Home » Technology » Smartphones (Page 5)

Category Archives: Smartphones

The Most Versatile VoIP Provider: FREE PORTING

Enchilada Amore: It’s Incredible PBX 16-15 for CentOS 7

Just when you thought the VoIP community was running out of open source offerings, along comes last week’s Incredible PBX 16® LITE and today’s Incredible PBX 16-15 for CentOS® 7 featuring the same great feature set as the LITE version including Asterisk 16®. And now you also get the entire FreePBX® 15 GPL module collection including their new User Control Panel (UCP) and a much enhanced web GUI plus the entire Incredible PBX feature set. As with Incredible PBX LITE, it’s plug-and-play with immediate calling capability using any of four commercial SIP providers. Or you can choose one of 16 other preconfigured SIP providers, enter your credentials, and enjoy instant connectivity without worrying about SIP settings. We began the Incredible PBX 16 adventure last week. Let’s catch you up if you’re just joining.

UPDATE: A new release of Incredible PBX 16-15 is now available here. It resolves most issues with migration from Incredible PBX 13-13.

UPDATE: Turn your Incredible PBX 16-15 server into a secure public-facing PBX. Here’s how.

What’s Included? Incredible PBX 16-15 serves up a VoIP powerhouse featuring Asterisk 16, the FreePBX 15 GPL platform including User Control Panel (UCP), an Apache web server, the latest MariaDB SQL server (formerly MySQL), SendMail, and the Incredible PBX feature set including SIP, SMS, Opus, voice recognition, PicoTTS Text-to-Speech VoIP applications plus fax support, Click-to-Dial, News, Weather, Reminders, ODBC, and hundreds of features that typically are found in commercial PBXs: Conferencing, IVRs and AutoAttendants, Email Delivery of Voicemail, and much more.

Choosing a SIP Provider. Incredible PBX 16-15 comes preconfigured with support for five SIP extensions and four of the major SIP providers: Skyetel, VoIP.ms, V1VoIP, and Anveo Direct. We obviously hope you’ll choose Skyetel not only because they financially support Nerd Vittles and our open source projects, but also because it is a clearly superior platform offering crystal-clear communications and triple-redundancy so you never miss a call. Skyetel also sets itself apart from the other providers in the support department. They actually respond to issues, and there’s never a charge. As the old saying goes, they may not be the cheapest, but you get what you pay for. Even without taking advantage of Nerd Vittles half-price offer on up to $500 of Skyetel services, they’re still dirt cheap compared to the Bell Sisters and cable companies. Traditional DIDs are $1 per month. Outbound conversational calls are $0.012 per minute. Incoming conversational calls are a penny a minute, and CallerID lookups are $0.004. With all four providers, you only pay for minutes you use. Using more than one is a good idea.

Choosing a Platform for Incredible PBX 16-15

As with our other open source offerings, the platform choice for Incredible PBX 16-15 depends upon a number of factors. For most folks, you’d be crazy to go out and purchase hardware to use in your home or office when cloud-based platforms are available for about a dollar a month. Unless you plan to publicly expose your server on the Internet to facilitate remote SIP connections, the OpenVZ offerings below are perfectly adequate while in business with the cautionary note that you need off-site backups AND a tested backup plan. Three providers previously listed have closed their doors in 2019. You’ve been warned.

ProviderRAMDiskBandwidthPerformance as of 12/1/19Cost
CrownCloud KVM (LA)1GB20GB +
Snapshot
1TB/month598Mb/DN 281Mb/UP
2CPU Core
$25/year
Best Buy!
Naranjatech KVM (The Netherlands)1GB20GB1TB/monthHosting since 2005
VAT: EU res.
20€/year w/code:
SBF2019
BudgetNode KVM (LA)1GB40GB RAID101TB/monthAlso available in U.K PM @Ishaq on LET before payment$24/year
FreeRangeCloud KVM (Ashburn VA, Winnipeg, Freemont CA)1GB20GB SSD3TB/monthPick EGG loc'n
Open ticket for last 5GB SSD
$30/year w/code:
LEBEGG30

