rtpengine¶

Status: Current | Last reviewed: 2026-05-28

RTP media proxy. Sits between Kamailio and the rest of the stack to handle NAT, codec, SRTP, and recording.

Image¶

fmateusz/rtpengine:mr11.5.1.13 (or current pin in docker-compose.media.yml).

Ports¶

Port	Purpose
22222/UDP	NG control protocol from Kamailio
30000–40000/UDP	Media

What it does¶

Anchors RTP at a public socket so SIP UAs in different NATs can reach each other.
Re-encrypts SRTP for legs that need it.
Optionally records to a file or pcap.

Global Accelerator dual-interface¶

In EC2 + Global Accelerator setups, GA performs DNAT: the dst IP is rewritten from PUBLIC_IP to LAN_IP before delivery. A single-interface config like interface = ${PUBLIC_IP} will not bind to the LAN-side socket and inbound RTP fails with ICMP port-unreachable.

Use dual-interface syntax in docker-compose.media.yml:

interface = pub/${PUBLIC_IP}!${PUBLIC_IP};priv/${LAN_IP}

Same applies to GKE/EKS with NLB-style NAT.

Kernel module¶

In Vanguard (Codespaces and EC2) the kernel module is unavailable, so rtpengine runs in userspace forwarding mode. This caps per-pod throughput around 200 concurrent calls. In bare-metal or dedicated-VM cluster nodes, install the kernel module for in-kernel forwarding.

See media-pool-tuning.md.

Vanguard¶

Started by docker-compose.media.yml as tsf-local-rtpengine.

Production¶

Helm chart at charts/rtpengine. hostNetwork: true; dedicated media node pool with kernel tuning.