VoIP.infoThe independent guide to business communications.
VoIP.info Guide

Should a PBX be exposed to the public internet?

Separate necessary carrier and phone reachability from administrative exposure.

Reviewed 2026-10-19Foundational

Ask which service needs to be reachable

A carrier may need to send signaling and media to your PBX. Remote phones need an approved connection path. Neither requirement automatically means the management interface or every listener should be publicly reachable.

Separate administration, signaling and media
An administration network accesses management interfaces. Allowed signaling peers and media peers use separate defined policies to reach the PBX. Arbitrary internet traffic is not a management path.

Example defensive architecture. Source restrictions, authentication, update policy and call permissions work together.

Build an access matrix

For each service, identify permitted source, destination, protocol and purpose. Use provider-documented networks where applicable and a controlled remote-access architecture for administrators. Confirm the policy for both IPv4 and IPv6.

Do not confuse obscurity with control

Changing a default port can reduce some noise but is not an authorization boundary. Authentication, software maintenance, rate controls and restricted dialing remain necessary. Encryption protects configured traffic paths but does not prevent an authenticated account from abusing granted permissions.

Verify the actual deployment

Inventory listening services and compare the firewall to the intended matrix. Remove unused exposure through a planned change with a recovery path. Test legitimate incoming, outgoing and remote calls after hardening. Keep emergency and continuity arrangements documented separately with the carrier.

Treat PJSIP ACLs as one control, not complete authentication

The Asterisk PJSIP ACL guide limits source or REGISTER Contact addresses but does not replace firewall ownership, endpoint identification, SIP authentication or dialplan authorization.

Do not turn a PBX zone into an internet-wide trust shortcut

On FreePBX systems, use the Firewall zone and service guide to classify interfaces and known networks before exposing a service. Responsive Firewall is bounded to selected signaling; it does not authorize GUI, SSH, provisioning, UCP or arbitrary calling from an unknown address.

Keep facility-control management off the open internet

The IP facility control station category can combine web administration, SIP, streams, storage and privileged door actions. Restrict management and peer access to the intended network, disable unused services and prove certificate and role enforcement before remote operation.

Keep 2N management and door control on intended paths

2N intercoms can expose SIP, streams, web management, APIs, mobile and central-management paths. The 2N hub keeps those services and the physical relay as separate trust boundaries. Do not publish a management interface or stream merely to make remote door answering convenient.

Keep the manager interface behind a protected path

The AMI login diagnostic follows Asterisk's safe-environment, SSH-or-VPN and manager ACL boundaries.

Keep GDS3712 administration and direct SIP off unnecessary public paths

The GDS3712 guide separates local management, event receivers, PBX service and direct peering. Do not expose its web interface or accept arbitrary direct SIP merely to restore a doorbell call.

Constrain remote lookup destinations

The Asterisk CURL guide keeps scheme, host, port and path controlled and treats redirects and dynamic URI input as separate authorization boundaries.

Keep external text out of dialplan control names

The dialplan input guide requires a bounded allowlist and full-shape decision before external data becomes a context, destination, path or command argument.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Continue your research

Hub

VoIP security

Reduce PBX exposure, constrain calling permissions and prepare for accountable recovery.

Explore topic →
Guide · Asterisk 22 LTS

Secure an Asterisk PBX before adding paid calling

Review management access, endpoint identities and dialplan permissions as separate layers.

Read guide →
Guide · FreePBX Backup & Restore release/17.0 source, FreePBX advisories GHSA-5v7h-49gr-jcwr and GHSA-f6hc-rqxg-ch86, and Sangoma Filestore, backup, fwconsole and FreePBX 17 migration documentation reviewed October 12, 2026; the advisories identify affected Backup & Restore versions below 17.0.6 and 17.0.30 respectively, but repository or advisory state does not prove the installed module, archive custody, target handlers or restored runtime, and no PBX, archive, storage destination, credential, job, restore, module, endpoint, trunk or call was inspected or tested

FreePBX backup and restore: prove the recovery path

Choose backup scope, protect off-host storage and validate an isolated restore before relying on it.

Read guide →
Guide · Current Asterisk 22 res_pjsip and res_pjsip_acl references, configuration relationships, sample configuration and diagnostic logging guidance were reviewed October 8, 2026; no Asterisk or FreePBX host, module, generated configuration, endpoint, ACL, source address, Contact address, registration, authentication exchange, firewall, request, packet flow, availability, compatibility or call was inspected or tested

Asterisk PJSIP ACLs: source-address and Contact boundaries

Separate all-PJSIP, endpoint, named and REGISTER Contact ACLs before permitting an address or diagnosing a rejected request.

Read guide →
Diagnostic · Current Asterisk 22 res_pjsip and res_pjsip_acl references, configuration relationships, sample configuration and diagnostic logging guidance were reviewed October 8, 2026; no Asterisk or FreePBX host, module, generated configuration, endpoint, ACL, source address, Contact address, registration, authentication exchange, firewall, request, packet flow, availability, compatibility or call was inspected or tested

Asterisk PJSIP ACL rejects a request or REGISTER Contact

Locate whether a PJSIP request failed a module-wide source ACL, an endpoint rule or a REGISTER Contact-address policy before widening access.

