Asterisk is an open-source PBX (Private Branch Exchange) platform that handles SIP sessions, call routing, voicemail, IVR menus, and conference bridging. FreePBX provides a web-based management interface on top of Asterisk, making phone system administration accessible without constant CLI work.

This guide walks through a full production install of Asterisk with FreePBX on Debian 13 (Trixie) and Ubuntu 24.04 LTS. We cover compiling Asterisk from source, setting up Apache with PHP 8.3, MariaDB, Node.js, configuring SIP extensions, trunks, inbound/outbound routes, IVR, voicemail, firewall rules, fail2ban protection, and backup strategy.

Prerequisites

  • A server running Debian 13 or Ubuntu 24.04 LTS with at least 2 CPU cores and 2GB RAM
  • Root or sudo access to the server
  • A public IP address if connecting remote SIP phones or external trunks
  • Ports 5060 (SIP/UDP), 5061 (SIP TLS/TCP), and 10000-20000 (RTP/UDP) available
  • A registered domain name (optional but recommended for TLS and Let’s Encrypt)
  • DNS configured to point to your server IP

Step 1: Update System Packages

Start by updating all system packages to the latest versions. Reboot if the kernel was updated.

sudo apt update && sudo apt upgrade -y

Check if a reboot is required and reboot if needed.

[ -f /var/run/reboot-required ] && sudo reboot -f

Step 2: Install Asterisk Build Dependencies

Asterisk needs several development libraries and build tools to compile from source. Install them all in one pass.

sudo apt -y install git vim curl wget libnewt-dev libssl-dev libncurses5-dev \
  subversion libsqlite3-dev build-essential libjansson-dev libxml2-dev \
  uuid-dev libedit-dev libsrtp2-dev libspeexdsp-dev libopus-dev \
  pkg-config python3-dev autoconf libtool-bin unixodbc-dev

Verify that gcc and make are available.

gcc --version && make --version | head -1

Step 3: Download and Compile Asterisk from Source

Download the latest Asterisk 22 LTS release. Asterisk 22 is the current long-term support branch and pairs well with FreePBX 17.

cd /usr/src/
sudo wget https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-22-current.tar.gz

Extract the archive and enter the source directory.

sudo tar xvf asterisk-22-current.tar.gz
cd asterisk-22*/

Download the MP3 decoder library into the source tree. This enables MP3 playback for music on hold and other audio features.

sudo contrib/scripts/get_mp3_source.sh

Run the prerequisite installer script. It detects your OS and installs any missing development packages automatically.

sudo contrib/scripts/install_prereq install

When prompted, enter your country code (for example, 1 for US, 44 for UK, 254 for Kenya). At the end you should see:

#############################################
## install completed successfully
#############################################

Configure and Build Asterisk

Run the configure script to check build dependencies and prepare the build system.

sudo ./configure

A successful run ends with the Asterisk ASCII art and “Package configured for” message. Next, launch the module selection menu.

sudo make menuselect

Use arrow keys to navigate and Enter to toggle selections. Enable these modules:

  • Add-ons: select format_mp3
  • Core Sound Packages: select WAV, ALAW, ULAW, and G729 formats for EN sounds
  • Music On Hold: select WAV, ALAW, ULAW formats
  • Extra Sound Packages: select WAV, ALAW, ULAW formats for EN extra sounds

Click “Save and Exit” when done. Then compile Asterisk.

sudo make -j$(nproc)

The build takes 5 to 15 minutes depending on your hardware. You should see this at the end:

 +--------- Asterisk Build Complete ---------+
 + Asterisk has successfully been built, and +
 + can be installed by running:              +
 +                                           +
 +                make install               +
 +-------------------------------------------+

Install Asterisk binaries, sample configs, and startup scripts.

sudo make install
sudo make samples
sudo make config
sudo ldconfig

Step 4: Create Asterisk User and Start the Service

Running Asterisk as a dedicated non-root user is a security best practice. Create the asterisk user and group, then set ownership on all relevant directories.

