Install and Configure 3CX PBX on Debian 12

3CX is a software-based PBX (Private Branch Exchange) that replaces traditional hardware phone systems with a VoIP solution you host yourself. It supports SIP trunks, WebRTC, video conferencing, and mobile clients out of the box. As of current releases, 3CX officially supports Debian 12 as the Linux deployment platform. This guide covers installing 3CX on Debian 12, configuring SIP trunks, creating extensions, and setting up softphones.

What Is 3CX PBX

3CX is a unified communications system that handles voice calls, video meetings, live chat, and messaging through a single platform. It runs as a Linux service, managed entirely through a web-based console. The free tier supports up to 10 users, making it practical for small businesses and home labs. Paid licenses scale to enterprise deployments with call center features, CRM integration, and advanced call routing.

System Requirements

Before installing 3CX, confirm your Debian 12 server meets these minimum requirements:

• OS: Debian 12 (Bookworm) – fresh minimal installation recommended
• CPU: 2 cores minimum (4 cores for 15+ simultaneous calls)
• RAM: 2 GB minimum (4 GB recommended for production)
• Disk: 30 GB minimum (more if recording calls)
• Network: Static IP address, reliable internet connection for SIP trunking
• DNS: A fully qualified domain name pointing to the server (required for HTTPS)

3CX should be installed on a dedicated server – do not run other web applications on the same machine as it manages its own Nginx reverse proxy.

Download and Run the 3CX Installer

3CX provides a single-command installer that handles all dependencies. Start by updating the system:

sudo apt update && sudo apt upgrade -y

Download and add the 3CX repository key:

wget -O- https://downloads-global.3cx.com/downloads/3cxpbx/public.key | sudo gpg --dearmor -o /usr/share/keyrings/3cx-archive-keyring.gpg

Add the 3CX repository:

echo "deb [signed-by=/usr/share/keyrings/3cx-archive-keyring.gpg] http://downloads-global.3cx.com/downloads/3cxpbx/ /" | sudo tee /etc/apt/sources.list.d/3cx.list

Update the package list and install 3CX:

sudo apt update
sudo apt install -y 3cxpbx

The installer runs an interactive setup wizard in the terminal. It asks for your 3CX license key (or lets you start a free trial), preferred ports, and the FQDN for the web console.

Verify the service is running after installation:

sudo systemctl status 3CXPhoneSystem

You should see “active (running)” in the output.

Access the Web Management Console

Once the installation completes, the wizard provides a URL for the web management console. It follows this pattern:

https://your-fqdn:5001

Open this URL in a browser. You will be prompted to create an admin account on first access. Complete the initial configuration wizard, which walks you through:

• Setting the admin password
• Choosing your country and time zone
• Selecting extension digit length (3 or 4 digits)
• Configuring the operator extension

Verify you can log in and see the dashboard before proceeding.

Configure SIP Trunks

SIP trunks connect your 3CX PBX to the public telephone network through a VoIP provider. To add a trunk:

Navigate to Admin – SIP Trunks in the web console. Click “Add SIP Trunk”. 3CX includes pre-configured templates for major providers (Twilio, Vonage, VoIP.ms, and many regional carriers). Select your provider from the list.

Fill in the credentials from your VoIP provider:

• Trunk Name: A descriptive label (e.g., “Twilio-Main”)
• Registrar/Server: The SIP server address from your provider
• Authentication ID: Your SIP username
• Authentication Password: Your SIP password
• Main Trunk Number: Your DID (phone number)

Save the configuration. The trunk status should show “Registered” within a few seconds. If it does not register, check your credentials and ensure UDP port 5060 (or the configured SIP port) is open.

Configure inbound rules under Admin – Inbound Rules to route incoming calls on this trunk to specific extensions or ring groups.

Create Extensions

Extensions represent individual users or devices. Navigate to Admin – Users and click “Add”. Fill in:

• Extension number: e.g., 100, 101, 102
• First and Last name: The user’s name
• Email: Used for voicemail notifications and welcome email
• Mobile number: Optional, for forwarding rules

3CX sends a welcome email containing provisioning details (QR code and credentials) that users scan with the 3CX mobile or desktop app. Save the extension and verify it appears in the users list.

To create multiple extensions quickly, use the “Import” feature with a CSV file containing names, extensions, and email addresses.

Softphone Setup

3CX offers its own softphone clients for Windows, macOS, Linux (web client), iOS, and Android. These are the easiest to set up because they auto-configure via provisioning.

3CX App (recommended): Download the 3CX app from the relevant app store or the 3CX website. Open the welcome email on the device, click the provisioning link or scan the QR code, and the app configures itself automatically.

Third-party SIP phones: If you prefer a different softphone (Zoiper, Linphone, MicroSIP), configure it manually with these settings from the extension details page in the admin console:

• SIP Server: your 3CX FQDN
• SIP Port: 5060 (or your configured port)
• Username: the extension number
• Password: the SIP authentication password (found in extension settings)

After configuring the softphone, make a test call between two extensions to verify audio works in both directions.

Firewall Configuration

3CX requires several ports open for proper operation. Configure your firewall (and any upstream router/cloud security group) to allow:

# SIP signaling
5060 TCP/UDP
5061 TCP (SIP TLS)

# HTTPS web console and web client
443 TCP
5001 TCP

# RTP media (voice/video)
9000-10999 UDP

# 3CX tunnel protocol (remote phones)
5090 TCP/UDP

If you use ufw on Debian 12:

sudo ufw allow 5060/udp
sudo ufw allow 5060/tcp
sudo ufw allow 5061/tcp
sudo ufw allow 443/tcp
sudo ufw allow 5001/tcp
sudo ufw allow 9000:10999/udp
sudo ufw allow 5090/tcp
sudo ufw allow 5090/udp
sudo ufw reload

Verify the rules are active:

sudo ufw status verbose

You can also use the 3CX Firewall Checker tool (accessible from the admin console under Dashboard – Firewall) to test that all required ports are reachable from the internet.

Post-Installation Verification

Run through this checklist to confirm everything is working:

1. Web console is accessible over HTTPS
2. SIP trunk status shows “Registered”
3. At least two extensions are created and provisioned
4. Internal call between two extensions works (audio both ways)
5. Outbound call through the SIP trunk connects to an external number
6. Inbound call to your DID rings the correct extension
7. Firewall checker shows all ports green

Wrapping Up

3CX on Debian 12 gives you a production-grade PBX system without proprietary hardware. The web-based management console handles trunk configuration, extension provisioning, and call routing without touching config files. Once the base installation is working, explore ring groups for team-based call handling, digital receptionists (IVR) for automated call routing, and call recording for compliance requirements.