Read guide →
Guide · Current Sangoma Firewall guidance and FreePBX release/17.0 module metadata reviewed October 8, 2026; no host, rule set, packet path, registration or call tested

FreePBX Firewall: zones, services and Responsive Firewall

Map interfaces and source networks to zones, keep service permissions explicit, and use Responsive Firewall only for its documented signaling boundary.

Read guide →
Device category · Grandstream current GSC3570 product, firmware, user, FAQ, peering and wiring documentation reviewed October 13, 2026; no control station, SIP account, PBX, camera, alarm input, relay, lock, credential, network, firmware, storage device, management service, door or emergency-release path was inspected or tested

IP facility control stations for SIP, video and door systems

Evaluate a wall or desk control station as separate SIP, video-monitoring, alarm-I/O, door-control, management and physical-safety paths.

Read guide →
Current device research · Grandstream current GSC3570 product page, general firmware table, datasheet, user manual, FAQ, peering guide and wiring diagrams reviewed October 13, 2026; the general firmware table listed 1.0.7.10, but no GSC3570, hardware revision, firmware image, SIP account, PBX, camera, alarm input, relay, lock, credential, network, SD card, management service, door or emergency-release path was inspected or tested

Grandstream GSC3570 facility control station

Evaluate the GSC3570 as a four-account SIP intercom and facility-control panel while keeping video, alarm I/O, relay ownership, storage, firmware and physical safety independently observable.

HD intercom and facility control station
Grandstream maintained a live product page and listed GSC3570 general firmware 1.0.7.10 at review. That does not prove regional availability, support term, hardware revision, installed firmware or suitability for a particular door or life-safety design.

Read guide →
Brand hub · Current 2N IP One and IP Verso 2.0 product, installation, configuration, support and firmware resources reviewed October 13, 2026; no intercom, module, credential, PBX, network, camera, relay, lock, sensor, mobile service, firmware, door or emergency-release path was inspected or tested

2N IP intercoms and door-entry endpoints

Navigate current 2N door-intercom references while keeping SIP, video, access credentials, relay wiring, management and physical-safety evidence separate.

Read guide →
Current device research · Current 2N IP One product specifications, support and firmware page, installation manual 3.3 and shared IP-intercom configuration manual 3.3 reviewed October 13, 2026; no intercom, order variant, firmware image, SIP account, PBX, camera, stream, credential, mobile service, switch output, lock, input, tamper circuit, PoE path, door or emergency release was inspected or tested

2N IP One compact video intercom

Evaluate the 2N IP One as a one-button SIP and video door station while keeping media, camera, relay, input, tamper, power, firmware and physical access separately observable.

Compact one-button SIP video door intercom
2N maintained live product, installation, configuration and support pages and listed OS 3.3.1 dated August 31, 2026 at review. This does not establish regional availability, installed hardware or firmware, support entitlement, compatible PBX, mobile-service eligibility or suitability for a particular door and life-safety design.

Read guide →
Current device research · Current 2N IP Verso 2.0 product specifications, support and firmware page, installation manual 3.3 and shared IP-intercom configuration manual 3.3 reviewed October 13, 2026; no main unit, module, frame, firmware image, SIP account, PBX, camera, stream, credential, reader, mobile service, relay, lock, input, PoE path, door or emergency release was inspected or tested

2N IP Verso 2.0 modular video intercom

Evaluate the 2N IP Verso 2.0 as a modular SIP door station whose main unit, camera, access modules, I/O, enclosure, firmware and physical-control path require an exact bill of material.

Modular SIP video and access-control intercom
2N maintained live product, installation, configuration and support pages and listed OS 3.3.1 dated August 31, 2026 at review. This does not establish which main-unit or module order numbers are available in a region, the installed bill of material, support entitlement, compatible PBX or suitability for a particular access and life-safety design.

Read guide →
Guide · Asterisk branch-23-generated Login, Challenge, Logoff and Events references, branch-22-generated Login reference, and official AMI syntax, v2, permission and network-security documentation reviewed October 16, 2026; installed branch and maintenance release, listener and transport, manager.conf ownership, username, secret rotation, ACL, read and write classes, login event mask, connection lifetime, client timeout, reconnect policy and downstream operations remain deployment specific; no PBX, manager configuration, credential, ACL, socket, manager session, request, response, event, channel, packet, media stream or live call was inspected or tested

Asterisk AMI session authentication, Login, Logoff and Challenge

Keep manager identity, authentication exchange, transport protection, event mask, permissions and session lifetime as separate AMI evidence.