Installing Incredible PBX 16-15 with CentOS 7

If you’ve installed previous iterations of Incredible PBX, today’s drill is similar. Here is a thumbnail sketch of the install procedure for Incredible PBX 16-15. Begin by installing a minimal CentOS 7 (64-bit) platform or pick the CentOS 7 option with 1GB RAM and 20GB of storage from your cloud provider’s menu of choices. Then log into your server as root and issue the following commands:

passwd
yum -y update
yum -y install net-tools nano wget tar
wget http://incrediblepbx.com/incrediblepbx16-15.1.tar.gz
tar zxvf incrediblepbx16-15.1.tar.gz
rm -f incrediblepbx16-15.1.tar.gz
# to add swap file on non-OpenVZ cloud platforms with no swap file
./create-swapfile-DO
# kick off Phase I install
./IncrediblePBX16-15.sh
# after reboot, kick off Phase II install
./IncrediblePBX16-15.sh
# add HylaFax/AvantFax, if desired
./incrediblefax16.sh
# set desired timezone
./timezone-setup
# display your passwords
./show-passwords
# remember to enable TUN/TAP if using VPS Control Panel with OpenVZ
# reconfigure PortKnocker if installing on an OpenVZ platform
echo 'OPTIONS="-i venet0:0"' >> /etc/sysconfig/knockd
service knockd restart
# set up NeoRouter VPN client, if desired
nrclientcmd
# check network speed
wget -O speedtest-cli https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py
chmod +x speedtest-cli
./speedtest-cli

WebMin is also installed and configured as part of the base install. The root password for access is the same as your Linux root password. We strongly recommend that you not use WebMin to make configuration changes to your server. You may inadvertently damage the operation of your PBX beyond repair. WebMin is an excellent tool to LOOK at how your server is configured. When used for that purpose, we highly recommend WebMin as a way to become familiar with your Linux configuration.

Planning Ahead for That Rainy Day

If you haven’t already learned the hard way, let us save you from a future shock. Hardware fails. All of it. So spend an extra hour now so that you’ll be prepared when (not if) disaster strikes. First, once you have your new PBX configured the way you plan to use it, make a backup of your PBX by running the Incredible Backup script: /root/incrediblebackup16

Copy down the name of the backup file that was created. You’ll need it in a few minutes.

Second, build yourself an identical VirtualBox platform on your desktop PC. It’s the same steps as outlined above.

Next, create a /backup folder on your VirtualBox PBX and copy the backup file from your main server to your VirtualBox server and restore it after logging in to VirtualBox PBX as root:

mkdir /backup
scp root@main-pbx-ip-address:/backup/backup-file-name.tar.gz /backup/.
/root/incrediblerestore16 /backup/backup-file-name.tar.gz

Complaints that you "forgot" to make a backup and your hardware has failed or your provider has gone out of business are not welcomed. We’re sorry for your loss. Case closed.

Completing the Incredible PBX Setup Procedure

Unless your desktop PC and server are both on the same private LAN, the install procedure should be performed from a desktop PC using SSH or Putty. This will insure that your desktop PC is also whitelisted in the Incredible PBX firewall. Using the console to perform the install is NOT recommended as your desktop PC will not be whitelisted in the firewall. This may result in your not being able to log in to your server. Once you have network connectivity, log in to your server as root from a desktop PC using your root password. Accept the license agreement by pressing ENTER.

Kick off the Phase I install. Once your server reboots and you log back in as root, start the Phase II install. All of your passwords will be randomly assigned with the exception of the root user Linux password. You can set it at any time by issuing the command: passwd. With the exception of your root user password, the remaining passwords can be displayed using the command: /root/show-passwords.