sudo groupadd asterisk
sudo useradd -r -d /var/lib/asterisk -g asterisk asterisk
sudo usermod -aG audio,dialout asterisk
sudo chown -R asterisk:asterisk /etc/asterisk
sudo chown -R asterisk:asterisk /var/{lib,log,spool}/asterisk
sudo chown -R asterisk:asterisk /usr/lib/asterisk

Edit /etc/default/asterisk to set the runtime user.

sudo sed -i 's/#AST_USER="asterisk"/AST_USER="asterisk"/' /etc/default/asterisk
sudo sed -i 's/#AST_GROUP="asterisk"/AST_GROUP="asterisk"/' /etc/default/asterisk

Also update /etc/asterisk/asterisk.conf to match.

sudo sed -i 's/;runuser = asterisk/runuser = asterisk/' /etc/asterisk/asterisk.conf
sudo sed -i 's/;rungroup = asterisk/rungroup = asterisk/' /etc/asterisk/asterisk.conf

Enable and start the Asterisk service.

sudo systemctl enable asterisk
sudo systemctl start asterisk

Verify the service is running.

sudo systemctl status asterisk

You should see active (running) in the output. Test CLI connectivity to confirm Asterisk responds.

sudo asterisk -rvvv

You will see the Asterisk CLI prompt with the version banner. Type quit to exit the CLI.

Step 5: Install MariaDB Database Server

FreePBX stores its configuration, CDR records, and module data in MariaDB. Install and secure the database server.

sudo apt -y install mariadb-server mariadb-client
sudo systemctl enable mariadb
sudo systemctl start mariadb

Run the security hardening script. Set a root password, remove anonymous users, disable remote root login, and remove the test database.

sudo mysql_secure_installation

Answer Y to all prompts and set a strong root password. Verify MariaDB is running.

sudo systemctl status mariadb

Step 6: Install Apache Web Server

FreePBX needs a web server for its management interface. Install Apache and configure it to run as the asterisk user.

sudo apt -y install apache2

Back up the original Apache config, then change the user/group to asterisk and enable AllowOverride.

sudo cp /etc/apache2/apache2.conf /etc/apache2/apache2.conf_orig
sudo sed -i 's/^\(User\|Group\).*/\1 asterisk/' /etc/apache2/apache2.conf
sudo sed -i 's/AllowOverride None/AllowOverride All/' /etc/apache2/apache2.conf

Remove the default index page and disable the default site so FreePBX takes over.

sudo rm -f /var/www/html/index.html
sudo a2dissite 000-default.conf
sudo a2enmod rewrite

Restart Apache to apply changes.

sudo systemctl restart apache2

Step 7: Install PHP 8.3 for FreePBX

FreePBX 17 requires PHP 8.x. On Debian 13, PHP 8.3 is available from the default repositories. On Ubuntu 24.04, PHP 8.3 ships as the default version.

For Debian 13

Install PHP 8.3 and all extensions required by FreePBX.

sudo apt -y install php8.3 php8.3-{mysql,cli,common,imap,ldap,xml,curl,mbstring,zip,gd,gettext,xml,intl,bcmath} libapache2-mod-php8.3

For Ubuntu 24.04

Ubuntu 24.04 includes PHP 8.3 in the default repositories as well.

sudo apt -y install php8.3 php8.3-{mysql,cli,common,imap,ldap,xml,curl,mbstring,zip,gd,gettext,xml,intl,bcmath} libapache2-mod-php8.3

Adjust PHP settings for file uploads and memory usage. These changes apply to both the Apache module and CLI.

sudo sed -i 's/\(^upload_max_filesize = \).*/\120M/' /etc/php/8.3/apache2/php.ini
sudo sed -i 's/\(^upload_max_filesize = \).*/\120M/' /etc/php/8.3/cli/php.ini
sudo sed -i 's/\(^memory_limit = \).*/\1256M/' /etc/php/8.3/apache2/php.ini

Verify the PHP version.

php -v

Step 8: Install Node.js

FreePBX uses Node.js for its UCP (User Control Panel) and several frontend modules. Install Node.js 20 LTS from the NodeSource repository.

sudo apt install -y curl ca-certificates gnupg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg

Add the NodeSource repository and install Node.js.

