Asterisk vs FreePBX for a Small Office Phone System on Your Own VPS

Asterisk vs FreePBX is less of a contest than it looks. Asterisk is the engine: it registers the phones, connects the calls, plays the "press 1 for sales" menu and stores voicemail. FreePBX is a web interface that writes Asterisk's configuration for you, and its installer sets up Asterisk at the same time. For a small office that wants extensions, a greeting menu and voicemail in the inbox without learning a configuration language, run FreePBX. Choose plain Asterisk only if you would rather keep the phone system in text files and never open a web page.

The job usually arrives like this: fourteen people, one main number, two colleagues working from home and an old box in the cupboard that nobody dares to reboot. This guide replaces the box.

Five things first:

• FreePBX 17's official installer runs only on Debian 12 (amd64) and brings Asterisk 22 LTS with it. Both FreePBX 17 and Debian 12 are supported until June 30, 2028.
• On Debian 13 or Ubuntu, build plain Asterisk 22 LTS from source instead.
• A G.711 call needs 87.2 kbps each way. Distance matters more, so host the PBX near the office and the SIP provider.
• Toll fraud is the real risk: SIP only from known IPs, admin pages off the internet, international calls off.
• An old FreePBX 16 box has had security fixes only since September 1, 2026, and loses support on January 1, 2027, at the latest.

Asterisk vs FreePBX: what is actually different?

A PBX (private branch exchange) is the office switchboard: it gives every desk an extension and shares the outside lines. Asterisk, developed mainly by Sangoma, which also owns FreePBX, reads text files in /etc/asterisk: pjsip.conf for phones and trunks, extensions.conf for the dialplan, the rules for each dialled number. FreePBX turns those files into web forms and regenerates them on every Apply Config, so your own edits go in the *_custom.conf files.

Build on Asterisk 22, the long-term support (LTS) branch: four years of full support from October 2024 plus a fifth year of security fixes, according to the Asterisk versions page. FreePBX 17 has installed it by default since January 2025. The next LTS branch, Asterisk 24, has been at the release-candidate stage since September 17, 2026, but Sangoma lists only Asterisk 18 to 23 for FreePBX 17, and on plain Asterisk a new branch deserves a few point releases before it carries an office's calls. Ignore tutorials built on sip.conf: chan_sip was removed in Asterisk 21, and everything current uses PJSIP.

For most offices the choice ends with FreePBX, unless you want every change to the phone system reviewed like code, or you are building something custom on Asterisk's programming interfaces. The open-source edition has no per-seat fee.

Why put a small office PBX on a VPS?

A PBX in the cupboard sits behind the office router, and behind carrier-grade NAT (CGNAT), where the internet provider shares one public address among many customers, incoming audio often cannot reach it at all. The usual fix in FreePBX forum threads is a server with a public IP. A VPS has one: phones register to it wherever they are, and when the office line fails, the PBX still answers and takes voicemail.

The box in the cupboard may also be running out of time. If it runs FreePBX 16, Sangoma's version table moved it to security fixes only on September 1, 2026, and ends support on January 1, 2027, possibly sooner; its SNG7 operating system, built on CentOS 7, has been out of support since June 30, 2024. There is no in-place upgrade to FreePBX 17: the supported path is a backup of the old system restored onto a fresh install, which offers to convert old chan_sip extensions and trunks to PJSIP on the way. A new server is the natural moment to do it.

Hosted services are licensed per user: Microsoft Teams Phone is an add-on that needs a calling plan or connector for outside calls, and Google Voice Starter stops at ten users. Self-hosting has no per-seat licence, but patching and fraud control become your job. If nobody will install a security update within days, buy hosted.

How much bandwidth and latency does VoIP need?

VoIP (voice over IP) sends calls as a stream of small packets over the internet, so delay matters more than raw speed. Latency, for voice, means one-way mouth-to-ear delay. ITU-T Recommendation G.114 calls delay below 150 ms essentially transparent for most applications and treats 400 ms as the upper limit for network planning; routes within one region, up to about 5,000 km, are likely to stay under 150 ms. The phones spend part of that themselves: Cisco puts G.729's coding delay at about 18 ms and a typical jitter buffer at 40 to 45 ms.

