Kamailio TLS SIP Edge Setup

I need a working SIP-edge on an Ubuntu 22 / 24 VM that lets MicroSIP register over TLS even in networks where standard SIP/VoIP traffic is blocked. The edge will terminate the TLS leg, proxy the signalling to my existing VoIP switch over plain UDP, and keep media flowing through RTP Engine.

What I will provide
• A clean VM (public IP, sudo access)
• SIP account details for registration tests
• Any public cert/key material you need for stunnel or Kamailio TLS

Scope of work
– Install and configure Kamailio as the front-end SIP proxy.
– Enable TLS support so MicroSIP can register and place calls securely.
– Use RTP Engine to anchor media and make sure audio is two-way.
– Deploy stunnel (or an equivalent TLS wrapper) if it simplifies the TLS handshake.
– Keep the back-end leg strictly UDP because that is the only protocol my switch accepts.
– Apply basic IP whitelisting so only approved endpoints can talk to the proxy.
– Stick to a standard, well-documented configuration; no exotic patches or custom modules unless absolutely required.

Acceptance test
1. From a remote network I will register a MicroSIP client to the proxy using TLS.
2. I must be able to place an inbound and outbound call with clean audio.
3. SIP messages on the back-end must reach the switch via UDP only.
4. Only the whitelisted test IPs may reach the proxy port.

Deliverables
• Full installation commands / scripts
• kamailio.cfg, RTP Engine and stunnel configs with inline comments
• A brief README explaining how to add more IPs to the whitelist and renew TLS certificates

If you have prior experience bridging TLS clients to UDP-only switches with Kamailio, this should be straightforward. I am ready to start as soon as you can.