NODE_MAJOR=20
echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list
sudo apt update
sudo apt -y install nodejs

Confirm the installed version.

node -v

Step 9: Install FreePBX on Debian 13 / Ubuntu 24.04

With all dependencies ready, install the additional utility packages that FreePBX expects.

sudo apt install -y sox mpg123 lame ffmpeg sqlite3 git unixodbc \
  postfix odbc-mariadb pkg-config libicu-dev

Configure ODBC for Asterisk CDR

Asterisk uses ODBC to write Call Detail Records (CDR) to the MariaDB database. Create the ODBC driver configuration.

echo "[MySQL]
Description = ODBC for MySQL (MariaDB)
Driver = /usr/lib/x86_64-linux-gnu/odbc/libmaodbc.so
FileUsage = 1" | sudo tee /etc/odbcinst.ini

Create the ODBC DSN for the asteriskcdrdb database.

echo "[MySQL-asteriskcdrdb]
Description = MySQL connection to asteriskcdrdb database
Driver = MySQL
Server = localhost
Database = asteriskcdrdb
Port = 3306
Socket = /var/run/mysqld/mysqld.sock
Option = 3" | sudo tee /etc/odbc.ini

Download and Install FreePBX

Download the latest FreePBX 17 release and extract it.

cd /usr/src
sudo wget http://mirror.freepbx.org/modules/packages/freepbx/freepbx-17.0-latest.tgz
sudo tar xfz freepbx-17.0-latest.tgz
cd freepbx

Stop the running Asterisk instance (if active) and start it through the FreePBX start script.

sudo systemctl stop asterisk
sudo ./start_asterisk start

Run the FreePBX installer. Replace YourDBPassword with the MariaDB root password you set earlier.

sudo ./install -n --dbuser root --dbpass "YourDBPassword"

A successful install ends with:

You have successfully installed FreePBX

Install all community modules and reload the configuration.

sudo fwconsole ma disablerepo commercial
sudo fwconsole ma installall
sudo fwconsole ma delete firewall
sudo fwconsole reload
sudo fwconsole restart

Restart Apache to finalize the web interface setup.

sudo systemctl restart apache2

Step 10: Configure Apache Virtual Host for FreePBX

Create a dedicated Apache virtual host for FreePBX. This ensures proper document root and logging. Open a new config file.

sudo vim /etc/apache2/sites-available/freepbx.conf

Add the following virtual host configuration. Replace pbx.example.com with your actual domain or server IP.

<VirtualHost *:80>
    ServerName pbx.example.com
    DocumentRoot /var/www/html

    <Directory /var/www/html>
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/freepbx-error.log
    CustomLog ${APACHE_LOG_DIR}/freepbx-access.log combined
</VirtualHost>

Enable the site and reload Apache.

sudo a2ensite freepbx.conf
sudo systemctl reload apache2

Step 11: Access the FreePBX Admin Panel

Open a web browser and navigate to your server IP or domain name.

http://192.168.1.50

On first access, FreePBX prompts you to create an admin account. Set a strong username and password. This is the main admin account for the entire phone system – store these credentials securely.

After creating the admin account, select your preferred language and click “FreePBX Administration” to enter the dashboard. You now have a working Asterisk PBX with a web management interface.

Step 12: Create SIP Extensions

Extensions are the individual phone lines for users. In the FreePBX admin panel, go to Applications > Extensions and click Add Extension. Select chan_pjsip as the technology (PJSIP is the modern SIP stack in Asterisk, replacing the legacy chan_sip).

Fill in the required fields for each extension:

  • User Extension: the extension number, e.g. 1001
  • Display Name: the user’s name, e.g. John Smith
  • Secret: a strong password for SIP registration (auto-generated or custom)
  • Voicemail: enable and set a voicemail PIN

Click Submit, then click the red “Apply Config” button at the top of the page. Repeat this process for each user who needs a phone extension. The extension number, server IP, and secret are what SIP phones or softphones need to register.

For a basic office with four employees, create extensions 1001 through 1004. Each user registers their SIP phone using these credentials.

Step 13: Configure SIP Trunks

A SIP trunk connects your PBX to an external VoIP provider (such as Twilio, VoIP.ms, or Flowroute), allowing calls to and from regular phone numbers. Navigate to Connectivity > Trunks and click Add Trunk > Add SIP (chan_pjsip) Trunk.