Every call also passes through the PBX, even between two desks in the same room, so the server belongs near the office and near the provider's SIP servers. Once it exists, run mtr -rwc 100 SERVER_IP from an office Linux machine (install the mtr-tiny package first), sudo mtr -rwc 100 SERVER_IP on a Mac after brew install mtr, or pathping SERVER_IP on Windows, and halve the round-trip time. During a call, asterisk -rx 'pjsip show channelstats' shows packet loss and jitter, the variation in packet arrival time (RFC 3550); Cisco asks for loss far below 1 percent.

Bandwidth is the easy part. A codec compresses voice into packets, and according to Cisco's bandwidth note a G.711 call with 20 ms packets uses 87.2 kbps each way on Ethernet, G.729 31.2 kbps. Opus (RFC 6716) spans 6 to 510 kbit/s, and at the 16 to 20 kbit/s suggested for wideband speech our own calculation gives roughly 39 to 43 kbps with headers. Ten G.711 calls need about 0.9 Mbit/s each way on the office line and 1.7 Mbit/s at the server, which each outside call crosses twice. Stay with G.711 on the trunk; the alternatives come with conditions. Open-source Asterisk can pass G.729 through but not encode or decode it, so plain Asterisk needs Sangoma's per-call licence or an unofficial third-party module. FreePBX 17 includes Sangoma's G.729 module, but it works only once the system is activated, a free registration with Sangoma. Opus is a separate module that is off by default. Recordings in Asterisk's WAV format take about 57.6 MB per hour, wav49 about 5.9 MB.

Which VPS for FreePBX or Asterisk?

RS Computers has KVM servers in Amsterdam, Prishtina and Dublin. For a PBX the city matters more than the plan: take the one closest to your office and your SIP provider. For an office in Kosovo that is Prishtina, where local peering keeps the audio path short, as our article on hosting in Kosovo explains. Use a location the plans page shows as available. Every plan has NVMe storage, unmetered traffic on a 1 Gb/s port (VPS) or 10 Gb/s port (VDS), and its own IPv4 and IPv6 address; register the phones over IPv4, because the SIP transports in both setups below listen on IPv4 only. FreePBX needs Debian 12, so check that it is among the Linux distributions offered when you order, and ask us if it is missing. The whole server gets a free weekly backup you can restore from the client area, which is also where you move to a bigger plan when the office grows.

No official minimum exists for a single FreePBX 17 server; Sangoma's older page for high-availability clusters asks for 2 GB of memory and prefers 4 GB. On a test VDS on our platform with 8 vCPU and 16 GB of RAM, a fresh FreePBX 17 sat at about 750 MB of memory with no calls running; plain Asterisk 22 needed about 100 MB. The table is our guidance for 5 to 30 extensions.

VDS Medium and VDS Large are more than a phone system needs: with G.711 end to end, the trunk runs out of channels long before the processor does.

Which ports does a PBX need?

SIP (Session Initiation Protocol, RFC 3261) sets up calls on port 5060 over UDP or TCP and 5061 over TLS. The audio travels as RTP (Real-time Transport Protocol) on UDP 10000 to 20000 in FreePBX and Asterisk's sample rtp.conf, or 5000 to 31000 when that file is missing. Open 5060 but forget the RTP range and calls connect in silence.

Path A: install FreePBX 17 on Debian 12

The FreePBX 17 installer refuses Debian 13 and every Ubuntu release; Sangoma keeps FreePBX 17 on Debian 12 and leaves Debian 13 to FreePBX 18. Use Debian 12 on amd64. Its regular support ended on July 12, 2026, when Debian handed bookworm to its LTS team, and security updates keep coming through the same repository until June 30, 2028, the day FreePBX 17 itself reaches end of life. Log in as root, or run sudo -i from a normal user; our Linux practice lab guide covers SSH basics.

A1. Check the system

The installer checks three things before anything else: the Debian release, the architecture and the full host name. Check them yourself first.

