Your own FreePBX server, from a blank machine to a locked-down phone system

What do you need before you start?

You need a machine that can run Debian 12, nothing more exotic. Sangoma, the company behind FreePBX, supports version 17 on Debian 12 (codename bookworm) only, installed either with its ISO or with a script you run on an existing Debian 12 system.

• An Intel or AMD processor (amd64). Sangoma's install script checks the architecture before it does anything and refuses to go on otherwise, so ARM machines are out, 64-bit ones included.
• Debian 12, and staying there. Sangoma's update guide tells you to stop if an upgrade starts talking about Debian 13, trixie or stable.
• An internet connection during the install. The script fetches its packages live; Sangoma offers no offline installer.
• A SIP trunk from a phone carrier if you want to call ordinary phone numbers. FreePBX is the switchboard; the carrier connects it to the phone network.

Sangoma does not publish a minimum amount of memory or number of cores for FreePBX 17, so we will not guess one for you. What makes a phone system busy is how many calls run at the same time, whether the server has to convert audio between formats, conference rooms, and recordings. If you record calls, plan the disk around how long you keep them.

Old guides mention chan_sip. FreePBX 17 comes with Asterisk 22, and Asterisk 21 and later dropped chan_sip, so everything here uses PJSIP, the SIP driver Asterisk still ships.

Picking the server that fits

A phone system is one job, and our dedicated servers give that job a whole physical machine: all of its cores, memory and disks, with no other customer on the hardware. Your calls never wait behind somebody else's busy website, and nothing meters the port, so a month of heavy calling does not come with a bandwidth bill.

• Small cartridges suit a single office. If you want to see the server's screen when it will not boot, choose the m510 or m710x, which carry their own console; the other cartridges give you power on and off only. Skip the ARM cartridge.
• Rack servers and blades carry a remote console of their own and can be ordered with a hardware RAID controller. Choose two disks in RAID 1 if voicemail and recordings must outlive a failed disk.
• Two-processor servers make sense if you host phone systems for several companies, each in its own virtual machine.

Put the server close to whoever holds the phones; we run machines in five cities across the US and Europe, all on our locations page. A ready server is handed over within 30 minutes of payment approval, and Debian is one of the systems on our Linux servers.

Getting FreePBX on it, step by step

1. Choose Debian 12 when you order, or reinstall to it from the control panel, and log in over SSH as root.
2. Shut the web ports to the outside world for now. Sangoma's instructions put the admin login setup on your first visit to the web interface, and that first visit should be yours, not a stranger's. The first lines below do it, for IPv4 and IPv6. Don't count on a reboot clearing them: Sangoma's script adds iptables-persistent, which stores whatever rules are loaded when it installs, so the block stays until you take it out.
3. Download and run Sangoma's install script, then let it work. Sangoma says to expect around 30 minutes or more, and it keeps a log under /var/log/pbx/.
4. When it finishes, list the rules with ip6tables -S INPUT and iptables -S INPUT and make sure the web block is still there.
5. From your own computer, start an SSH tunnel using the last line below, logging in exactly as you did in step 1, and visit http://127.0.0.1:8080/ in your browser. Create the admin account there, with a long password.

apt-get install -y iptables
iptables -I INPUT -p tcp -m multiport --dports 80,443 ! -i lo -j DROP
ip6tables -I INPUT -p tcp -m multiport --dports 80,443 ! -i lo -j DROP

wget https://github.com/FreePBX/sng_freepbx_debian_install/raw/master/sng_freepbx_debian_install.sh -O /tmp/sng_freepbx_debian_install.sh
bash /tmp/sng_freepbx_debian_install.sh

# on your own computer:
ssh -L 8080:127.0.0.1:80 YOUR_LOGIN@YOUR_SERVER_IP

The script has a --skipversion switch that skips its own version check. Sangoma advises against using it, and you do not need it. The --dahdi switch is only for Sangoma's physical phone-line cards, which a hosted server does not have.

Which doors to open, and to whom

Sangoma's own port list is short, and most of it should be closed to the public. The one range that has to stay open to everyone is the voice traffic, because carriers often send audio from different addresses than the ones they signal from.

Sangoma recommends leaving the RTP range as it is. Port 5160, which many older articles mention, was chan_sip's and is not needed on a default FreePBX 17.

Turning on the firewall without shutting yourself out

FreePBX ships its own firewall, and it works by refusing everything you have not allowed. It also reads your setup: once a trunk is configured, that carrier is let in automatically for its own protocol. You turn it on in the web interface under Connectivity, then Firewall.

