Why Asterisk and not FreePBX<\/h2>\n\n\n\n
FreePBX is a good option if you want a managed UX for a complex PBX. However, I wanted to understand the basics and also with the help of AI build my own custom UX for my PBX down the line. For me, the goal is not getting a basic phone service – I already have a Grandstream ATA and home phones that handle that part with my voip.ms account. My goal is eventually have programmatic access to PSTN and I would like to use Asterisk REST Interface (ARI) and Asterisk Management Interface (AMI) to enable these.<\/p>\n\n\n\n
Network Diagram<\/h2>\n\n\n\n
Here’s a network diagram of the final setup I wanted to achieve<\/p>\n\n\n\n I chose to run Asterisk as a LXC on my proxmox server. I decided to place it in my IoT VLAN. Asterisk is a fairly large attack surface, so placing it in my IoT VLAN and isolated from my other devices works for me. My management VLAN has full access to this VLAN – so any other services that need access to ARI or AMI will be able to reach it. I set the LXC up with a static IP on my Unifi gateway.<\/p>\n\n\n\n Instead of building packages from source, I decided to use Sangoma’s packages on Debian 12. As of FreePBX 17, Sangoma now uses Debian as its underlying Operating System so this works well.<\/p>\n\n\n\n First we create the user and group for asterisk, add Sangoma repo and install Asterisk and key dependencies:<\/p>\n\n\n\n At this point, you should have a working asterisk service that does not do much. You can check using ARI requires the HTTP server in Asterisk, which is disabled by default. Edit Then configure ARI credentials in Restart the service ( voip.ms uses subaccounts to allow you to register from different endpoints for the same number (DID). Each subaccount gets its own SIP credentials. This allows my Grandstream ATA to connect directly to voip.ms (no dependency on my Asterisk server) and other softphones to also connect directly. For Asterisk, I created a dedicated subaccount with the following settings (only the relevant ones are mentioned):<\/p>\n\n\n\n For incoming calls, you can create a ring group and set it as the target for your DID – then add the sub-accounts to that ring group. This allows the flexibility (and continued use of your DID) while you setup Asterisk by not having that sub-account in the ring group. Go to DID Numbers > Ring Groups and Create new ring group. Add relevant sub-accounts to the ring group along with the setting for time, number of rings. Now DID Numbers > Manage DID and Routing Settings, select Ring Group and pick the Ring Group you created.<\/p>\n\n\n\n Edit Restart the service ( Edit Now restart the service and test an outbound call to another number (like your cell):<\/p>\n\n\n\n If everything worked, you should get a call on your cell and when answered you should hear something like “Congratulations, you have successfully installed and executed asterisk”.<\/p>\n\n\n\n Now that we have the basic SIP trunk with voip.ms working with Asterisk, we can start setting up local SIP endpoints – these would be how endpoints connect to the Asterisk server and we can wire them up to receive\/make calls via the SIP trunk we setup. I setup my local endpoints in a separate file Now, you can use this information configure local softphone clients. Since I use a Linux Desktop, I tried three different clients – they all are good. A brief description of my experience with each below:<\/p>\n\n\n\n Have a client configured and verify that you can sign-in using the SIP account you setup on your Asterisk server.<\/p>\n\n\n\n Next, we can configure the outbound and inbound calls through the SIP trunk from our Local SIP endpoints. Modify your With this dialplan, your local SIP endpoints should now be able to both make outbound calls through the voip.ms SIP trunk as well as receive inbound calls made to your voip.ms number.