FreePBX vs Asterisk in 2026: Which One Do You Need (and chan_sip vs PJSIP)

FreePBX vs Asterisk is not really a contest between two phone systems. Asterisk is the engine: it registers the phones, connects the calls, runs voicemail and follows a dialplan written in text files. FreePBX is a web interface and module collection from Sangoma that sits on top of Asterisk and writes those files for you. If you want extensions, ring groups and a "press 1 for sales" menu built from a browser, run FreePBX 17 on Debian 12. If you prefer text files, want the smallest server or are building your own voice application, run plain Asterisk 22. Either way, connect phones with PJSIP, because chan_sip is gone from current Asterisk.

We installed both on 12 October 2026 on an RS Computers lab VPS in Amsterdam and measured memory, disk and open ports. Step-by-step installation lives in our Asterisk and FreePBX install guide; this article is the comparison.

Key facts, checked on 13 October 2026:

• Asterisk 22 is the current long-term support (LTS) branch: full support until 16 October 2028, security fixes until 16 October 2029 (Asterisk versions page). Asterisk 24 LTS is scheduled for 15 October 2026 and reached its second release candidate on 8 October.
• chan_sip was removed in Asterisk 21.0.0 on 18 October 2023. Asterisk 20, the last LTS that has it, drops to security fixes on 19 October 2026 and reaches end of life on 19 October 2027.
• FreePBX 17 installs only on Debian 12 (amd64), works with Asterisk 18 to 23 and reaches end of life on 30 June 2028. FreePBX 18 for Debian 13 is planned, with a beta scheduled for 1 November 2026 (Sangoma's version table).
• In our lab, plain Asterisk 22.11.0 used 88 MB of RAM idle and 108 MB with 100 simultaneous calls. A fresh FreePBX 17 used 1,168 MB idle, added 6.1 GB of disk and took just under 20 minutes to install.

FreePBX or plain Asterisk: the decision table

Measured on our lab server: plain Asterisk in a Debian 13 container with 2 vCPU and 2 GB of RAM, FreePBX in a Debian 12 virtual machine with 2 vCPU and 3 GB.

In short, FreePBX costs about a gigabyte of RAM and a bigger attack surface, and in return a non-specialist can run the phones. A small office should take FreePBX; a developer building calls into an application, or an admin who keeps configuration in Git, should take Asterisk alone.

What Asterisk does on its own

A PBX (private branch exchange) is an office switchboard: it gives each desk an extension and shares the outside lines. Asterisk is a PBX engine with no screens. pjsip.conf defines phones and SIP trunks (your provider's link to the phone network), and extensions.conf holds the dialplan, the rules for each dialled number. Programs drive it through AMI (the Asterisk Manager Interface) and ARI (the Asterisk REST Interface).

Debian 13 does not package Asterisk:

# as root
apt-get update
apt-cache policy asterisk

The answer was Candidate: (none), so we built Asterisk 22.11.0 (27 August 2026) from source as in path B of our install guide: six minutes on 2 vCPU.

Two phones and a dialplan

PJSIP describes each phone with three sections sharing one name: an endpoint (how its calls behave), an auth (username and password) and an aor, or address of record (where it can be reached right now). A template marked (!) holds the shared settings. This is the file we tested:

; /etc/asterisk/pjsip.conf (edit as root)
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060

[phone](!)
type=endpoint
context=from-internal
disallow=all
allow=alaw,ulaw
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes

[101](phone)
auth=101
aors=101
mailboxes=101@default

[101]
type=auth
auth_type=userpass
username=101
password=PASTE_A_LONG_RANDOM_SECRET

[101]
type=aor
max_contacts=1
remove_existing=yes
qualify_frequency=60

Extension 102 repeats the three sections with 102. The dialplan lets the desks call each other, sends unanswered calls to voicemail after 20 seconds and adds an echo test on 600; the mailboxes go in voicemail.conf as lines such as 101 => 4821,Desk 101.

; /etc/asterisk/extensions.conf (edit as root)
[from-internal]
exten => _1XX,1,Dial(PJSIP/${EXTEN},20)
 same => n,VoiceMail(${EXTEN}@default,u)
 same => n,Hangup()
exten => 600,1,Answer()
 same => n,Echo()
 same => n,Hangup()

We registered two baresip softphones, run by a normal user in a second container, and listed the endpoints with asterisk -rx "pjsip show endpoints":

# what we saw for 101 (102 looked the same)
 Endpoint:  101                                                  Not in use    0 of inf
     InAuth:  101/101
        Aor:  101                                                1
      Contact:  101/sip:101-0x55e4f8b82180@10.141.188.77:5 e72a1b78a0 Avail         0.585

Avail and a round-trip time mean the phone answers the OPTIONS pings that qualify_frequency=60 sends every minute. A call from 101 to 102 carried G.711 audio both ways with no packets lost (pjsip show channelstats), the echo test returned every packet, and a call to 102 while it was off went to voicemail.

