A dedicated, encrypted and isolated path between your phone system and Taliiq, so call traffic never travels the open internet

Taliiq Private SIP Link

Private SIP Link gives your organization a dedicated, encrypted connection between your PBX, gateway, or firewall and Taliiq. Call signaling and audio travel inside this private link, never over the open internet, and your phone system does not need a single public SIP or RTP port.

It is built for organizations that treat voice as sensitive data: banks, healthcare providers, government contractors, contact centers handling payment or personal data, and any enterprise whose security policy requires private connectivity to third-party voice platforms.

Dashboard path: Manage → Integrations → Taliiq Private SIP Link

Related: SIP / BYO SIP

Why use Private SIP Link

Without Private SIP Link	With Private SIP Link
SIP and RTP ports published on a public IP	No public SIP or RTP ports on your side
Calls cross the internet, often unencrypted	Every packet is encrypted end to end between your site and Taliiq
Your PBX is reachable by internet scanners and toll-fraud bots	Only your own tunnel can reach the Taliiq SIP edge
Peer identified by a public IP that can change	Peer identified by a fixed private tunnel address and cryptographic key

It also removes the usual networking obstacles. Your site does not need a static public IP, and it works behind carrier-grade NAT.

How it works

You create a link in the dashboard (one device or site = one link).
Taliiq assigns a private tunnel address and generates keys unique to that link.
You download the configuration once and import it on your device.
You attach the link to a BYO SIP channel or outbound trunk. Taliiq then reaches your PBX only through the tunnel address.

Security model

Private SIP Link is designed on the principle of least privilege. Each link can do exactly one thing: carry your calls to Taliiq.

Encryption and authentication

Traffic is protected by WireGuard, using modern cryptography (Curve25519 key exchange, ChaCha20-Poly1305 encryption, forward secrecy).
Every link has its own key pair. A device without the matching private key cannot connect, even from a known network.
The private key is generated for your device and shown once. Taliiq does not display it again.

Isolation

Per organization: a link can only be attached to your organization's channels and trunks. No other customer can route calls to your tunnel address.
Per link: links cannot reach each other, even within the same organization.
SIP and RTP only: a tunnel can reach Taliiq SIP signaling (5060) and media (10000-10100) and nothing else. It gives no internet access and no path to any other Taliiq system.
Rate limited: each tunnel has a traffic ceiling, so a compromised device cannot flood the platform.

Your network stays yours

The downloaded configuration routes only the Taliiq SIP addresses through the tunnel. Your internet traffic, LAN, and other systems are untouched.

Never set AllowedIPs = 0.0.0.0/0 or add a default route through the tunnel. The downloaded configuration is already scoped to Taliiq SIP addresses only.

Operational control

Action	What it does
Suspend	Immediately stops the tunnel. Calls over this link fail until you resume it.
Resume	Re-enables a link you suspended. Links suspended by Taliiq support need support to clear.
Rotate	Issues new keys and a new configuration. The old keys stop working at once. Use it after staff changes, device replacement, or on a regular schedule.
Delete	Revokes the link permanently. Detach it from SIP channels first.

Every create, download, rotate, suspend, and delete is recorded in your organization's audit trail.

Supported protocols

Protocol	Status	Best for
WireGuard	Available	Linux servers, FreePBX / Asterisk, MikroTik RouterOS 7, most modern firewalls
OpenVPN	Coming soon	Yeastar, Grandstream UCM, older appliances
IPsec (IKEv2)	Coming soon	FortiGate, pfSense, enterprise firewalls

If your device does not run WireGuard yet, contact support. We can advise on a gateway design for your site.

Create a link

Open Manage → Integrations → Taliiq Private SIP Link.

Click New link. Enter a clear name (for example Head office PBX) and choose your device type.

Click Create & download config. Store the file securely: it contains the link's private key and is shown only once.

Import the file on your device (see WireGuard setup). Confirm the tunnel is up: the dashboard shows the last handshake time.

In Build → Channels → SIP (BYO) or an outbound trunk, choose Connect via Private SIP Link. Taliiq fills the gateway / trunk host with your tunnel address.

