🛡️ Part 9: Deploying Kalixor SBC (Session Border Controller) on Debian 13

Welcome to the ninth installment of our "Debian 13 Clustering & Distribution" series. In the previous parts, we set up our custom APT repository, compiled and packaged FreeSWITCH, Kamailio, and RTPEngine, and walked through both single-server and distributed deployments. To wrap up this series, we will cover the installation and configuration of Kalixor SBC (Session Border Controller) on Debian 13 (Trixie). To make deployment simple and reliable, Kalixor SBC is installed using an automated one-touch installer. In this guide, we will explain how to bootstrap the entire SBC gateway via the install-sbc.sh script, which installs the unified softswitch-sbc package from the repository (automatically pulling Kamailio and RTPEngine as dependencies), configures backend PostgreSQL databases, sets up local DSN connections, deploys Nginx reverse proxies, starts WireGuard VPN tunnels, and boots secure nftables firewall configurations.

🏗️ Architecture Overview

The Session Border Controller (SBC) acts as the secure entry point for external SIP trunks and remote subscribers, shielding the internal softswitch core (FreeSWITCH nodes) from direct public network exposure. It performs topology hiding, protocol validation, rate limiting, and bridges media streams across networks using Sipwise RTPEngine.

The automated installer compiles and links these decoupled layers into a unified gateway:

Kamailio 6.x: The core SIP proxy handling routing logic, dispatcher load balancing, and signaling boundaries.
RTPEngine: Media relay, transcribing SRTP to RTP, and handling NAT traversal.
PostgreSQL 17: Dynamic routing tables, dispatchers, subscribers, and admin panel records.
SBC API (Node.js/Fastify): Secure administrative REST API listening on loopback port 3003.
Nginx Web Server: Front-facing reverse proxy handling HTTPS termination, API forwarding, and serving static frontend React dashboard files.
WireGuard: Secure VPN interface (wg0) allowing PBX nodes and remote spokes to register securely over encrypted tunnels.

⚡ One-Touch Installation (Recommended)

The entire SBC gateway installation is fully automated. You can fetch and execute the installer script from the Ring2All repository server.

To run the one-touch installation, execute the following command as root on your target Debian 13 server:

Bash

wget -O- https://repo.softswitchone.com/apt/install-sbc.sh | bash

Alternatively, you can download the script first to customize parameters:

Bash

wget https://repo.softswitchone.com/apt/install-sbc.sh
chmod +x install-sbc.sh

# Run the installer
./install-sbc.sh

Supported Installer Flags

When running the script manually, you can append flags:

--skip-sbc-kamailio: Skips installing Kamailio and its modules (useful if they are already pre-installed).
--skip-repo: Skips configuring the Ring2All repository sources.
--skip-kamdb: Skips Kamailio database schema initialization.

⚙️ Automated Installation Workflow

When the installer runs, it executes the following steps automatically:

Installs System Prerequisites: Sets up core utilities (curl, wget, gnupg2, openssl), web servers (nginx), databases (postgresql), connector drivers (unixodbc, odbc-postgresql), and security tools (fail2ban, nftables, wireguard).
Deploys Node.js 22 LTS: Connects to NodeSource to fetch and register the Node.js 22 runtime environment.
Installs Kamailio 6.x & Modules: Registers the Kamailio PPA for Debian 13 (deb http://deb.kamailio.org/kamailio60 trixie) and installs Kamailio along with its modules (postgres, tls, websocket, json, presence) and kamcli.
Bootstraps Kamailio Databases: Initializes database roles, creates the kamailio database, applies schemas (standard-create.sql, presence-create.sql), and registers the primary server IP as a default domain alias.
Registers Ring2All APT Repository: Adds the package signing key and references the custom /apt/base repository path.
Installs softswitch-sbc: Installs the unified Kalixor SBC package from the repository. The package post-installation scripts handle:

- Creating the sbc_admin database and seeding default tables.

- Deploying sbc credentials at /etc/softswitch/sbc-credentials.

- Configuring /etc/softswitch/sbc-api.env variables.

- Deploys the Fastify-based REST API administrative service (sbc-api.service) listening on loopback port 3003.

Maps system DSN ODBC Connections: Connects local services to the databases by editing /etc/odbc.ini with correct roles.
Configures Nginx Server: Installs the authoritative reverse proxy blocks at /etc/nginx/sites-available/softswitch-sbc, enabling HTTPS forwarding for API queries, real-time WebSocket communication, and web dashboard static assets.
Sets up WireGuard VPN (wg0): Generates private/public server keypairs, builds /etc/wireguard/wg0.conf listening on UDP port 51820, registers the server public key, and binds Kamailio to listen on the tunnel IP 10.9.0.1:5060.
Deploys Firewalls: Deploys a secure default drop ruleset in nftables, opening port 22 (SSH), 80/443 (HTTP/S), 5060 (SIP UDP/TCP), 5061 (SIP TLS), and 51820 (WireGuard VPN).

🔍 Verifying the Installation

After the one-touch installer script completes, run these commands to verify that all systems are healthy:

1. Verify Core Services Status

Bash

systemctl status postgresql
systemctl status kamailio
systemctl status sbc-api
systemctl status nginx
systemctl status wg-quick@wg0

2. Validate API Health Check

Bash

# Direct local query (ignoring Nginx)
curl -s http://127.0.0.1:3003/health

# Public query via Nginx proxy (ignoring self-signed TLS errors)
curl -ks https://127.0.0.1/health

Expected output: {"status":"ok","service":"kamailio-api","version":"1.0.0"}

3. Check Active SIP Listeners

Bash

ss -ulnp | grep -E '5060|51820'

Expected: Kamailio listening on port 5060 (UDP/TCP) on the primary interface and the WireGuard interface (10.9.0.1), and WireGuard listening on port 51820 (UDP).

🔌 Post-Installation SBC Configuration

1. Initial Access & Setup

URL: https://
Username: admin
Password: (Blank by default)

NOTE

On your first visit, the UI will automatically redirect you to the Set Admin Password setup screen where you can securely configure your new password.

2. Map Telephony Target Nodes (Dispatcher List)

To allow the SBC to route traffic to your internal FreeSWITCH cluster, register the telephony IP address in the dispatcher list:

Bash

# Add FreeSWITCH cluster node (Replace 192.168.10.30 with your actual FreeSWITCH server IP)
sudo -u postgres psql -d kamailio -c \
  "INSERT INTO dispatcher (setid, destination, flags, priority, attrs, description) \
   VALUES (1, 'sip:192.168.10.30:5060', 0, 1, '', 'FreeSWITCH Node 1');"

# Reload dispatcher tables dynamically
kamcli dispatcher reload

📈 Operation & Diagnostics

Manage your daily SBC operations with these kamcli commands:

Bash

# Show registered SIP endpoints
kamcli ul show

# Show dispatcher nodes and their availability state
kamcli dispatcher show

# Reload dispatchers list after adding target servers
kamcli dispatcher reload

# Show active SIP dialog flows
kamcli dialog show

# Ban a spamming IP address dynamically
kamcli htable seti ipban <IP_ADDRESS> 1

This concludes our series on Debian 13 Clustering and Distribution. You now have a secure, robust perimeter SBC (Kalixor) running Kamailio 6.x and RTPEngine, routing traffic safely to your internal FreeSWITCH clusters.