On the General tab, give the trunk a descriptive name like “voipms-trunk”. On the pjsip Settings tab, set these fields based on your provider’s details:

  • Username: your SIP account username from the provider
  • Secret: your SIP account password
  • SIP Server: your provider’s SIP server address (e.g. sip.voip.ms)
  • SIP Server Port: usually 5060
  • Authentication: Outbound
  • Registration: Send

Submit and apply the configuration. Verify trunk registration status under Reports > Asterisk Info > Registrations. A registered trunk shows “Registered” status.

Step 14: Set Up Outbound Routes

Outbound routes define how calls leaving your PBX reach external numbers. Go to Connectivity > Outbound Routes and click Add Outbound Route.

Configure the route:

  • Route Name: OutboundDefault
  • Trunk Sequence: select your SIP trunk as the first (and primary) trunk
  • Dial Patterns: add patterns matching your dialing plan. For US calling, add pattern 1NXXNXXXXXX for 11-digit numbers and NXXNXXXXXX with prepend digit 1 for 10-digit numbers

For international calls, add a pattern like 011. (the dot matches any remaining digits). Submit and apply config.

Step 15: Set Up Inbound Routes

Inbound routes control what happens when someone calls your phone number from outside. Navigate to Connectivity > Inbound Routes and click Add Inbound Route.

Set the DID Number to match the phone number your provider assigned (e.g. 15551234567). Under “Set Destination”, choose where inbound calls should go:

  • Extension: ring a specific phone directly
  • Ring Group: ring multiple phones simultaneously or in sequence
  • IVR: play an automated menu (configured in the next step)
  • Time Condition: route differently based on business hours

Submit and apply config. Test by calling your DID from an external phone.

Step 16: Configure IVR (Auto Attendant)

An IVR (Interactive Voice Response) menu greets callers with a recorded message and routes them based on keypad input. This is the “Press 1 for Sales, Press 2 for Support” feature that most businesses use. For more details on configuring IVR in Asterisk, see our dedicated guide.

First, record or upload a greeting audio file. Go to Admin > System Recordings and either record via a phone extension or upload a WAV/MP3 file.

Then navigate to Applications > IVR and click Add IVR. Configure:

  • IVR Name: Main Menu
  • Announcement: select the greeting recording you created
  • Timeout: 10 seconds
  • Invalid Retries: 3
  • Invalid Destination: an extension or voicemail as fallback
  • Timeout Destination: same as invalid destination

Add IVR entries for each key press. For example:

  • Key 1 – Destination: Extension 1001 (Sales)
  • Key 2 – Destination: Extension 1002 (Support)
  • Key 3 – Destination: Extension 1003 (Billing)
  • Key 0 – Destination: Extension 1004 (Operator)

Submit and apply config. Update your inbound route to point to this IVR as the destination.

Step 17: Configure Voicemail

Voicemail lets callers leave messages when an extension is busy or unanswered. FreePBX configures voicemail automatically when you enable it on an extension, but you can fine-tune global settings.

Go to Settings > Voicemail Admin to configure global voicemail options:

  • Max message length: 180 seconds (default)
  • Max messages per folder: 100
  • Email notifications: enable to send voicemail recordings as email attachments. Requires a working mail server (postfix was installed earlier)
  • Delete after email: set to Yes if you only want voicemails delivered via email

For per-extension voicemail settings, edit each extension under Applications > Extensions and click the Voicemail tab. Set the voicemail password (PIN), email address for notifications, and whether to attach the recording to the email.

Users can check their voicemail by dialing *97 from their own phone or *98 from any phone (then entering their extension number and PIN).