Finally, if your PBX is sitting behind a NAT-based router, you’ll need to redirect incoming UDP 5060 and UDP 10000-20000 traffic to the private IP address of your PBX. This is required for all of the SIP providers included in the Incredible PBX 16-15 default build. Otherwise, inbound calls will fail.

Configuring Skyetel for Incredible PBX 16-15

If you’ve decided to go with Skyetel, here’s the drill. Sign up for Skyetel service and take advantage of the Nerd Vittles BOGO special. First, complete the Prequalification Form here. You then will be provided a link to the Skyetel site to complete your registration. Once you have registered on the Skyetel site and your account has been activated, open a support ticket and request the BOGO credit for your account by referencing the Nerd Vittles special offer. Skyetel will match your deposit of up to $250 which gets you up to $500 of helf-price calling. Credit is limited to one per person/company/address/location. Effective 10/1/2023, $25/month minimum spend required.

Skyetel does not use SIP registrations to make connections to your PBX. Instead, Skyetel utilizes Endpoint Groups to identify which servers can communicate with the Skyetel service. An Endpoint Group consists of a Name, an IP address, a UDP or TCP port for the connection, and a numerical Priority for the group. For incoming calls destined to your PBX, DIDs are associated with an Endpoint Group to route the calls to your PBX. For outgoing calls from your PBX, a matching Endpoint Group is required to authorize outbound calls through the Skyetel network. Thus, the first step in configuring the Skyetel side for use with your PBX is to set up an Endpoint Group. Here’s a typical setup for Incredible PBX 16-15:

  • Name: MyPBX
  • Priority: 1
  • IP Address: PBX-Public-IP-Address
  • Port: 5060
  • Protocol: UDP
  • Description: my.incrediblepbx.com

To receive incoming PSTN calls, you’ll need at least one DID. On the Skyetel site, you acquire DIDs under the Phone Numbers tab. You have the option of Porting in Existing Numbers (free for the first 60 days after you sign up for service) or purchasing new ones under the Buy Phone Numbers menu option.

Once you have acquired one or more DIDs, navigate to the Local Numbers or Toll Free Numbers tab and specify the desired SIP Format and Endpoint Group for each DID. Add SMS/MMS and E911 support, if desired. Call Forwarding and Failover are also supported. That completes the VoIP setup on the Skyetel side. System Status is always available here.

Configuring VoIP.ms for Incredible PBX 16-15

To sign up for VoIP.ms service, may we suggest you use our signup link so that Nerd Vittles gets a referral credit for your signup. Once your account is set up, you’ll need to set up a SIP SubAccount and, for Authentication Type, choose Static IP Authentication and enter your Incredible PBX 16-15 server’s public IP address. For Transport, choose UDP. For Device Type, choose Asterisk, IP PBX, Gateway or VoIP Switch. Order a DID in their web panel, and then point the DID to the SubAccount you just created. Be sure to specify atlanta1.voip.ms as the POP from which to receive incoming calls.

Configuring V1VoIP for Incredible PBX 16-15

To sign up for V1VoIP service, sign up on their web site. Then login to your account and order a DID under the DIDs tab. Once the DID has been assigned, choose View DIDs and click on the Forwarding button beside your DID. For Option #1, choose Forward to IP Address/PBX. For the Forwarding Address, enter the public IP address of your server. For the T/O (timeout) value, set it to 2o seconds. Then click the Update button. Under the Termination tab, create a new Endpoint with the public IP address of your server so that you can place outbound calls through V1VoIP.

Configuring Anveo Direct for Incredible PBX 16-15

To sign up for Anveo Direct service, sign up on their web site and then login. After adding funds to your account, purchase a DID under Inbound Service -> Order DID. Next, choose Configure Destination SIP Trunk. Give the Trunk a name. For the Primary SIP URI, enter $[E164]$@server-IP-address. For Call Options, select your new DID from the list. You also must whitelist your public IP address under Outbound Service -> Configure. Create a new Call Termination Trunk and name it to match your server. For Dialing Prefix, choose six alphanumeric characters beginning with a zero. In Authorized IP Addresses, enter the public IP address of your server. Set an appropriate rate cap. We like $0.01 per minute to be safe. Set a concurrent calls limit. We like 2. For the Call Routing Method, choose Least Cost unless you’re feeling extravagant. For Routes/Carriers, choose Standard Routes. Write down your Dialing Prefix and then click the Save button.