How much load the engine takes

SIPp, a SIP load generator, then placed authenticated G.711 calls into the echo test, each playing recorded audio for about a minute:

All 150 calls completed. Treat this as a floor: a real call to a provider is two bridged channels, and recording or transcoding (converting between codecs such as G.711 and Opus) costs far more CPU than passing audio through.

What FreePBX adds, and what it costs

FreePBX is a PHP web application that turns forms into Asterisk configuration: IVR menus, ring groups, queues, office-hours rules, call recording, a user portal and a firewall module. Sangoma makes FreePBX, and since buying Digium, Asterisk's sponsor, in September 2018 it sponsors Asterisk as well.

We read Sangoma's install script (version 1.15) before running it in a Debian 12 virtual machine. It refuses anything but Debian 12 on amd64, blocks upgrades to Debian 13 and installs Apache, MariaDB, PHP 8.2, Node.js, Redis, Postfix, fail2ban, HAProxy and a TFTP server before Asterisk 22 and FreePBX. The run took 19 minutes 52 seconds, eight of them upgrading modules, and left 921 Debian packages and 27 running services. Then we checked it:

# as root, on the FreePBX server
asterisk -rx "core show version"
curl -s -o /dev/null -w "%{http_code}\n" http://localhost/admin/config.php
fwconsole ma list

Asterisk reported 22.11.0 from Sangoma's package, built on 31 August 2026. The admin page answered 200 with the Initial Setup form. The module list showed 113 modules: 77 under GPL or AGPL licences and 35 marked Commercial, among them sysadmin, endpoint and pbxmfa.

Commercial modules and activation

The open-source core, with extensions, IVRs, ring groups and queues, costs nothing. Commercial modules are bought in the Sangoma Portal and licensed to one PBX, a "deployment" (Sangoma's guide); our install ended with a notice that it was not activated. The script's --opensourceonly option skips commercial modules but also removes the firewall module, which depends on the commercial System Admin module.

Unused modules still count. CVE-2025-57819, rated 10.0, gave unauthenticated access to the FreePBX administrator through the commercial endpoint module, and Sangoma's advisory says attackers were exploiting it on or before 21 August 2025. That module was enabled in our lab without activation, so update every module.

Memory and open ports

Idle after 25 minutes, free -m showed 1,168 MB in use: MariaDB 289 MB, Node.js 256 MB, Apache 230 MB, Asterisk 100 MB, the PM2 process manager 76 MB. The web stack, not Asterisk, takes the memory.

Until you finish Initial Setup and enable the firewall, the iptables policy is ACCEPT and the server listens on 80 and 443, on 8001, 8003, 6082 and 6083 for Node.js, and on 5060 (SIP), 4569 (IAX2), 4520 (DUNDi), 5000 (Unistim), 1720 (H.323), 69 (TFTP) and 5353 (mDNS). Whoever opens the admin page first creates the administrator, so do step A4 of our install guide in the same sitting.

chan_sip vs PJSIP: what changed and how to migrate

A channel driver is the part of Asterisk that speaks one protocol. chan_sip was the original SIP driver, configured in sip.conf. chan_pjsip arrived in Asterisk 12 in 2013, built on the open-source PJSIP library. The project deprecated chan_sip in Asterisk 17 and deleted it in 21; our Asterisk 22 build had nine channel drivers, none of them chan_sip.

Migrating an old sip.conf

FreePBX has no in-place upgrade from 16 to 17. Sangoma's upgrade page has you restore a backup of the old system onto a fresh FreePBX 17; on Asterisk 21 or later the restore offers to convert chan_sip extensions and trunks to PJSIP, which Sangoma recommends.

Plain Asterisk ships a converter, sip_to_pjsip.py (migration page). We fed it an old sip.conf with one phone and one trunk. Run it in a scratch folder with copies of sip.conf and its included files: it writes pjsip.conf into the current folder, so in /etc/asterisk it would overwrite your live file.

# as root, with a copy of the old sip.conf in /root/convert
cd /root/convert
python3 /usr/src/asterisk-22.*/contrib/scripts/sip_to_pjsip/sip_to_pjsip.py

Use python3 as shown: started directly, the script failed on Debian 13 with env: 'python': No such file or directory. It printed Writing pjsip.conf, and the output needed three fixes:

• The trunk's login came out as username = provider, the section name, instead of the account number; the defaultuser line was listed under "Non mapped elements".
• qualify=yes was not converted, so add qualify_frequency = 60 to each phone's aor.
• The file defines its own [transport-udp]; delete it if you already have one.

