Thanks — I understand you're concerned that a trunk with

allowedAddresses

configured still accepted a connection from an IP not in that list. I'll help troubleshoot this and narrow down whether that's expected or a misconfiguration. A few quick facts from the configuration model: • Trunks include an

allowed_addresses

/

allowedAddresses

field intended as an IP whitelist for SIP providers. • The documentation references the ability to "restrict calls by IP address," but it does not explicitly state enforcement details for every runtime scenario. Because the sources do not state exactly how enforcement behaves in every case, I need a bit more information to determine whether what you saw is expected or indicates a problem. Could you share the following? 1. The exact field name and value you used (

allowedAddresses

vs

allowed_addresses

) and a sanitized copy of the trunk config (redact secrets). 2. The LiveKit version or release you’re running. 3. The IP address that successfully connected (or a CIDR you used) and the IP you expected to block. 4. Whether the trunk or service was restarted after changing the

allowedAddresses

. 5. Any logs from the SIP/inbound trunk handling around the connection time (timestamp, incoming IP, accept/deny messages). What I can do once you share that: • Check for common causes (mis-typed field name, wrong CIDR format, config not reloaded). • Walk through steps to reproduce or tighten the restriction. • Suggest specific logging checks or config edits to ensure the whitelist is enforced. If you prefer, start by pasting the sanitized trunk configuration and the connecting IP and I’ll point out anything obvious right away. Sources: Accepting calls overview | LiveKit Documentation | sip | livekit/livekit_composite | DeepWiki