Before you can make outbound calls through Anveo Direct from your PBX, you first must configure the Dialing Prefix that you wrote down in the previous step. Log into the GUI as admin using a web browser and edit the Anveo-Out trunk in Connectivity -> Trunks. Click on the custom-Settings tab and replace anveo-pin with your actual Dialing Prefix. Click Submit and Apply Config to complete the setup.

By default, incoming Anveo Direct calls will be processed by the Default inbound route on your PBX. If you wish to redirect incoming Anveo Direct calls using DID-specific inbound routes, then you’ve got a bit more work to do. In addition to creating the inbound route using the 11-digit Anveo Direct DID, enter the following commands after logging into your server as root using SSH/Putty:

cd /etc/asterisk
echo "[from-anveo]" >> extensions_custom.conf
echo "exten => _.,1,Ringing" >> extensions_custom.conf
echo "exten => _.,n,Goto(from-trunk,\\${SIP_HEADER(X-anveo-e164)},1)" >> extensions_custom.conf
asterisk -rx "dialplan reload"

Configuring a Softphone for Incredible PBX 16-15

We’re in the home stretch now. You can connect virtually any kind of telephone to your new PBX. Plain Old Phones require an analog telephone adapter (ATA) which can be a separate board in your computer from a company such as Digium. Or it can be a standalone SIP device such as ObiHai’s OBi100 or OBi110 (if you have a phone line from Ma Bell to hook up as well). SIP phones can be connected directly so long as they have an IP address. These could be hardware devices or software devices such as the YateClient softphone. We’ll start with a free one today so you can begin making calls. You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum when you’re ready to get serious about VoIP telephony.

We recommend YateClient which is free. Download it from here. Run YateClient once you’ve installed it and enter the credentials for the 701 extension on Incredible PBX. You can find them by running /root/show-passwords. You’ll need the IP address of your server plus your extension 701 password. In the YateClient, fill in the blanks using the IP address of your Server, 701 for your Username, and whatever Password was assigned to the extension when you installed Incredible PBX. Click OK to save your entries.

Once you are registered to extension 701, close the Account window. Then click on YATE’s Telephony Tab and place some test calls to the numerous apps that are preconfigured on Incredible PBX. Dial a few of these to get started:

DEMO - Apps Demo
123 - Reminders
947 - Weather by ZIP Code
951 - Yahoo News
TODAY - Today in History
LENNY - The Telemarketer's Worst Nightmare

If you are a Mac user, another great no-frills softphone is Telephone. Just download and install it from the Mac App Store. For Android users, check out the terrific new VitalPBX Communicator. Works flawlessly with Incredible PBX.

Audio Issues with Incredible PBX 16-15

Only if you experience one-way or no audio on some calls, add your external IP address and LAN subnet in the GUI by navigating to Settings -> Asterisk SIP Settings. In the NAT Settings section, click Detect Network Settings. Click Submit and Apply Settings to save your changes.

Incredible PBX 16-15 Administration

We’ve eased the pain of administering your new PBX with a collection of scripts which you will find in the /root folder after logging in with SSH or Putty. Here’s a quick summary of what each of the scripts does.

add-fqdn is used to whitelist a fully-qualified domain name in the firewall. Because Incredible PBX 16-15 blocks all traffic from IP addresses that are not whitelisted, this is what you use to authorize an external user for your PBX. The advantage of an FQDN is that you can use a dynamic DNS service to automatically update the IP address associated with an FQDN so that you never lose connectivity.

add-ip is used to whitelist a public IP address in the firewall. See the add-fqdn explanation as to why this matters.