After those edits, asterisk -rx "module reload res_pjsip.so" loaded the converted phone and trunk. Read every converted line before it goes live.

The alternatives, one paragraph each

FusionPBX on FreeSWITCH

FusionPBX is a multi-tenant web interface for FreeSWITCH, a different engine, so one server can host many companies under their own domains. Version 5.6.5 came out on 21 September 2026 under the Mozilla Public License 1.1. Its Debian installer compiles FreeSWITCH 1.11 from source, which avoids the SignalWire access token that FreeSWITCH's binary packages require (packaging notes). Asterisk dialplan skills do not carry over.

Issabel and Elastix

Elastix, a CentOS distribution bundling Asterisk and FreePBX, was the old answer to "FreePBX or Elastix". 3CX took it over in December 2016 and made Elastix 5 a 3CX product. The community fork Issabel released Issabel 5 on 30 April 2024 with Asterisk 16 or 18, both now past end of life, then ended sales of on-premise servers and appliances on 28 October 2025 to focus on cloud services. For a new self-hosted server, the answer is FreePBX.

3CX

3CX is proprietary and does not use Asterisk. Its pricing page (updated 7 August 2026) charges a yearly fee per system based on simultaneous calls, with no per-user price, across Basic, Pro and AI editions plus a free tier. Self-hosting means 3CX's own Debian 12 image; its install guide asks for one dedicated CPU or two vCPU and 2 GB of RAM, supports KVM 2.8 and later, and tells you not to install other packages.

Wazo Platform

Wazo Platform is an open-source (GPLv3) communications platform built on Asterisk for developers who want REST APIs rather than a PBX screen. Release 26.10 came out on 12 October 2026 with Asterisk 22.11.0. It installs on Debian 12 with Ansible, and its documentation asks for 2 CPUs, 4 GiB of RAM and 50 GiB of storage for about 50 users.

Security basics for a VoIP VPS

A PBX on a public address is found by SIP scanners quickly, and the prize is toll fraud: calls to premium-rate numbers placed through your trunk and billed to you. Telecom fraud cost the industry $41.82 billion in 2025, the CFCA figure quoted by TNS in January 2026. Harden SSH with our Debian 13 security guide, then apply these steps, tested on plain Asterisk.

1. Unload what you do not use

The sample configuration opened UDP 4569 (IAX2, Asterisk-to-Asterisk trunking), 4520 (DUNDi, number lookup) and 5000 (Unistim, old Nortel phones). The sample modules.conf has one [modules] section, so appending works:

# as root
cat >> /etc/asterisk/modules.conf <<'EOF'
noload = chan_iax2.so
noload = pbx_dundi.so
noload = chan_unistim.so
EOF
systemctl restart asterisk
ss -ulpn | grep asterisk

Afterwards 5060 was the only fixed port, next to two random high ports Asterisk keeps for itself.

2. Firewall SIP to the addresses that need it

SIP uses UDP 5060, or TCP 5061 with TLS; audio (RTP) uses UDP 10000 to 20000 in Asterisk's sample rtp.conf. Allow SSH before enabling the firewall, and repeat the 5060 rule for your provider's addresses:

# as root
apt-get install -y ufw fail2ban
ufw allow 22/tcp
ufw allow from OFFICE_IP to any port 5060 proto udp
ufw allow 10000:20000/udp
ufw --force enable
ufw status verbose

3. Ban password guessers with fail2ban

Debian's built-in [asterisk] jail reads /var/log/asterisk/messages and allows 10 failures, but a source-built Asterisk writes messages.log. Enable the security log, then create the jail:

# as root
sed -i 's/^;security.log => security/security.log => security/' /etc/asterisk/logger.conf
asterisk -rx "logger reload"

# /etc/fail2ban/jail.d/asterisk.local (create as root)
[asterisk]
enabled  = true
backend  = auto
logpath  = /var/log/asterisk/messages.log
           /var/log/asterisk/security.log
maxretry = 5
bantime  = 1h

Run systemctl restart fail2ban and fail2ban-client status asterisk; both logs appear under File list. Six wrong-password registrations from our second container got that address banned within seconds, along with both lab phones behind it. In an office, put the office IP on an ignoreip line.