# as root
grep VERSION_CODENAME /etc/os-release
dpkg --print-architecture
hostname -f

You want VERSION_CODENAME=bookworm, amd64 and a name such as pbx.example.com. If you see trixie or Ubuntu, the installer would stop with "Unsupported OS version": reinstall with Debian 12 or take path B. If hostname -f prints nothing, run hostnamectl set-hostname pbx.YOUR_DOMAIN and add the name to /etc/hosts.

A2. Download and run the installer

Update Debian, then download and run Sangoma's script from the official FreePBX repository. Sangoma's FreePBX 17 installation guide says the script may take around 30 minutes or more.

# as root
apt update && apt -y upgrade
cd /tmp && wget https://github.com/FreePBX/sng_freepbx_debian_install/raw/master/sng_freepbx_debian_install.sh -O /tmp/sng_freepbx_debian_install.sh
bash /tmp/sng_freepbx_debian_install.sh

Success shows FreePBX 17 Installation finished successfully., a short validation summary and a table of the server's IP addresses. The box saying the machine is not activated concerns commercial modules and Sangoma's G.729 codec; if you stay on G.711, it needs nothing from you. On the test server from the sizing section, the install took about 15 minutes, nearly half of it spent upgrading FreePBX modules. On failure the script prints the last 10 lines of its log; tail -f /var/log/pbx/freepbx17-install-*.log in a second session follows it live. Keep the APT sources on bookworm, never stable or trixie, and skip --opensourceonly unless you will build your own firewall: it removes the Firewall module.

A3. Check that it runs

Three quick checks: the Asterisk version, the Apache, fail2ban and FreePBX services, and the module list.

# as root
asterisk -rx 'core show version'
systemctl is-active apache2 fail2ban freepbx
fwconsole ma list

Expect a line starting Asterisk 22., then active three times, then modules marked Enabled.

A4. Claim the admin account and switch on the firewall

Do this step in the same sitting as the install. Until the firewall is on, the Initial Setup page and the SIP port answer anyone, and whoever opens that page first creates the admin account. Scanners do not wait: on a fresh test server we booted, the first SSH password guess arrived less than six minutes after boot. Open http://SERVER_IP/, complete Initial Setup and leave automatic security updates on. Then trust your office's public IP so the firewall cannot lock you out.

# as root
fwconsole firewall trust OFFICE_IP
fwconsole firewall list trusted

The list shows your office IP. Then, in the web interface:

1. Connectivity > Firewall: Enable Firewall.
2. Interfaces tab: move the public interface from Trusted to Internet. FreePBX flags one left in Trusted as a critical misconfiguration.
3. Services tab: keep SSH, Web Management, UCP, HTTP provisioning and REST closed to all but Trusted.
4. Settings > Asterisk SIP Settings: Detect Network Settings, keep RTP at 10000 to 20000 and "Allow Anonymous Inbound SIP Calls" at No. Submit, Apply Config, then fwconsole restart.

Path B: build Asterisk 22 LTS on Debian 13

Asterisk has no official package repository and Debian 13 ships no Asterisk package. Ubuntu keeps one in its community-maintained universe section, but it lags: 20.6.0 on 24.04, untouched since April 2024, and 22.5.2 on Ubuntu 26.04, unchanged since that release came out in April 2026. So build from source, the official method; in early October 2026 the download below fetches 22.11.0. On Ubuntu 24.04 or 26.04 the steps are identical after sudo -i.

B1. Tools, source and dependencies

This block installs the tools, downloads the newest Asterisk 22 and installs its build dependencies.

# as root
apt update && apt -y full-upgrade
apt -y install wget ca-certificates libsystemd-dev nano ufw fail2ban
cd /usr/src
wget https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-22-current.tar.gz
tar xzf asterisk-22-current.tar.gz
cd asterisk-22.*/
./contrib/scripts/install_prereq install

It asks no questions and ends with install completed successfully inside a box of # signs. Stay in this folder for B2.

B2. Build and install

This block compiles Asterisk on every vCPU, installs it with sample configuration and log rotation, and enables the security log for fail2ban.

