How to Set Up a Self-Hosted PBX

Step 1: Plan Your Requirements

Before touching any software, determine what your phone system needs to do. Start with these questions: How many users will have extensions? How many simultaneous calls do you expect at peak times? Do you need features like call recording, IVR menus, call queues, or conference bridges? Will you serve one organization or multiple tenants? Do you need to connect to traditional phone lines, or will everything go through SIP trunks?

For most small businesses with 5 to 50 employees, a single FreePBX server with a SIP trunk handles everything comfortably. A VPS with 2 CPU cores, 4 GB of RAM, and 40 GB of SSD storage can support 30 to 50 concurrent calls. If you expect higher volumes, plan for 4 cores and 8 GB of RAM. If you need multi-tenancy (hosting phone systems for multiple separate clients), choose FusionPBX on FreeSWITCH instead of FreePBX on Asterisk.

Decide whether to host on-premises or in the cloud. On-premises gives you the lowest latency for local phones and full physical control over the hardware, but you are responsible for power, networking, and disaster recovery. Cloud hosting on a VPS provider like DigitalOcean, Vultr, Linode, or AWS eliminates hardware concerns and provides geographic redundancy, but adds a few milliseconds of latency to every call and introduces a monthly hosting cost (typically $10 to $40 per month for a capable VPS).

Step 2: Choose Your PBX Software

For single-tenant deployments serving one organization, FreePBX is the recommended choice. It has the largest community, the most available documentation, and the easiest setup path through FreePBX Distro. For multi-tenant deployments, FusionPBX is the right platform because it was built specifically for hosting multiple independent organizations on shared infrastructure.

If you are building a custom telephony application that does not fit the mold of a traditional PBX, consider working directly with Asterisk or FreeSWITCH without a GUI layer. This requires deeper technical expertise but gives you maximum flexibility over call handling logic.

FreePBX Distro is a bootable ISO image that installs a complete operating system (based on Rocky Linux), Asterisk, and FreePBX in one process. FusionPBX provides installation scripts for Debian and Ubuntu that automate the setup of FreeSWITCH, the web interface, and all dependencies.

Step 3: Prepare the Server

If you are using FreePBX Distro, download the latest ISO from the FreePBX website and boot your server from it. The installer will partition the disk, install the operating system, and set up all necessary packages. If you are deploying on a VPS where you cannot boot from an ISO, install a fresh minimal Linux distribution (Rocky Linux 9 or AlmaLinux 9 for FreePBX, Debian 12 or Ubuntu 22.04 for FusionPBX) and then install the PBX software on top of it.

For FusionPBX, the project provides a single-command installation script that handles everything. On a fresh Debian or Ubuntu server, you download and run the install script, which installs FreeSWITCH, PostgreSQL, Nginx, PHP, and the FusionPBX web interface. The script outputs the randomly generated admin password at the end of the installation.

Regardless of the platform, make sure the server has a static IP address (or a stable elastic IP if using a cloud provider), the system clock is synchronized via NTP (critical for TLS certificate validation and call detail record accuracy), and the hostname is properly set. If the PBX will serve remote users or SIP phones at other locations, it also needs a publicly routable IP address and appropriate firewall rules.

Step 4: Install and Configure the PBX

After the base system is installed, access the web interface. For FreePBX, navigate to the server's IP address in a browser and complete the initial setup wizard, which asks for the admin username, password, and email address. For FusionPBX, log in with the admin credentials generated during installation and configure the default domain.

Set the system's outbound caller ID to your main business number (you will configure this number in the SIP trunk step). Configure the system timezone, voicemail settings (such as the maximum message length and email delivery format), and music on hold. If your PBX will handle voicemail-to-email, configure the SMTP settings for outbound email delivery.

Create an IVR (Interactive Voice Response) menu if you want callers to hear a greeting with options like "Press 1 for Sales, Press 2 for Support." Both FreePBX and FusionPBX provide graphical IVR editors that let you define menu options, timeouts, and fallback destinations without writing any code.

Step 5: Set Up SIP Trunks

A SIP trunk connects your PBX to the public telephone network, allowing users to make and receive calls to regular phone numbers. Choose a SIP trunk provider based on your location, pricing needs, and call volume. Popular options include Twilio, Telnyx, VoIP.ms, Flowroute, and SIPStation (Sangoma's own service, tightly integrated with FreePBX).

