Prerequisites
What to gather before installing the PBX: a virtual machine, its network, a name and a certificate, a SIP trunk and an email server.
Virtual machine
The PBX ships as a complete VM image: Debian 13, PostgreSQL, FreeSWITCH, FusionPBX, the PBX and nginx, ready to start (see Installing from the image).
| Hypervisor | KVM, Proxmox or OpenStack (qcow2 image); VMware or VirtualBox (OVA image). |
| CPU and memory | 2 vCPUs and 4 GB by default, up to 200 simultaneous calls; see Sizing. |
| Disk | 12 GB at least; the image grows on first boot to the size given. Plan more for call recordings and voicemail (about 1 MB per minute in 8 kHz WAV). |
| Access | A public SSH key, given on first boot through cloud-init: the image has no password. |
For high availability, two identical VMs on the same network, plus a free IP address (the floating IP): see Active/passive.
Network
A fixed public IP address, preferably carried by the VM itself: phones and the trunk
provider reach it. Behind NAT, check that FreeSWITCH announces the public address (FusionPBX
variables external_sip_ip and external_rtp_ip), otherwise audio only flows one way.
Ports to open towards the VM (the image installs no firewall: filter upstream, or on the VM):
| Port | Protocol | For |
|---|---|---|
| 443 | TCP | Portal and API (HTTPS). |
| 80 | TCP | Redirect to HTTPS, and Let’s Encrypt certificate validation. |
| 5060 | UDP and TCP | SIP from phones and softphones (internal profile). |
| 5061 | TCP | SIP over TLS from softphones (internal profile). |
| 5080 | UDP and TCP | SIP from the trunk: provider or C5 (external profile). Can be limited to the provider’s addresses. |
| 16384 to 32768 | UDP | Audio (RTP). |
| 22 | TCP | Administration (SSH), from your own addresses only. |
Between the two VMs of an active/passive pair: VRRP (IP protocol 112), PostgreSQL (5432) and SSH (22).
Phone SIP is in clear on 5060, like the current PBX, and over TLS on 5061, with the machine’s certificate: Linphone uses it for customers who choose encrypted calls (Settings). A phone that fails to authenticate too often gets its address banned (see Diagnostics): add your own addresses to the allow list right after installing.
The external profile also has TLS (5081): customers’ SIP connectors register over TLS with
their service. These connections go out from the machine: port 5081 does not need to be open
inbound.
Name and certificate
- A fully qualified machine name (
pbx.operator.example), with its DNS record pointing to the public address. It gives the portal address and the default domain. - A domain for customers, preferably as a wildcard (
*.pbx.operator.example): each customer has its SIP domain (customer.pbx.operator.example), which its phones register to. - A TLS certificate for the machine name, for the portal and SIP over TLS: the operator’s, or Let’s Encrypt (certbot). On first boot, the VM uses a self-signed certificate, to be replaced: softphones reject it.
SIP trunk
An account with a SIP provider (or a C5) for each customer that calls out: username and password, or IP address authentication. Calls between customers also go out through the trunk. See A customer’s trunk.
An SMTP server (address, port, credentials, sender): invitations, password links, voicemail and alerts are sent by email. It is set in the portal, before creating the first users.
Optional
- Voicemail transcription: a service compatible with OpenAI’s transcription API (online service, or a local engine: see Local transcription).
- Configuration assistant: a Claude API key (Anthropic).
- Monitoring: Prometheus, for the metrics and the alerts shipped (Monitoring).
- Backups: storage outside the VM to copy the archives to (Backup).