del-acct is used to remove an IP address or FQDN from the firewall’s whitelist.

reset-conference-pins is a script that automatically and randomly resets the user and admin pins for access to the preconfigured conferencing application. Dial C-O-N-F from any registered SIP phone to connect to the conference.

reset-extension-passwords is a script that automatically and randomly resets ALL of the SIP passwords for extensions 701-705. Be careful using this one, or you may disable existing registered phones and cause Fail2Ban to blacklist the IP addresses of those users. HINT: You can place a call to the Ring Group associated with all five extensions by dialing 777.

reset-reminders-pin is a script that automatically and randomly resets the pin required to access the Telephone Reminders application by dialing 123. It’s important to protect this application because a nefarious user could set up a reminder to call a number anywhere in the world assuming your SIP provider’s account was configured to allow such calls.

show-feature-codes is a cheat sheet for all of the feature codes which can be dialed from any registered SIP phone. It documents how powerful a platform Incredible PBX 16-15 actually is. A similar listing is available in the GUI at Admin -> Feature Codes.

show-passwords is a script that displays ALL of the passwords associated with Incredible PBX 16-15. This includes SIP extension passwords, voicemail pins, conference pins, telephone reminders pin, and your Anveo Direct outbound calling pin (if configured). Note that voicemail pins are configured by the user of a SIP extension the first time the user accesses the voicemail system by dialing *97.

update-IncrediblePBX is the Automatic Update Utility which checks for server updates from incrediblepbx.com every time you log into your server as root using SSH or Putty. Do NOT disable it as it is used to load important fixes and security updates when necessary. We recommend logging into your server at least once a week.

pbxstatus (shown above) displays status of all major components of Incredible PBX 16-15.

Forwarding Calls to Your Cellphone. Keep in mind that inbound calls to your DIDs automatically ring all five SIP extensions, 701-705. The easiest way to also ring your cellphone is to set one of these five extensions to forward incoming calls to your cellphone. After logging into your PBX as root, issue the following command to forward calls from extension 705 to your cellphone: asterisk -rx "database put CF 705 6781234567"

To remove call forwarding: asterisk -rx "database del CF 705"

Configuring SendMail with Incredible PBX 16-15

In order to receive voicemails by email delivery, outbound mail functionality from your server obviously is required. If you’ve deployed your server in your home, your Internet Service Provider probably blocks downstream mail servers such as Incredible PBX from sending mail. This is done to reduce SPAM. In this case, you will need to configure SendMail using either your ISP or Gmail as an SMTP Relay Host. Here are the steps using a Gmail account:

cd /etc/mail
yum -y install sendmail-cf
hostname -f > genericsdomain
touch genericstable
makemap -r hash genericstable.db < genericstable
mv sendmail.mc sendmail.mc.original
wget http://incrediblepbx.com/sendmail.mc.gmail
cp sendmail.mc.gmail sendmail.mc
mkdir -p auth
chmod 700 auth
cd auth
echo AuthInfo:smtp.gmail.com \\"U:smmsp\\" \\"I:user_id\\" \\"P:password\\" \\"M:PLAIN\\" > client-info
echo AuthInfo:smtp.gmail.com:587 \\"U:smmsp\\" \\"I:user_id\\" \\"P:password\\" \\"M:PLAIN\\" >> client-info
echo AuthInfo:smtp.gmail.com:465 \\"U:smmsp\\" \\"I:user_id\\" \\"P:password\\" \\"M:PLAIN\\" >> client-info
# Stop here and edit client-info (nano -w client-info) in all three lines.
# Replace  user_id with your gMail account name without @gmail.com
# Replace password with your real gMail password
# Be sure to replace the double-quotes shown above if they don't appear in the file!!!
# Save your changes (Ctrl-X, Y, then Enter)
chmod 600 client-info
makemap -r hash client-info.db < client-info
cd ..
make
systemctl restart sendmail

