How to Fix SIP 403 Forbidden

403 Forbidden is a refusal, not a failure to connect. RFC 3261 section 21.4.4 defines it as "the server understood the request, but is refusing to fulfil it", and adds that the request should not be repeated. The server is reachable and it read your message. It decided no. Why it decided no depends on which request it refused: a REGISTER points to credentials, account state or an IP ban, while an INVITE points to the dialplan, the outbound route or the trunk.

Quick checklist

1. Note which request got the 403: REGISTER or INVITE.
2. For REGISTER: retype the password and clear the Auth username unless the provider gave you one.
3. Ask whether the extension is enabled and whether your public IP is banned.
4. Compare the Domain field with what the server expects.
5. For INVITE: try an internal extension first, then an external number in the exact format the PBX expects.
6. Ask the administrator to check the extension's context, outbound routes and trunk caller ID rules.

What does 403 Forbidden mean in SIP?

SIP response codes follow the HTTP pattern. The 4xx class means the request failed because of something the client did or is not allowed to do. Within that class, 401 asks for authentication and 403 says authentication will not help. Servers do not always follow this distinction strictly, so you cannot read 403 as "my password is fine". Treat it as "the server rejected me on purpose" and work through the causes below.

Why do some servers answer 403 for wrong credentials?

Asterisk is the best-known example. Depending on the channel driver and settings, a REGISTER with a bad secret can receive 403 Forbidden instead of a second 401. The reason phrase sometimes helps, for example "403 Forbidden (Bad auth)". If you see that wording, follow the steps in How to Fix SIP 401 Unauthorized: retype the password, check the auth username and confirm the secret on the server. Enabling the "Save detailed logs" option in your softphone shows the full reply including the reason phrase.

Is your IP address banned?

Servers exposed to the internet are probed constantly, so many administrators run a ban service such as fail2ban. After a few failed attempts from one address, every further request from that address is dropped or refused. Some setups answer 403 during the ban. Two things make bans confusing:

• The failed attempts may have come from another device behind the same router. The whole office shares one public address.
• Correcting your password changes nothing until the ban expires.

Ask the administrator to look for your public IP in the ban list and remove it. Then fix the device that caused the failures. Hosted providers run similar fraud filters and may require a support ticket to lift the block.

A related cause is an IP allow-list. If the PBX only accepts SIP from known addresses and you connect from a cafe or a mobile network, the request is refused. The fix is a VPN into the office network or an updated allow-list.

Is the extension disabled or expired?

A refused REGISTER can simply mean the account is turned off. On a PBX the administrator may have disabled the extension, deleted it, or moved it to a different password. With a hosted provider the account may be suspended for billing reasons. There is nothing to configure on the phone in these cases; confirm the account state first.

Is the domain wrong?

Some servers check the domain in the request against a list of domains they serve. If you enter an IP address as the Server but the PBX only accepts its hostname as the domain, the REGISTER can be refused with 403. The reverse also happens. Try these in order:

1. Leave Domain empty so the softphone uses the server address.
2. If the provider documents a separate SIP domain or realm, enter exactly that.
3. If the server has several domains, ask which one your extension belongs to.

Why does an outbound call get 403?

When registration works but an INVITE is answered with 403, the server accepted you as a user but not the call you asked for. Typical reasons:

• Context restrictions. On Asterisk-based systems each extension lives in a dialplan context. If the context has no rule for the dialled pattern, the call can be refused. See the Asterisk documentation on dialplan contexts.
• Outbound routes. Systems such as Issabel and FreePBX add outbound routes on top of the dialplan. A route may only allow certain prefixes or certain extensions.
• Dial format. The PBX may expect a leading 9, a country code, or a specific number of digits. Dial an internal extension first to prove calling works at all, then adjust the external format.
• Caller ID. Trunks often refuse an INVITE whose caller ID is not one of the numbers on the account. The trunk's 403 is sometimes relayed to the phone as-is.
• Trunk permissions. The provider may restrict international or premium destinations until they are enabled on the account.

For a wider walkthrough see Why Can I Register but Not Make Calls?.

How do I tell a 403 from a network block?

A network block produces silence, not a response. If the softphone shows a timeout or "Could not reach the server", the server never answered and you should read How to Fix SIP 408 Request Timeout. A 403 proves the path is open. That is useful information: skip the firewall and port checks and focus on the account and the server configuration.

What should the administrator look at?

The SIP reply rarely explains itself, but the server log does. Ask for:

• the server's SIP or PJSIP log around the time of your attempt;
• the fail2ban or firewall log for your public IP;
• the extension's settings: enabled, secret, context, allowed codecs, permitted source addresses;
• the outbound route and trunk settings if the 403 is on a call.

Next steps

If the refusal was on REGISTER and you have ruled out bans and account state, work through the broader list in Why Does SIP Registration Keep Failing?. If you run your own PBX, the Asterisk integration page explains where the relevant settings live. The SIP error code lookup tool gives a one-line meaning for any other code you meet in the logs.