# as root
./configure
make -j$(nproc)
make install
make samples
make install-logrotate
ldconfig
sed -i 's/^;security.log => security/security.log => security/' /etc/asterisk/logger.conf

Look for boxes headed Asterisk Build Complete and Asterisk Installation Complete, and fix any error before the next line. The build downloads PJSIP, so it needs internet access; run make samples on a fresh server only.

B3. A user for Asterisk, then the firewall

Asterisk should not run as root. Create its own user, then open SSH, SIP from the office and the provider, and the audio range, and only then switch ufw on.

# as root
adduser --system --group --home /var/lib/asterisk --no-create-home asterisk
chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/log/asterisk /var/spool/asterisk
sed -i 's/^;runuser = asterisk/runuser = asterisk/; s/^;rungroup = asterisk/rungroup = asterisk/' /etc/asterisk/asterisk.conf
ufw allow 22/tcp
ufw allow from OFFICE_IP to any port 5060 proto udp
ufw allow from PROVIDER_SIGNALLING_RANGE to any port 5060 proto udp
ufw allow 10000:20000/udp
ufw --force enable
ufw status verbose

Expect Status: active and your rules, with (v6) copies for SSH and RTP.

B4. Phones and dialplan

Move the two sample files you are about to replace out of the way and generate a random secret; run the last line once per phone.

# as root
cd /etc/asterisk
mv pjsip.conf pjsip.conf.sample-orig
mv extensions.conf extensions.conf.sample-orig
openssl rand -base64 24

It prints a 32-character string. Open nano /etc/asterisk/pjsip.conf and paste this, with your values in place of the capitals:

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060

[acl]
type=acl
deny=0.0.0.0/0.0.0.0
permit=OFFICE_IP/32
permit=PROVIDER_SIGNALLING_RANGE

[101]
type=endpoint
context=from-internal
disallow=all
allow=alaw,ulaw
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
auth=101
aors=101

[101]
type=auth
username=101
password=PASTE_A_SECRET_HERE

[101]
type=aor
max_contacts=1
remove_existing=yes
qualify_frequency=60

Below it, add the trunk as your provider's PJSIP example shows, naming the endpoint provider with context=from-provider. Then nano /etc/asterisk/extensions.conf gets the dialplan. Each context is a walled garden: phones may dial out, trunk calls only reach reception.

[from-internal]
exten => _1XX,1,Dial(PJSIP/${EXTEN},20)
 same => n,VoiceMail(${EXTEN}@default,u)
exten => 112,1,Dial(PJSIP/112@provider)
; national numbers only, no 00 or +; adapt to your country
exten => _0[1-9]XXXXXX.,1,Dial(PJSIP/${EXTEN}@provider,60)

[from-provider]
exten => _X.,1,Dial(PJSIP/101,20)
 same => n,VoiceMail(101@default,u)

Last, in /etc/asterisk/voicemail.conf, replace the example mailbox under [default] with 101 => YOUR_PIN,Reception,reception@YOUR_DOMAIN. Step B5 checks the result.

B5. Start Asterisk as a service

Asterisk's source tree ships a systemd unit. Install it, start Asterisk now and at every boot, and list the endpoints it loaded.

# as root
chown -R asterisk:asterisk /etc/asterisk
chmod 640 /etc/asterisk/pjsip.conf
cd /usr/src/asterisk-22.*/
cp contrib/systemd/asterisk.service /etc/systemd/system/asterisk.service
sed -i 's/^#RuntimeDirectory=asterisk/RuntimeDirectory=asterisk/' /etc/systemd/system/asterisk.service
systemctl daemon-reload && systemctl enable --now asterisk
systemctl is-active asterisk
asterisk -rx 'pjsip show endpoints'

You should see active, then endpoint 101 and your trunk. If the start times out, libsystemd-dev was missing at ./configure: install it and repeat B2 without make samples. Then, from the office network, point a softphone such as Zoiper at the server IP with 101 and its secret; asterisk -rx 'pjsip show contacts' should list it as Avail. The qualify_frequency line makes Asterisk check the phone every minute; without it the status stays NonQual.