Read guide →
Troubleshooting · Asterisk branch-23-generated Login, Challenge, Logoff and Events references, branch-22-generated Login reference, and official AMI syntax, v2, permission and network-security documentation reviewed October 16, 2026; installed branch and maintenance release, listener and transport, manager.conf ownership, username, secret rotation, ACL, read and write classes, login event mask, connection lifetime, client timeout, reconnect policy and downstream operations remain deployment specific; no PBX, manager configuration, credential, ACL, socket, manager session, request, response, event, channel, packet, media stream or live call was inspected or tested

Asterisk AMI login fails or the session drops

Trace one failed login or lost manager session through listener identity, protected reachability, framing, authentication fields, manager account policy and the exact termination boundary.

Read guide →
Current device research · Grandstream GDS3712 product, datasheet, installation, user, endpoint-integration, digital-input and event-log material was reviewed October 16, 2026. Published family instructions and compatibility examples remain version- and topology-sensitive and do not establish the installed firmware, wiring, power, network, SIP, video, relay, lock, sensor, credential, management or life-safety state at a selected door. No device, PBX, endpoint, camera, recorder, relay, lock, sensor, credential, event receiver, packet, media stream or live call was inspected or tested

Grandstream GDS3712 video intercom: separate calls, video and door control

Assess the GDS3712 as a PoE SIP video intercom whose camera, media, remote-unlock request, relays, inputs and physical opening require separate evidence.

Read guide →
Troubleshooting · Grandstream GDS3712 product, datasheet, installation, user, endpoint-integration, digital-input and event-log material was reviewed October 16, 2026. Published family instructions and compatibility examples remain version- and topology-sensitive and do not establish the installed firmware, wiring, power, network, SIP, video, relay, lock, sensor, credential, management or life-safety state at a selected door. No device, PBX, endpoint, camera, recorder, relay, lock, sensor, credential, event receiver, packet, media stream or live call was inspected or tested

Grandstream GDS3712 calls, but video or door unlock fails

Trace a GDS3712 door call through model, power, topology, SIP leg, video mode, unlock request, relay, input and physical opening without treating one success as end-to-end proof.

Read guide →
Guide · Current Asterisk Latest API CURL, CURLOPT, JSON_DECODE and URIENCODE references, the Asterisk CLI guide, the upstream func_curl implementation and the official libcurl connection and whole-transfer timeout references were reviewed October 19, 2026. The generated Asterisk API pages reported branch 23; the installed Asterisk and libcurl versions, loaded modules, channel and global options, DNS, proxy, certificate store, remote service, response schema and elapsed call-path behavior remain deployment specific. No PBX, module, dialplan, credential, DNS answer, proxy, certificate, remote service, response, packet, media stream or live call was inspected or tested

Asterisk CURL: make HTTP dialplan lookups bounded and auditable

Separate URL construction, channel-scoped options, connection and whole-transfer limits, HTTP handling, response parsing and fallback routing for remote dialplan lookups.

Read guide →
Troubleshooting · Current Asterisk Latest API CURL, CURLOPT, JSON_DECODE and URIENCODE references, the Asterisk CLI guide, the upstream func_curl implementation and the official libcurl connection and whole-transfer timeout references were reviewed October 19, 2026. The generated Asterisk API pages reported branch 23; the installed Asterisk and libcurl versions, loaded modules, channel and global options, DNS, proxy, certificate store, remote service, response schema and elapsed call-path behavior remain deployment specific. No PBX, module, dialplan, credential, DNS answer, proxy, certificate, remote service, response, packet, media stream or live call was inspected or tested

Asterisk CURL is empty, slow, redirected or returns an unsafe response

Trace one remote dialplan lookup through URL ownership, effective options, DNS and connect timing, TLS and HTTP handling, bounded response parsing and the fallback branch.

Read guide →
Guide · Current Asterisk Latest API FILTER, REGEX, ISNULL, LEN, FIELDQTY and CUT references, the dialplan-functions overview and the upstream func_strings implementation were reviewed October 19, 2026. The generated API pages reported branch 23; the installed branch, compiled and loaded modules, parser escaping, channel-variable content, delimiter, pattern, downstream application and call outcome remain deployment specific. No PBX, module, dialplan, channel, variable, external input, parsed field, route, packet, media stream or live call was inspected or tested

Asterisk dialplan input validation and field parsing

Keep presence, length, allowed-character filtering, full-shape validation, delimiter count and field extraction as separate dialplan decisions.

Read guide →
Troubleshooting · Current Asterisk Latest API FILTER, REGEX, ISNULL, LEN, FIELDQTY and CUT references, the dialplan-functions overview and the upstream func_strings implementation were reviewed October 19, 2026. The generated API pages reported branch 23; the installed branch, compiled and loaded modules, parser escaping, channel-variable content, delimiter, pattern, downstream application and call outcome remain deployment specific. No PBX, module, dialplan, channel, variable, external input, parsed field, route, packet, media stream or live call was inspected or tested

Asterisk dialplan input is empty, truncated or misparsed

Trace one value through assignment, length, filtering, regex syntax, delimiter count, CUT variable ownership and the first downstream branch.

Read guide →