4. Encrypt signalling and audio with TLS and SRTP

TLS encrypts SIP signalling on TCP 5061; SRTP encrypts the audio. With SDES, the usual SRTP method for desk phones, the audio keys travel inside the SIP messages, so SRTP protects you only together with TLS. We tested with a self-signed certificate for the lab name pbx.lab.test. Put your PBX's host name in place of pbx.example.com, and in production use a certificate from a real authority:

# as root
mkdir -p /etc/asterisk/keys
openssl req -x509 -newkey rsa:2048 -nodes -days 365 -subj "/CN=pbx.example.com" -addext "subjectAltName=DNS:pbx.example.com" -keyout /etc/asterisk/keys/pbx.key -out /etc/asterisk/keys/pbx.crt
chown -R asterisk:asterisk /etc/asterisk/keys
chmod 600 /etc/asterisk/keys/pbx.key

; add to /etc/asterisk/pjsip.conf (as root)
[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
cert_file=/etc/asterisk/keys/pbx.crt
priv_key_file=/etc/asterisk/keys/pbx.key
method=tlsv1_2

; and inside each endpoint that must encrypt audio, e.g. [102](phone):
media_encryption=sdes

# as root
ufw allow from OFFICE_IP to any port 5061 proto tcp
systemctl restart asterisk
asterisk -rx "pjsip show transports"

The softphone registered over TLS ({0/TLS/v4} 200 OK), and a call from plain 101 to encrypted 102 reported SRTP is Enabled (cryptosuite=AES_CM_128_HMAC_SHA1_80) with no packets lost. Check that each phone model supports SRTP before you require it.

5. Strong secrets and dialling limits

Generate every SIP password with openssl rand -base64 24 (32 random characters); never reuse the extension number. Give phones a context that reaches only national and emergency numbers, keep trunk calls in a context that cannot dial out, and ask your provider for international barring and a daily spending cap. If floods rather than guessing are the problem, see our guide to spotting a DDoS attack on a Linux server.

Sizing a VPS for FreePBX or Asterisk

Plain Asterisk idled under 100 MB and carried 100 G.711 calls on a fraction of one vCPU, so your trunk's channel count usually runs out first. FreePBX needs more than 1.1 GB before the first phone registers, plus disk for recordings: 57.6 MB per hour of WAV, since 8,000 samples a second at 2 bytes each make 16 KB a second. Cisco puts a G.711 call at 87.2 kbps each way, so 100 calls need under 9 Mbit/s.

VPS plans share their vCPUs and VDS plans have dedicated ones, which matters when the processor transcodes audio. All run on KVM with NVMe, unmetered traffic and their own IPv4 and IPv6 address, in Amsterdam, Dublin and Prishtina; availability by city is on the plans page. Pick the city nearest your office and SIP provider; you can move to a bigger plan later with a short reboot. For voicemail by email, outbound port 25 is blocked on new servers, so relay through your mail provider on port 587 or ask us on Telegram to open it.

Frequently asked questions

Is FreePBX the same as Asterisk?

No. Asterisk is the open-source engine that registers phones and connects calls. FreePBX is a web interface and module collection that writes Asterisk's configuration and installs Asterisk with it. FreePBX cannot work without Asterisk, while Asterisk runs fine without FreePBX.

Can FreePBX 17 run on Debian 13?

No. The FreePBX 17 installer stops on anything but Debian 12 on amd64 and blocks upgrades to Debian 13. Sangoma plans FreePBX 18 for Debian 13; its version table schedules a beta for 1 November 2026 and general availability for 1 January 2027.

Is chan_sip still supported?

Only on old branches. chan_sip was removed in Asterisk 21 in October 2023. Asterisk 20, the last long-term release that includes it, gets only security fixes from 19 October 2026 and reaches end of life on 19 October 2027, so move phones and trunks to PJSIP now.

How much RAM does FreePBX need?

In our test, a fresh FreePBX 17 on Debian 12 used 1,168 MB of RAM with no calls, mostly for MariaDB, Node.js and Apache. Plan for at least 2 GB, and 4 GB if you record calls or run queues. Plain Asterisk 22 used under 100 MB.

Is FreePBX free?

The core is open source and free, including extensions, IVRs, ring groups and queues. In our lab install, 35 of the 113 modules were commercial Sangoma modules, licensed per PBX through the Sangoma Portal.

What happened to Elastix?

3CX took over Elastix in December 2016 and turned Elastix 5 into a 3CX product. The open-source fork, Issabel, ended sales of on-premise servers and appliances on 28 October 2025 to focus on cloud services. For a self-hosted Asterisk PBX in 2026, FreePBX is the maintained choice.

Pick the engine first, then the server

For a phone system managed from a browser, install FreePBX 17 on Debian 12 with at least 2 GB of RAM. For a lean engine or your own voice application, build Asterisk 22 and keep it in text files. Use PJSIP either way, unload what you do not use, and put a firewall and fail2ban in front of port 5060 before the first phone registers. Choose a server on the VPS plans page, or message us on Telegram if you would like us to quote the setup.

← All articles