Step 18: Configure Firewall Rules for SIP and RTP

A phone system needs specific ports open for SIP signaling and RTP media streams. Open these ports using UFW (the default firewall on Ubuntu and Debian).

sudo ufw allow 5060/udp comment "SIP signaling"
sudo ufw allow 5061/tcp comment "SIP TLS"
sudo ufw allow 10000:20000/udp comment "RTP media"
sudo ufw allow 80/tcp comment "HTTP FreePBX"
sudo ufw allow 443/tcp comment "HTTPS FreePBX"
sudo ufw allow 22/tcp comment "SSH"

Enable the firewall if it is not already active.

sudo ufw enable
sudo ufw status verbose

The output should list all the rules you just created. For production systems exposed to the internet, restrict SIP port access to known IP ranges of your SIP provider and office locations.

sudo ufw allow from 203.0.113.0/24 to any port 5060 proto udp comment "SIP provider network"
sudo ufw allow from 10.0.1.0/24 to any port 5060 proto udp comment "Office LAN"

Configure the RTP port range in Asterisk to match your firewall rules. Edit /etc/asterisk/rtp.conf.

sudo vim /etc/asterisk/rtp.conf

Set these values under the [general] section.

[general]
rtpstart=10000
rtpend=20000

Reload the Asterisk configuration.

sudo asterisk -rx "module reload"

Step 19: Protect SIP with Fail2ban

SIP servers exposed to the internet attract brute-force registration attempts within minutes. Fail2ban monitors Asterisk logs and automatically bans IPs that fail authentication repeatedly.

sudo apt -y install fail2ban

Create an Asterisk jail configuration.

sudo vim /etc/fail2ban/jail.d/asterisk.conf

Add the following configuration. This monitors the Asterisk security log and bans offending IPs for 1 hour after 3 failed attempts within 10 minutes.

[asterisk]
enabled  = true
filter   = asterisk
action   = ufw[name=Asterisk, port="5060,5061", protocol=udp]
logpath  = /var/log/asterisk/messages
maxretry = 3
findtime = 600
bantime  = 3600

Make sure Asterisk logs security events. Edit /etc/asterisk/logger.conf and confirm the messages log line includes the “security” category.

sudo vim /etc/asterisk/logger.conf

Under the [logfiles] section, ensure this line exists:

messages => notice,warning,error,security

Reload Asterisk logger and restart fail2ban.

sudo asterisk -rx "logger reload"
sudo systemctl enable fail2ban
sudo systemctl restart fail2ban

Verify the Asterisk jail is active.

sudo fail2ban-client status asterisk

The output shows the jail status, number of currently banned IPs, and total bans. Check banned IPs at any time with the same command.

Step 20: FreePBX Backup Strategy

A solid backup strategy protects your PBX configuration, CDR data, voicemail recordings, and custom audio files. FreePBX includes a built-in backup module.

Navigate to Admin > Backup and Restore in the FreePBX panel. Click Add Backup and configure:

  • Backup Name: NightlyBackup
  • Items to backup: select all (Full Backup, CDR, System Audio, Voicemail)
  • Storage Location: Local storage at /var/spool/asterisk/backup/ or a remote SSH/FTP server
  • Schedule: daily at 2:00 AM
  • Retention: keep 7 daily backups

For additional protection, set up an off-server backup using rsync or SCP to push backup files to a remote location. Create a cron job that runs after the FreePBX backup completes.

sudo crontab -e

Add an entry to sync backups to a remote server at 3:00 AM daily (giving the FreePBX backup an hour to complete).

0 3 * * * rsync -az /var/spool/asterisk/backup/ [email protected]:/backups/pbx/

You can also back up the MariaDB databases directly for an extra layer of safety.

sudo mysqldump --all-databases | gzip > /var/spool/asterisk/backup/mariadb-all-$(date +%F).sql.gz

To restore from backup, go to Admin > Backup and Restore > Restore tab, select the backup file, choose which components to restore, and click Restore. FreePBX handles the entire process.

Conclusion

You now have a fully functional Asterisk PBX with FreePBX running on Debian 13 or Ubuntu 24.04. The system supports SIP extensions, external trunk connections, inbound/outbound call routing, IVR menus, voicemail with email notifications, and automated backups.

For production deployments, add TLS certificates (Let’s Encrypt works well) for both the web interface and SIP transport, set up monitoring for trunk registration status, and keep Asterisk and FreePBX modules updated regularly. Consider placing the PBX behind a Session Border Controller if handling high call volumes from the public internet.

Related Guides

LEAVE A REPLY

Please enter your comment!
Please enter your name here