B6. fail2ban for SIP

Create /etc/fail2ban/jail.d/asterisk.local with this jail; the ignore list keeps one phone with a stale password from banning the whole office. Keep the backend line: on Ubuntu 24.04 and 26.04, fail2ban otherwise reads the systemd journal, where Asterisk writes nothing, and would never ban anyone.

[asterisk]
enabled  = true
backend  = auto
logpath  = /var/log/asterisk/messages.log
           /var/log/asterisk/security.log
ignoreip = 127.0.0.1/8 ::1 OFFICE_IP

Restart fail2ban and check that the jail loaded.

# as root
systemctl restart fail2ban
fail2ban-client status asterisk

You get Status for the jail: asterisk, both log files under File list and Currently banned: 0. If you see "Have not found any log file for asterisk jail", compare the paths with ls /var/log/asterisk/.

How to stop toll fraud on a PBX

Toll fraud is someone else calling through your PBX, usually to international premium-rate numbers that pay them a share. It arrives as an overnight burst of calls to countries nobody in the office has ever rung, and the bill comes later. The CFCA's 2023 Global Fraud Loss Survey put telecom fraud losses at 2.5% of industry revenue, up 12% on 2021, with PBX fraud among the top methods.

The attacks are automated. SIPVicious, a free toolkit, finds SIP servers, lists their extensions and cracks passwords. CVE-2025-57819 gave unauthenticated access to the FreePBX administrator and led to code execution; Sangoma's advisory rated it 10.0, and it was exploited in the wild by August 21, 2025. In May 2026 Cyble described intruders dialling out over victims' own trunks with asterisk -rx channel originate, on servers that reinstalled the attackers' tools through six separate persistence channels, and cited Shadowserver's count of more than 900 compromised FreePBX systems in February 2026. So, without exceptions:

1. Never expose the admin pages. They answer trusted IPs only; from anywhere else, connect through a VPN first, such as the one in our WireGuard setup guide.
2. Allow SIP from the office and the provider's signalling addresses, nothing else. FreePBX's Responsive Firewall is for roaming phones only.
3. Give every extension and trunk its own long random secret. Never the extension number, never the unsecurepassword from Asterisk's Hello World example.
4. Keep international calling off: national and emergency patterns only, nothing starting with 00 or +, no premium-rate ranges. Ask the provider for international barring and a spending limit too.
5. Leave "Allow Anonymous Inbound SIP Calls" at No, and never let trunk calls reach a context that dials out.
6. Close AMI and Asterisk HTTP to the internet. In 2023 FreePBX warned that ARI passwords repeated across many installations were being abused through exposed ports 8088 and 8089 for traffic pumping. Since Asterisk 22.10.1, ARI applications can no longer call functions such as SHELL() or FILE() unless live_dangerously is switched on in asterisk.conf; leave it off.
7. Patch fast. On June 25, 2026, Asterisk 22.10.1 fixed 20 security advisories in one release. In May 2026 Sangoma closed CVE-2026-46376, a critical flaw: on systems where an admin had used the optional UCP template setup, a hard-coded password opened the User Control Panel, with voicemail and call records, to anyone. The userman module 17.0.7, which fwconsole ma upgradeall installs, randomises it.
8. If the server is ever compromised, rebuild it from scratch and change every secret, the trunk's included. Do not try to clean it.

Extensions, trunk, IVR and voicemail in FreePBX

The rest is form filling, quickest in this order:

1. Applications > Extensions: one chan_pjsip extension per desk.
2. Phones: a softphone (a phone app) or a desk phone registers with the server address, extension and secret. Provision desk phones from a trusted network only.
3. Connectivity > Trunks > Add SIP (chan_pjsip) Trunk. A SIP trunk is the provider's service linking your PBX to the public phone network.
4. Outbound Routes: national and emergency patterns only.
5. Admin > System Recordings for the greeting, Applications > IVR for the menu (interactive voice response), and a Time Condition for evenings.
6. Ring Groups ring several phones at once; Queues hold callers with music until someone is free.
7. Inbound Routes last, pointing your number at the time condition.