<\/p>\n\n\n\n If something is not working, run the following and repeat the scenario to get logs and then figure out what went wrong. AI can be helpful in figuring out the problem:<\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" One of my long-standing projects has been to have Asterisk running on my home network so my services have PSTN (and potentially SMS) access. In this post, I will cover the setup of Asterisk as a home lan pbx with voip.ms setup as the SIP trunk. VOIP Providers While there are many VOIP providers, I…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-687","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/nramkumar.org\/tech\/wp-json\/wp\/v2\/posts\/687","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nramkumar.org\/tech\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nramkumar.org\/tech\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nramkumar.org\/tech\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nramkumar.org\/tech\/wp-json\/wp\/v2\/comments?post=687"}],"version-history":[{"count":3,"href":"https:\/\/nramkumar.org\/tech\/wp-json\/wp\/v2\/posts\/687\/revisions"}],"predecessor-version":[{"id":692,"href":"https:\/\/nramkumar.org\/tech\/wp-json\/wp\/v2\/posts\/687\/revisions\/692"}],"wp:attachment":[{"href":"https:\/\/nramkumar.org\/tech\/wp-json\/wp\/v2\/media?parent=687"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nramkumar.org\/tech\/wp-json\/wp\/v2\/categories?post=687"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nramkumar.org\/tech\/wp-json\/wp\/v2\/tags?post=687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"\"](\"https:\/\/nramkumar.org\/tech\/wp-content\/uploads\/2026\/05\/AsteriskNetworkDiagram-1024x559.png\")
<\/figure>\n\n\n\nSetup Environment<\/h2>\n\n\n\n
Installation<\/h2>\n\n\n\n
# Create asterisk user before installing\naddgroup asterisk\nadduser --system --ingroup asterisk asterisk\n\n# Add Sangoma repo\napt-get update\napt-get -y install gnupg software-properties-common wget\nwget http:\/\/deb.freepbx.org\/gpg\/aptly-pubkey.asc\ngpg --dearmor --yes -o \/etc\/apt\/trusted.gpg.d\/freepbx.gpg aptly-pubkey.asc\nadd-apt-repository -y -S \"deb [ arch=amd64 ] http:\/\/deb.freepbx.org\/freepbx17-prod bookworm main\"\napt-get update\n\n# Install Asterisk and required packages\napt-get -y install asterisk22 asterisk22-core asterisk22-configs asterisk22-odbc\n\n# Install key dependencies\napt-get install -y libxslt1.1 liburiparser1 libsrtp2-1\n\n# Install some sound files\napt-get install -y asterisk-sounds-core-en-ulaw asterisk-sounds-extra-en-ulaw\n\n# Install troubleshooting tools\napt-get install -y bind9-dnsutils nmap tcpdump\n\n# Add a home directory for asterisk user (optional)\nusermod -d \/home\/asterisk asterisk\n\n# Change ownership of directories to asterisk user\/group\nchown -R asterisk:asterisk \/etc\/asterisk \/var\/{lib,log,spool}\/asterisk \/usr\/lib\/asterisk\n\n# Modify config to run asterisk as user\/group asterisk\nsed -i 's\/;runuser\/runuser\/' \/etc\/asterisk\/asterisk.conf\nsed -i 's\/;rungroup\/rungroup\/' \/etc\/asterisk\/asterisk.conf\n\n# Enable and run the service\nsystemctl enable asterisk\nsystemctl start asterisk<\/code><\/pre>\n\n\n\nsystemctl status asterisk.service<\/code> or ps aux | grep asterisk | grep -v grep<\/code> to see the status of the service and process details. Use the system logs to debug issues if the service does not run for any reason. Also, after this point, you should be able to run further commands as user asterisk<\/code> instead of running as root<\/code>.<\/p>\n\n\n\nEnable ARI and HTTP<\/h2>\n\n\n\n
\/etc\/asterisk\/http.conf<\/code>:<\/p>\n\n\n\nenabled=yes\nbindaddr=0.0.0.0\nbindport=8088<\/code><\/pre>\n\n\n\n\/etc\/asterisk\/ari.conf<\/code>:<\/p>\n\n\n\n[general]\nenabled=yes\npretty=yes\n\n[asterisk]\ntype=user\nread_only=no\npassword=YOUR_ARI_PASSWORD<\/code><\/pre>\n\n\n\nsystemctl restart asterisk.service<\/code>) and verify modules are loaded with asterisk -rx \"module show like res_ari\"<\/code><\/p>\n\n\n\nSetting things up at voip.ms<\/h2>\n\n\n\n
\n
Setting Up voip.ms SIP Trunk<\/h2>\n\n\n\n
