FreePBX server on bare metal: install, ports and toll-fraud hardening

What FreePBX 17 expects from the machine

Sangoma states that FreePBX 17 is officially supported only on Debian 12 "Bookworm". The supported install is a shell script run as root on a plain Debian 12 host, or Sangoma's ISO, which installs Debian and then runs the same script. The script downloads everything from the internet as it goes; there is no offline installer.

• Operating system: Debian 12. Sangoma's update guide says to stay on bookworm and not to proceed if an upgrade mentions Debian 13 or trixie.
• Architecture: x86-64 only. The install script reads dpkg --print-architecture and refuses to run on anything but amd64.
• Asterisk: FreePBX 17 ships Asterisk 22 by default. Asterisk 21 and later have no chan_sip, so endpoints and trunks are PJSIP.
• PHP: the script installs PHP 8.2, the only version Sangoma tests its modules against.
• Hardware cards: DAHDI and Wanpipe drivers are installed only with --dahdi, for Sangoma analogue and digital cards.

Sangoma's install pages give no minimum CPU, memory or disk figure, and this page does not invent one. What loads a PBX is the number of calls up at once, any transcoding between codecs, conference bridges and call recordings, which also take disk. Size against those, and keep the recordings directory in mind when choosing drives.

Ports and who should reach them

These are the FreePBX 17 defaults from Sangoma's port list. Signalling and administration belong to known networks; only the media range is meant to be open to everyone, because a carrier's RTP can arrive from addresses its signalling never used.

Port 5160 belongs to chan_sip. On FreePBX 17 with its default Asterisk there is no chan_sip, so 5160 has no reason to be open. Sangoma also advises against moving RTP to an unusual range.

Why a whole machine for a PBX

A dedicated server is one physical machine with every core, all the memory, the disks and the network port serving one customer, with root access and no hypervisor unless you install one. For a PBX that means no neighbour's workload competing for CPU time while Asterisk is mixing audio, and the port carries your RTP alone. Ports marked Unmetered have no transfer allowance and no overage fee, so a busy month of calls adds no traffic charge.

Lockouts are the standard PBX accident: one wrong zone in the Firewall module and SSH stops answering. Every racked single-, dual- and quad-socket server has an out-of-band console (HPE iLO, Dell iDRAC or a Supermicro BMC), as do the m510 and m710x cartridges; the other cartridges have power control only. Power control alone is enough for FreePBX's Safe Mode, described below.

Latency to the handsets matters more than raw speed. The network is our own autonomous system, AS19624, with machines in New York, Miami, San Francisco, Amsterdam and Bucharest; the data centre pages carry test IPs you can ping from the office before you order.

Choosing the line

• Moonshot cartridges are built for one service per box, which is what a single-office PBX is. Prefer the m510 or m710x if you want a full console rather than power control. The X-Gene ARM cartridge is out: the script stops on anything that is not amd64.
• Single-socket rack servers add a RAID controller, which no cartridge has, and a full console: a sensible home when recordings and voicemail must survive a disk failure.
• Dual-socket machines suit a provider running several PBXs as virtual machines, each with its own Debian 12 guest.
• Ampere Altra and other ARM lines cannot run FreePBX 17 from Sangoma's repository.

Racked machines are handed over in about 30 minutes once payment is approved; built-to-order lines take 4 to 24 hours. Debian is among the free Linux images, and you can reinstall from the control panel as often as you need.

Installing FreePBX 17

1. Install Debian 12 on the server, then SSH in as root.
2. Until the FreePBX admin account exists, the web interface answers anyone who finds the address. Install iptables and drop outside traffic to ports 80 and 443, over IPv4 and IPv6 (first block below). The FreePBX script installs iptables-persistent, which saves the rules in place at that moment, so this rule will survive reboots until you remove it.
3. Run Sangoma's script. It takes around 30 minutes or more; the log is in /var/log/pbx/. When it finishes, check both rules are still listed with iptables -S INPUT and ip6tables -S INPUT, and add them again if not.
4. Open an SSH tunnel with the same login you used in step 1 and browse to the web interface through it (second block). Sangoma's guide has you set secure usernames and passwords for web access at this first visit.
5. Enable the firewall, put your own address in the Trusted zone, and only then remove the web block, as described in the next section.