Voicemail to email is a per-extension setting, and delivery is what fails quietly. Outbound port 25 is blocked on a new RS Computers VPS until you ask on Telegram, and direct sending also needs a reverse DNS (PTR) record, set in the client area or through us on Telegram. Relaying through your existing mailbox's SMTP server on port 587 avoids both; our self-hosted mail server guide explains port 25 and PTR in detail. Plain Asterisk hands mail to /usr/sbin/sendmail, so it needs Postfix or msmtp-mta.

If you record calls, mind the law. Article 5 of the EU ePrivacy Directive bans recording calls without consent unless the law allows it, as in lawful business practice for evidence of a transaction. Recordings, voicemail and call records are personal data under the GDPR and Kosovo's Law No. 06/L-082, both with a 72-hour breach deadline. Announce recording, set a retention period and check your country's rules.

Fixing one-way audio and failed registrations

One-way audio means signalling works and audio does not: check the RTP range in the firewall, switch off SIP ALG on the office router, and give the PBX its public address (External Address and Local Networks, then fwconsole restart, in FreePBX). Calls dropping after about 32 seconds are a missing ACK, because RFC 3261's Timer H is 64 times the 500 ms T1; fix them the same way. Registration failures name their cause in the log: No matching endpoint found is a wrong username, Failed to authenticate a wrong password, Not match Endpoint ACL (on path B, did not pass ACL test) an IP not permitted. If every phone drops at once, suspect your own ban list: fail2ban-client unban OFFICE_IP lifts the ban from every jail, on FreePBX as well.

Keeping the PBX patched, backed up and watched

On FreePBX, one routine covers Debian 12 and every module; the last line confirms the pin that keeps Debian 13 out.

# as root
apt update && apt -y upgrade
fwconsole ma upgradeall
fwconsole reload
cat /etc/apt/preferences.d/99-block-trixie.pref

The last command shows trixie at priority -1. Schedule nightly backups under Admin > Backup & Restore with a remote storage target. On plain Asterisk, archive /etc/asterisk and /var/spool/asterisk nightly and copy them off the server, as in our off-site backup guide with restic; the free weekly server backup is the net underneath. To upgrade within Asterisk 22, rebuild from the new tarball without make samples, then run asterisk -rx 'core restart when convenient'.

Watch the PBX from somewhere else. The push check in our Uptime Kuma and Grafana guide, running on a second server, can wait for a cron job on the PBX that only fires while the trunk shows Registered. And read the call records weekly; calls to countries you never ring are the earliest warning you get.

Frequently asked questions

Is FreePBX the same as Asterisk?

No. Asterisk is the engine that handles calls; FreePBX is a web interface that configures it and installs it alongside. You can run Asterisk without FreePBX by writing its configuration files yourself.

Can FreePBX 17 run on Ubuntu or Debian 13?

Not officially. The installer accepts only Debian 12 on amd64. FreePBX 18 moves to Debian 13, but in early October 2026 Sangoma still lists it as planned, with no beta yet, so use Debian 12 for FreePBX or plain Asterisk 22 on Debian 13.

Can I keep my existing number when moving to a self-hosted PBX?

Usually, yes, but your SIP trunk or number provider ports it, not the PBX. EU rules require a ported number to work within one working day of the agreed date; elsewhere, Kosovo included, local rules apply, so ask the new provider before cancelling the old one.

Do self-hosted VoIP systems support emergency calls?

They can, if the trunk does. Whether a 112 call reaches the right emergency centre with your location depends on the provider and the country, so use a local provider's trunk for emergency calls and ask how it passes caller location.

Can RS Computers set up the phone system for us?

Yes. Message us on Telegram or email info@rscomputers-ks.com with the number of extensions, your SIP provider and where the office is, and we will suggest a plan and quote the setup.

Switching over without a bad Monday

Do not move the whole office at once. Connect a trunk with a spare number and run two or three phones on the new PBX for a week while the old system keeps the main number. Call in, call out, leave a voicemail and watch it arrive by email. Once the week has been boring, port the main number and move the other desks on a quiet afternoon.

That trial week needs a server first. On the VPS plans page, pick the city closest to your office and your provider. VPS Micro runs a small FreePBX; VPS Mini leaves room for queues and recordings.

← All articles