; Sets TOS for SIP packets.
tos_audio=ef                   ; Sets TOS for RTP audio packets.
tos_video=af41                 ; Sets TOS for RTP video packets.
tos_text=af41                  ; Sets TOS for RTP text packets.
cos_sip=3                      ; Sets 802.1p priority for SIP packets.
cos_audio=5                    ; Sets 802.1p priority for RTP audio packets.
cos_video=4                    ; Sets 802.1p priority for RTP video packets.
cos_text=3                     ; Sets 802.1p priority for RTP text packets.

maxexpiry=3600                 ; Maximum allowed time of incoming registrations (seconds)
minexpiry=60                   ; Minimum length of registrations (default 60)
defaultexpiry=600              ; Default length of incoming/outgoing registration
submaxexpiry=3600              ; Maximum allowed time of incoming subscriptions (seconds), default: maxexpiry
subminexpiry=60                ; Minimum length of subscriptions, default: minexpiry
qualifyfreq=45                  ; Qualification: How often to check for the host to be up in seconds
                                ; and reported in milliseconds with sip show settings.
                                ; Set to low value if you use low timeout for NAT of UDP sessions
                                ; Default: 60
qualifygap=100                 ; Number of milliseconds between each group of peers being qualified
                                ; Default: 100
qualifypeers=1                 ; Number of peers in a group to be qualified at the same time
                                ; Default: 1
keepalive=45                   ; Interval at which keepalive packets should be sent to a peer
                                ; Valid options are yes (60 seconds), no, or the number of seconds.
                                ; Default: 0
disallow=all                   ; First disallow all codecs
allow=alaw                     ; Allow codecs in order of preference
prematuremedia=yes              ; Some ISDN links send empty media frames before
                                ; the call is in ringing or progress state. The SIP
                                ; channel will then send 183 indicating early media
                                ; which will be empty - thus users get no ring signal.
                                ; Setting this to "yes" will stop any media before we have
                                ; call progress (meaning the SIP channel will not send 183 Session
                                ; Progress for early media). Default is "yes". Also make sure that
                                ; the SIP peer is configured with progressinband=never.
                                ;
                                ; In order for "noanswer" applications to work, you need to run
                                ; the progress() application in the priority before the app.

progressinband=yes              ; If we should generate in-band ringing always
                                ; use 'never' to never use in-band signalling, even in cases
                                ; where some buggy devices might not render it
                                ; Valid values: yes, no, never Default: never
useragent=XXX             ; Allows you to change the user agent string
                                ; The default user agent string also contains the Asterisk
                                ; version. If you don't want to expose this, change the
                                ; useragent string.

tlsdontverifyserver=yes
;        If set to yes, don't verify the servers certificate when acting as
;        a client.  If you don't have the server's CA certificate you can
;        set this and it will connect without requiring tlscafile to be set.
;        Default is no.

rtptimeout=60                  ; Terminate call if 60 seconds of no RTP or RTCP activity
                                ; on the audio channel
                                ; when we're not on hold. This is to be able to hangup
                                ; a call in the case of a phone disappearing from the net,
                                ; like a powerloss or grandma tripping over a cable.
rtpholdtimeout=300             ; Terminate call if 300 seconds of no RTP or RTCP activity
                                ; on the audio channel
                                ; when we're on hold (must be > rtptimeout)
rtpkeepalive=15            ; Send keepalives in the RTP stream to keep NAT open
                                ; (default is off - zero)

callcounter = yes              ; Enable call counters on devices. This can be set per
                                ; device too.
nat=force_rport,comedia
directmedia=no

promiscredir=no

externip=x.x.x.x
localnet=10.x.x.0/255.255.255.0
localnet=10.y.y.0/255.255.255.0
localnet=10.z.z.0/255.255.255.0
localnet=172.w.w.0/255.0.0.0
localnet=x.x.x.x/255.255.255.240

[webphone](!)
host=dynamic
context=webphone
type=friend
encryption=yes
media_encryption=dtls
avpf=yes
avp=yes
rtcp_mux=yes
force_avp=yes
icesupport=yes
directmedia=no
disallow=all
allow=alaw
allow=gsm
allow=ilbc
allow=g729
allow=g723
allow=ulaw
dtlsenable=yes
dtlsverify=fingerprint
dtlscertfile=/etc/asterisk/keys/cert.pem
dtlscafile=/etc/asterisk/keys/cert_chained.crt
dtlssetup=actpass
dtls_setup=actpass
qualify=yes
call-limit=1
dtmfmode=rfc2833
transport=udp,tls,ws,wss

[webcall](!)
host=dynamic
context=webcall
type=friend
encryption=yes
media_encryption=dtls
avpf=yes
avp=yes
rtcp_mux=yes
force_avp=yes
icesupport=yes
directmedia=no
disallow=all
allow=alaw
allow=gsm
allow=ilbc
allow=g729
allow=g723
allow=ulaw
dtlsenable=yes
dtlsverify=fingerprint
dtlscertfile=/etc/asterisk/keys/cert.pem
dtlscafile=/etc/asterisk/keys/cert_chained.crt
dtlssetup=actpass
dtls_setup=actpass
qualify=yes
dtmfmode=rfc2833
transport=udp,tls,ws,wss

[telip](!)
host=dynamic
context=webphone
type=friend
encryption=no
avpf=no
force_avp=no
icesupport=no
directmedia=no
progressinband=never              ; If we should generate in-band ringing always
disallow=all
allow=g729
allow=gsm
allow=ilbc
allow=g722
allow=alaw
allow=ulaw
dtlsenable=no
qualify=yes
call-limit=10
dtmfmode=rfc2833
transport=udp,tcp

;USER's 
[XXXXXX](webphone)
context=webphone-XXXX
secret=xyz
callerid=YYYY <XXXXXX>

[XXXXXW](telip)
context=webphone-XXXX
secret=xyz
callerid=YYYW <XXXXXW>