Sign up with your chosen provider, purchase one or more DID numbers (the phone numbers people will call to reach you), and note the provider's SIP server address, port, and your authentication credentials. In FreePBX, navigate to Connectivity > Trunks, create a new SIP trunk, and enter the provider's connection details. In FusionPBX, navigate to Accounts > Gateways and create a new gateway with the provider's settings.

Configure outbound routes to tell the PBX which trunk to use for external calls. A typical configuration routes all 10-digit and 11-digit dialed numbers through the SIP trunk, while internal extensions (usually 3 or 4 digit numbers) stay on the local PBX. Configure inbound routes to direct calls arriving on each DID to the appropriate destination, whether that is an extension, a ring group, an IVR menu, or a queue.

Test the trunk by making an outbound call to a mobile phone and having someone call your DID number from an external line. Verify that audio flows in both directions and that caller ID displays correctly.

Step 6: Create Extensions and Users

Create a SIP extension for each user who needs a phone. In FreePBX, navigate to Applications > Extensions, choose "Add New SIP (PJSIP) Extension," and fill in the extension number, display name, and a strong password. In FusionPBX, navigate to Accounts > Extensions and create extensions for the appropriate domain.

For each extension, configure voicemail settings including the voicemail PIN, email address for message delivery, and whether to attach the audio file to the email. Set up ring groups for departments that should share incoming calls (for example, a "Sales" ring group that rings all sales team extensions simultaneously). Configure call queues for support teams where calls should be distributed one at a time to available agents.

If you are deploying follow-me (find-me) routing, configure the external numbers (mobile phones, home phones) that should ring when an extension goes unanswered after a set number of seconds. This is useful for remote workers and after-hours coverage.

Step 7: Configure Phones and Softphones

SIP desk phones from manufacturers like Yealink, Polycom, Grandstream, and Cisco need to be configured with the PBX's IP address, the extension number, and the SIP password. Most modern SIP phones support auto-provisioning, where the phone downloads its configuration from the PBX automatically using TFTP, HTTP, or HTTPS. FreePBX's Endpoint Manager (commercial module) and FusionPBX's built-in provisioning system both support auto-provisioning for major phone brands.

For users who prefer software-based phones, any SIP-compatible softphone application will work. Popular options include Ooh323, Ooh323c, Ooh323cs and other SIP clients on desktop, and Ooh323 and Ooh323c for mobile. Configure the softphone with the PBX's address, the extension number, and the SIP credentials, then test by making a call to another extension.

Test thoroughly before going live. Make internal calls between extensions to verify audio quality and features like transfer and hold. Make external calls through the SIP trunk to verify outbound connectivity. Have someone call your DID from an external number to verify inbound routing. Test voicemail by letting calls go unanswered and confirming that messages are recorded and email notifications are sent.

Step 8: Secure the System

VoIP systems are frequent targets for brute-force attacks and toll fraud. Securing your PBX is not optional. Start with the firewall: allow SIP traffic (UDP/TCP port 5060, or 5061 for TLS) only from your SIP trunk provider's IP ranges and your known office IP addresses. Allow RTP media traffic (typically UDP ports 10000 to 20000) from the same sources. Block all other inbound traffic to the SIP and RTP ports.

Install and configure Fail2ban to monitor SIP authentication logs and automatically block IP addresses that generate repeated failed login attempts. Both FreePBX and FusionPBX include Fail2ban configurations tailored to their respective log formats. Set the ban threshold low (3 to 5 failed attempts) and the ban duration long (at least 1 hour, preferably 24 hours).

Enable TLS for SIP signaling to encrypt the call setup messages, and enable SRTP for the media stream to encrypt the actual voice data. This prevents eavesdropping on calls even if an attacker can capture network traffic. Both Asterisk and FreeSWITCH support TLS and SRTP, though the configuration differs between the two engines.

Use strong, unique passwords for every SIP extension. Avoid predictable patterns like "1001" for extension 1001. A minimum of 16 random alphanumeric characters is recommended for SIP passwords, since these are typically configured once in the phone and never typed by hand. Disable guest calls (unauthenticated SIP connections) and disable any protocols or modules that you are not actively using.