If your server is hosted in the cloud and your provider does not block TCP port 25, then you can send mail without using a SmartHost; however, your server's hostname must actually be real or downstream mail servers will reject your mail. You can set your server's hostname like this: hostname myserver.myhost.com. This is usually sufficient; however, it's a good idea to also add the hostname in /etc/hostname and in /etc/hosts as the first entry on 127.0.0.1 line:

127.0.0.1   myserver.myhost.com pbx.local localhost localhost.localdomain

Next, test outbound mail using this command with your actual email address:

echo "test" | mail -s testmessage yourname@youremaildomain.com

Once you are sure your emails are being delivered reliably, here's a sample GUI voicemail configuration for an extension:



Getting Started with Incredible Fax 16

Believe it or not, there still are lots of folks that use faxes in their everyday lives. If you're one of them, Incredible PBX has your back. Begin by logging into your server as root and running incrediblefax16.sh to install HylaFax and AvantFax on your server. You'll be prompted a dozen or more times for information. Answer no to the secure fax question. For the rest of the prompts, just press ENTER to accept the default entries. Rebooting your server is required when the install finishes. Once your server is back on line, there will be a new AvantFax tab in the GUI. Before proceeding, be sure to set an Apache web apps password by running /root/apache-pw-change. Next, login to AvantFax with your browser. You first will be prompted for your Apache credentials. Enter admin for the username and whatever password you set up in the previous step. Then you will be prompted for your AvantFax credentials. The default is admin:password. After you enter the username and password, you will be prompted to change your admin password. The old password is still password. Then enter your desired password twice and save the setting. The AvantFax dashboard then will display. If nothing has come unglued, you should see four green Idle icons:



You can Send Faxes from within AvantFax by choosing the Send Fax tab, or you can use one of many HylaFax clients. Google is your friend.

Receiving faxes currently has issues not the least of which are fax detection being broken and incoming faxes never reaching the specified destination. We will continue to work on this and provide updates when they become available. For the time being, the simple workaround if you're using Skyetel as your provider is to designate a DID as a fax line (Call Routing: vFax) in the Skyetel Dashboard. Then Skyetel will manage the incoming faxes without any additional configuration on your PBX. You still can send faxes from within the AvantFax GUI.

Getting Started with ODBC for Asterisk

If you're new to the ODBC World, here's a quick primer. The idea behind Open Data Base Connectivity is to simplify the task of connecting up any flavor database management system so that it can talk to applications and foreign databases without having to write custom code to support every different DBMS. ODBC serves in much the same way as a translator who sits between you and foreign visitors. With the benefit of a translator, whatever is spoken is understood on both ends of the conversation. The real beauty of ODBC is that it is conversant with almost every DBMS offering on the planet including Oracle, Informix, SAS, MS Access, DB2, SQL Server, MySQL, MariaDB, PostgreSQL, Sybase, and even dBase, FoxPro, and XDB. All you really need is the ODBC connector for your operating system plus one or more database drivers for the DBMS data sources you wish to use.

Because the FreePBX modules are driven by MySQL tables, we've included the MySQL connector for Asterisk in Incredible PBX 16-15 together with two sample applications to get you started. If you add your own MySQL databases, it's easy to connect them with ODBC by simply running the odbc-gen.sh script in /root again. The two sample applications we've included will show you how to integrate ODBC queries into your Asterisk dialplan. The code is available in odbc.conf in the /etc/asterisk folder. The first sample is a typical employee database. By dialing 222, you will be prompted to enter the employee number (12345), and the ODBC app then will look up the employee number and read you the name of the employee. The second sample is a speed dialer using the AsteriDex database. The sample entries in the database include a 3-numeric-digit DIALCODE which simply matches the first three letters of each AsteriDex name spelled out on a phone, e.g. 335 = DELta Airlines and 263 = AMErican Airlines. As you add new entries to AsteriDex, you can add dialcodes in the same way or in any other scheme you prefer. Once you have signed up with a provider so that you can make outbound calls, just dial 223 and enter the AsteriDex dialcode to place the call. Think of it as a Speed Dialer on Steroids.

