FreePBX outbound restrictions and emergency routes

Start with allowed destinations

Define which roles need internal, local, national, international or premium destinations. Apply least privilege to shared and remote endpoints. A strong extension password does not limit the bill when a valid credential is misused.

Document emergency-service routing with the provider through its approved validation process. Ordinary calling restrictions must not accidentally shadow the intended emergency route; location and callback identity remain separate requirements.

Review the complete route choice

For a test number, follow the dialed digits, any prefix removal or prepending, route ordering and selected trunk. Then check caller identity and the carrier’s allowed destination policy. More than one layer can reject the same call.

Do not fix a single failed destination with an unrestricted catch-all route. Use the installed FreePBX permission mechanism and record any commercial-module dependencies instead of implying every edition offers identical role controls.

Test allowed and denied examples

Use approved test destinations representing each permission class. Confirm an allowed call reaches the expected trunk and a denied call fails at the intended boundary. Include a forwarded external call: forwarding may create another outbound leg with a different identity and policy path.

For failures, preserve the normalized number and responding system. A carrier 403 is not proof that the extension’s password is wrong. Compare outbound route troubleshooting.

Monitor exceptions

Review unusual destination, duration and concurrency patterns with spending limits where the carrier supports them. Assign an owner for temporary permissions and revoke them when the job ends. Keep the provider’s emergency arrangements documented with emergency calling considerations.

Include extension-owned Follow Me legs in route policy

An external Follow Me destination creates an outbound call on behalf of the extension. Sangoma documents that Extension Routing can block those legs and that Class of Service can become the controlling permission layer; accept both allowed and intentionally denied destinations.

Apply outbound controls to automated callbacks

The FreePBX Callback guide treats received caller ID as untrusted input and keeps premium, international and emergency exclusions explicit. A Callback must not become a path around ordinary route and spending controls.

Preserve the Bulk Solutions 911 and 922 paths through route restrictions

A working ordinary outbound route does not prove that 911@sip.bulkvs.com or 922@sip.bulkvs.com uses the intended trunk and caller identity. Use the Bulk Solutions diagnostic to record route selection, Request-URI, identity, provider response and safe restoration.