1. Add your own address to the Trusted zone first. The firewall page offers to do it for you, or use fwconsole firewall trust with your IP at the command line.
2. Add each office's fixed address too, for example with fwconsole firewall add other and the office network. The Other zone lets SIP through unfiltered, which is what your desk phones need.
3. Only then move the server's network interface from Trusted to Internet. Sangoma treats an interface left in Trusted as a misconfiguration, and the Internet zone does not let SIP in on its own.
4. Use the Services page to keep SSH, the admin pages and phone provisioning closed to the Internet zone. Sangoma is blunt about TFTP: never let untrusted networks reach it.
5. With the admin account created and your address Trusted, remove the web block you added during setup, then save, using the commands below.

iptables -D INPUT -p tcp -m multiport --dports 80,443 ! -i lo -j DROP
ip6tables -D INPUT -p tcp -m multiport --dports 80,443 ! -i lo -j DROP
netfilter-persistent save

Staff with softphones on laptops or mobiles move between networks, so you cannot list them by address. That is what Responsive Firewall is for. A device it does not know gets 10 signalling packets to register; fail that and it is ignored for 60 seconds. Reach 50 failed attempts in a day, or fire a burst of 50 packets inside 10 seconds, and that address is blocked for at least 24 hours. If every phone you have sits at a known address, Sangoma suggests leaving Responsive off.

Locked out anyway? With Safe Mode enabled, rebooting twice within five minutes holds the firewall back for five minutes after start-up, enough time to log in and fix the rule. You can do those reboots from the power control in your dashboard.

Stopping strangers from calling on your bill

Toll fraud is the risk that costs real money. The Asterisk project warns that a badly configured system can be used by outsiders and run up substantial charges. Here is the checklist Sangoma and the Asterisk documentation point you to:

• Under Asterisk SIP Settings, switch off Allow Anonymous Inbound SIP Calls and Allow SIP Guests. Both should read No.
• Use long random secrets for extensions. An extension whose password is its own number is the first thing attackers try.
• Ask your carrier for IP-based authentication on the trunk, if they offer it, instead of a password that can leak.
• No international callers on your team? Block those destinations in your outbound routes, and have the carrier bar them as well.
• Make sure nothing that reaches outside lines is reachable from incoming calls; Asterisk's dialplan guidance puts that first.
• Look through the call reports every week or so. An odd destination is the earliest warning you will get.

For extra protection, Sangoma suggests encrypting calls with TLS and SRTP, running Fail2ban through Intrusion Detection, and serving the admin pages over HTTPS only.

Keeping it healthy

Debian updates arrive with apt update followed by apt upgrade; FreePBX's own modules update separately from Module Admin. Sangoma's procedure ends with fwconsole restart, which drops most calls in progress, so schedule it for a quiet hour. Take regular backups with the Backup and Restore module (also Sangoma's supported way to move an older FreePBX onto version 17) and store a copy somewhere other than the server.

When a hosted phone system is the wrong idea

If your office still relies on analogue lines or ISDN through a telephony card, that card has to live where the lines come in, so the PBX belongs there too. And if your office internet drops often, a hosted PBX will drop with it. For just a few extensions, a Cloud VPS costs less, though it shares processor time with other customers.

Questions people ask

How powerful does a server for FreePBX need to be?

Sangoma publishes no minimum specification for FreePBX 17. The firm requirements are Debian 12 and an Intel or AMD processor; the install script refuses any other architecture. Beyond that, size it for how many calls happen at once, any audio conversion, conferences and how much recording you keep.

Is FreePBX free to run?

FreePBX is open-source software under the GPL, and Sangoma's install script is free to download and run. Sangoma also sells commercial add-on modules; the script also sets up the package repository those modules come from.

Can I use Ubuntu instead of Debian?

Sangoma develops and tests FreePBX 17 on Debian only, and says it might work on other Debian-based systems such as Ubuntu without supporting them. For a phone system your business depends on, stay with Debian 12.

Why can people hear me but I cannot hear them?

One-way or missing audio usually means the RTP range is not reaching the server. FreePBX uses UDP 10000 to 20000 by default and its firewall opens that range automatically, so check any other firewall in the path and the NAT settings on the office router.

Does the firewall need a rule for my SIP trunk?

No. The FreePBX firewall discovers the trunks you configure and accepts traffic from each one on its own protocol. You add rules for your offices and yourself, not for the carrier.