apt-get install -y iptables
iptables -I INPUT -p tcp -m multiport --dports 80,443 ! -i lo -j DROP
ip6tables -I INPUT -p tcp -m multiport --dports 80,443 ! -i lo -j DROP

cd /tmp
wget https://github.com/FreePBX/sng_freepbx_debian_install/raw/master/sng_freepbx_debian_install.sh -O /tmp/sng_freepbx_debian_install.sh
bash /tmp/sng_freepbx_debian_install.sh

# on your own computer, then open http://127.0.0.1:8080/
ssh -L 8080:127.0.0.1:80 YOUR_LOGIN@SERVER_IP

Leave out --skipversion: Sangoma says bypassing the script's version check is not recommended. Add --dahdi only if the machine holds Sangoma telephony cards.

Firewall module and Responsive Firewall

The FreePBX Firewall is deny by default and reads the PBX configuration itself: a configured trunk is admitted for its own protocol without a rule. Enable it under Connectivity, Firewall. New interfaces start in the Trusted zone, which FreePBX flags as a critical error, so the order is: add your own address or office network to Trusted first, then move the public interface to the Internet zone. Sangoma warns that the Internet zone does not allow SIP, so add your phones' networks before you switch.

fwconsole firewall trust 203.0.113.10
fwconsole firewall add other 198.51.100.0/24
fwconsole firewall list trusted
fwconsole firewall restart

# once the admin account exists and your address is Trusted:
iptables -D INPUT -p tcp -m multiport --dports 80,443 ! -i lo -j DROP
ip6tables -D INPUT -p tcp -m multiport --dports 80,443 ! -i lo -j DROP
netfilter-persistent save

The last three lines lift the temporary web block and save the rule set without it. The other zone is meant for trusted outside networks and gives unfiltered SIP; use it for a branch office with a fixed address. On the Services page, keep SSH, web management and provisioning away from the Internet zone; Sangoma says TFTP should never be reachable from untrusted networks.

Responsive Firewall is for phones that roam and cannot be listed by address. It lets an unknown host send 10 signalling packets; if it has not registered by then, its signalling is dropped for 60 seconds. Fifty failed registration or call attempts within 24 hours, or 50 packets in under 10 seconds, block that address on the attacked port for at least 24 hours. Sangoma's advice is to turn Responsive off when every client can be whitelisted.

Safe Mode: while it is enabled, if you lock yourself out, reboot the server twice within five minutes and the firewall rules are held back for the first five minutes after boot, long enough to add the missing rule.

Closing the toll-fraud doors

Asterisk's own documentation warns that improper configuration can allow unauthorised use of your facilities and substantial charges. The usual route is a guessed extension secret or an open inbound context, followed by calls to expensive destinations on your trunk.

• In Asterisk SIP Settings, set Allow Anonymous Inbound SIP Calls to No and Allow SIP Guests to No.
• Give every extension a long, random secret. Never reuse the extension number or a pattern as the password.
• Use IP-based authentication for the trunk if your provider supports it.
• If nobody calls abroad, block international dialling in the outbound routes, and ask the carrier to disable it too.
• Keep outbound routes out of any context reachable by inbound calls, which is Asterisk's first rule of dialplan security.
• Read the call reports regularly; unexpected destinations show up there first.

Sangoma also lists TLS and SRTP for signalling and media, Fail2ban through Intrusion Detection, and an HTTPS-only admin interface.

Updates, backups, and when not to host it

OS packages update with apt update and apt upgrade; FreePBX modules update separately in Module Admin or with fwconsole. Sangoma warns that the final fwconsole restart drops most calls, so do it out of hours. Backups go through the Backup and Restore module, which is also Sangoma's supported route between major versions; copy them off the machine.

A hosted PBX is the wrong choice when the phones depend on analogue or ISDN lines through a telephony card, which has to sit where the lines are, or when the office's own internet connection is the weak point. A Cloud VPS can carry a handful of extensions, with the caveat that its processor time is shared rather than reserved.