\/etc\/asterisk\/pjsip.conf<\/code> to add the following:<\/p>\n\n\n\n[transport-tls]\ntype=transport\nprotocol=tls\nbind=0.0.0.0:5061\nca_list_file=\/etc\/ssl\/certs\/ca-certificates.crt\nmethod=tlsv1_2\nlocal_net=<lan-subnet>\/24\n\n[voipms-auth]\ntype=auth\nauth_type=userpass\nusername=<sub-account userid>\npassword=<sub-account password>\n\n[voipms-aor]\ntype=aor\ncontact=sip:<pop hostname>:5061;transport=tls\n\n[voipms]\ntype=endpoint\ntransport=transport-tls\ncontext=from-voipms\ndisallow=all\nallow=ulaw\noutbound_auth=voipms-auth\naors=voipms-aor\nfrom_user=<sub-account userid>\nfrom_domain=<pop hostname>\ndirect_media=no\nrtp_symmetric=yes\nforce_rport=yes\nrewrite_contact=yes\nmedia_encryption=sdes\nsend_rpid=yes\ntrust_id_outbound=yes\n\n[voipms-registration]\ntype=registration\ntransport=transport-tls\noutbound_auth=voipms-auth\nserver_uri=sip:<pop hostname>:5061;transport=tls\nclient_uri=sip:<sub-account userid>@<pop hostname>\nretry_interval=60\n\n[voipms-identify]\ntype=identify\nendpoint=voipms\nmatch=<pop hostname><\/code><\/pre>\n\n\n\npop hostname<\/code> is the pop server you picked for your DID in voip.ms (check DID > Manage DID > Edit Settings > DID Point of Presence). Please note that much of the settings under [voipms]<\/code> have been setup to work correctly behind a NAT with your Asterisk server running on a LAN address behind your router. In particular, rtp_symmetric, direct_media, force_rport, rewrite_contact<\/code> settings are relevant here. Also, these settings setup an encrypted SIP connection as well as enable encrypted calls via SRTP<\/code>.<\/p>\n\n\n\nsystemctl restart asterisk.service<\/code>) and check that registration is successful with asterisk -rx \"pjsip show registrato<\/code>ns”. If everything worked, you should see voipms<\/code> show as Registered<\/code>. At this point, you are ready to test basic outbound calling using this SIP trunk.<\/p>\n\n\n\nTesting basic outbound calling<\/h2>\n\n\n\n
\/etc\/asterisk\/extensions.conf<\/code> and add the following:<\/p>\n\n\n\n[general]\nstatic=yes\nwriteprotect=no\n\n[default]\nexten => s,1,Answer()\n same => n,Playback(demo-congrats)\n same => n,Hangup()\n\n[from-voipms]\nexten => s,1,Answer()\n same => n,Playback(demo-congrats)\n same => n,Hangup()\n\n[outbound]\nexten => _1NXXNXXXXXX,1,NoOp(Outbound call to ${EXTEN})\n same => n,Dial(PJSIP\/${EXTEN}@voipms)\n same => n,Hangup()<\/code><\/pre>\n\n\n\nsystemctl restart asterisk.service\nasterisk -rx \"channel originate PJSIP\/1XXXXXXXXXX@voipms application Playback demo-congrats\"<\/code><\/pre>\n\n\n\nSetting Up Local SIP Endpoints<\/h2>\n\n\n\n
\/etc\/asterisk\/pjsip_extensions.conf<\/code> and then #include pjsip_extensions.conf<\/code> in \/etc\/asterisk\/pjsip.conf<\/code>. Here’s what the extension configuration looks like:<\/p>\n\n\n\n; The Local Endpoint\n[100]\ntype=endpoint\ncontext=from-internal\ndisallow=all\nallow=ulaw\nauth=100-auth\naors=100\nrtp_symmetric=yes\nrewrite_contact=yes\nforce_rport=yes\ndirect_media=no\n\n; The Authentication Credentials\n[100-auth]\ntype=auth\nauth_type=userpass\npassword=<password for asterisk user>\nusername=<username for asterisk user> ; I just used 100\n\n; The Address of Record\n[100]\ntype=aor\nmax_contacts=5\nremove_existing=yes\nminimum_expiration=60\ndefault_expiration=120<\/code><\/pre>\n\n\n\n\n
Configuring Outbound And Inbound Calls From Local SIP Endpoints<\/h2>\n\n\n\n
\/etc\/asterisk\/extensions.conf<\/code> to add the following:<\/p>\n\n\n\n[default]\nexten => s,1,Answer()\n same => n,Playback(demo-congrats)\n same => n,Hangup()\n\n[from-voipms]\nexten => <Your DID>,1,NoOp(Inbound call - Name: ${CALLERID(name)} - Num: ${CALLERID(num)})\n same => n,Set(CALLERID(name)=${IF($[\"${TOLOWER(${CALLERID(name)})}\" = \"wireless caller\" | \"${CALLERID(name)}\" = \"unknown\" | \"${CALLERID(name)}\" = \"\"]?${CALLERID(num)}:${CALLERID(name)})})\n same => n,Dial(${PJSIP_DIAL_CONTACTS(100)},30)\n same => n,Hangup()\n\n; Catch-all safety\nexten => _X.,1,Dial(PJSIP\/100,30)\n same => n,Hangup()\n\n[outbound]\nexten => _1NXXNXXXXXX,1,NoOp(Outbound call to ${EXTEN})\n same => n,Set(CALLERID(num)=<Your DID>)\n same => n,Set(CALLERID(name)=<Your Name>)\n same => n,Dial(PJSIP\/${EXTEN}@voipms)\n same => n,Hangup()\n\n[from-internal]\n; Match 10-digit numbers (e.g., 5555551234)\nexten => _NXXNXXXXXX,1,NoOp(Outbound call to ${EXTEN})\n same => n,Set(CALLERID(num)=<Your DID>)\n same => n,Dial(PJSIP\/${EXTEN}@voipms)\n same => n,Hangup()\n\n; Match 11-digit numbers (e.g., 15555551234)\nexten => _1NXXNXXXXXX,1,NoOp(Outbound call to ${EXTEN})\n same => n,Set(CALLERID(num)=<Your DID>)\n same => n,Dial(PJSIP\/${EXTEN}@voipms)\n same => n,Hangup()\n\n; Allow dialing extension 100 locally (for future use)\nexten => 100,1,Dial(${PJSIP_DIAL_CONTACTS(100)},30)\n same => n,Hangup()<\/code><\/pre>\n\n\n\nDebugging Tools<\/h2>\n\n\n\n
asterisk -rvvv\npjsip set logger on<\/code><\/pre>\n\n\n\n