Lost the configuration file? Use Rotate to issue new keys and download a fresh one. The old file stops working immediately.

WireGuard setup

What the configuration contains

[Interface]
PrivateKey = <your link private key>
Address = 10.40.0.x/32
MTU = 1380

[Peer]
PublicKey = <Taliiq public key>
Endpoint = <Taliiq private link endpoint>:51820
AllowedIPs = <taliiq-sip-private>/32[, <taliiq-sip-public>/32]
PersistentKeepalive = 25

Field	Meaning
`Address`	Your tunnel address. Taliiq reaches your PBX here
`Endpoint`	The Taliiq private link endpoint. Use it exactly as downloaded
`AllowedIPs`	Only Taliiq SIP addresses. Do not widen this
`PersistentKeepalive`	Keeps the link ready for inbound calls

Your firewall needs to allow outbound UDP 51820 to the endpoint. No inbound rule is required.

Linux / FreePBX / Asterisk

Run WireGuard on the PBX host itself where possible, so calls never leave the machine unencrypted.

sudo cp taliiq-*.conf /etc/wireguard/taliiq.conf
sudo chmod 600 /etc/wireguard/taliiq.conf
sudo systemctl enable --now wg-quick@taliiq
sudo wg show

Expect a latest handshake within a few seconds. Then, in Asterisk / FreePBX, point the Taliiq trunk at the Taliiq SIP address from AllowedIPs, so both signaling and media use the tunnel.

MikroTik RouterOS 7

/interface/wireguard/add name=taliiq-pl listen-port=0
/interface/wireguard/peers/add interface=taliiq-pl \
  public-key="<Peer PublicKey from file>" \
  endpoint-address=<Endpoint host from file> endpoint-port=51820 \
  allowed-address=<AllowedIPs from file> \
  persistent-keepalive=25s
/ip/address/add address=10.40.0.x/32 interface=taliiq-pl

Add routes for each /32 in AllowedIPs via taliiq-pl, and route or source-NAT SIP from the PBX behind the router through the tunnel. Do not add a default route through WireGuard.

Attach to SIP channels

A link carries calls only once it is attached:

Create or edit a BYO SIP channel or outbound trunk (SIP guide).

Select Connect via Private SIP Link and pick your active link.

Confirm the gateway / trunk host shows the tunnel address (for example 10.40.0.3), not a public IP.

Place a test call and confirm the last handshake updates in the Private SIP Link list.

Recommended practices

Store downloaded configurations in your secrets manager, not in email or chat.
Use one link per site or device, so you can suspend or rotate one without affecting others.
Rotate keys when a device is replaced, when administrators with access leave, and on a regular schedule.
Keep AllowedIPs exactly as downloaded.
Remove unused links rather than leaving them suspended indefinitely.

Troubleshooting

Symptom	What to check
No handshake	Outbound UDP `51820` allowed to the endpoint; correct file imported; link status Active
Handshake OK, calls fail	Channel attached to this link; host = tunnel address; SIP `5060` and RTP `10000-10100` routed via the tunnel
One-way audio	Media pinned to the public interface; route RTP through the tunnel
Internet traffic goes through the tunnel	Remove default routes; restore `AllowedIPs` from the downloaded file
Resume is disabled	The link was suspended by Taliiq support; contact support
Tunnel down after rotate	Import the new configuration; old keys are invalid by design

FAQ

Is the audio itself encrypted? Yes. Signaling and media both travel inside the WireGuard tunnel, which encrypts every packet between your site and Taliiq.

Does Private SIP Link change where my calls are processed? No. It changes only how your phone system connects to Taliiq. Call handling, recording, and data retention follow your existing Taliiq settings.

Can one PBX use multiple links? Yes. Create one link per tunnel endpoint (for example site A and site B).

Can I use Private SIP Link and the public SIP endpoint together? Yes, per channel. For the strongest posture, attach every channel for a site to its private link and remove public SIP rules from your firewall.

Private SIP Link

On this page