Where To Go From Here

Complete documentation on the FreePBX GPL Modules is available here.

Complete documentation on the Incredible PBX additions is available here.

An introduction to configuring extensions, trunks, and routes is available here.

Originally published: Monday, July 15, 2019



Need help with Asterisk? Visit the VoIP-info Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Introducing Incredible PBX 16 LITE for CentOS 7



We had a banner week with the introduction of Incredible PBX® LITE for Raspbian 10. What we heard privately from many users was that they’d always wanted a turnkey PBX that was preconfigured to make and receive calls. The irony of offering this platform without the FreePBX® GUI to celebrate Independence Day was not lost on many of our savvy supporters. And, while the bells and whistles were icing on the cake, many simply wanted a flexible VoIP platform that didn’t require going back to college. This week we’re upping the ante by introducing a similar Incredible PBX LITE platform for CentOS® 7 with a few major enhancements. First, you get the new Asterisk® 16 LTS version which will keep you chugging along with bug fixes and security updates for the next 4+ years. Second, we’ve replaced FLITE with PicoTTS for a much improved (free) text-to-speech platform. And finally, we’ve added WebMin and all the other Incredible PBX components that make Incredible PBX incredible. Will there be a new release of Incredible PBX 16 with the FreePBX GUI modules? Absolutely. And there may be a few, new surprises along the way as well. Stay tuned!

What’s Included? Despite its name, Incredible PBX LITE still serves up a VoIP powerhouse featuring Asterisk 16, an Apache web server, the latest MariaDB SQL server (formerly MySQL), SendMail, and most of the Incredible PBX feature set including SIP, SMS, Opus, voice recognition, PicoTTS Text-to-Speech VoIP applications plus fax support, Click-to-Dial, News, Weather, Reminders, and hundreds of features that typically are found in commercial PBXs: Conferencing, IVRs and AutoAttendants, Email Delivery of Voicemail, and much more.

What’s Missing? We’ve removed the entire FreePBX GUI platform while retaining most of its design engineering and feature set. We’ve also eliminated the need to run a web server or database server although they’re still there. And gone are the days of having to configure extensions and trunks as well as inbound and outbound routes before you can actually use your PBX to make your first call. The tradeoff is a noticeable performance improvement.

Choosing a SIP Provider. Incredible PBX LITE comes preconfigured to support five SIP extensions and four of the major SIP providers: Skyetel, VoIP.ms, V1VoIP, and Anveo Direct. We obviously hope you’ll choose Skyetel not only because they financially support Nerd Vittles and our open source projects, but also because it is a clearly superior platform offering crystal-clear communications and triple-redundancy so you never miss a call. Skyetel also sets itself apart from the other providers in the support department. They actually respond to issues, and there’s never a charge. As the old saying goes, they may not be the cheapest, but you get what you pay for. Even without taking advantage of Nerd Vittles half-price offer on up to $500 of Skyetel services, they’re still dirt cheap compared to the Bell Sisters and cable companies. Traditional DIDs are $1 per month. Outbound conversational calls are $0.012 per minute. Incoming conversational calls are a penny a minute, and CallerID lookups are $0.004. With all four providers, you only pay for minutes you use. Using more than one is a good idea.

Choosing a Platform for Incredible PBX 16 LITE

As with our other open source offerings, the platform choice for Incredible PBX 16 LITE depends upon a number of factors. For most folks, you’d be crazy to go out and purchase hardware to use in your home or office when cloud-based platforms are available for about a dollar a month. Unless you plan to publicly expose your server on the Internet to facilitate remote SIP connections, the OpenVZ offerings below are perfectly adequate while in business with the cautionary note that you need off-site backups AND a tested backup plan. Three providers previously listed have closed their doors in 2019. You’ve been warned.

ProviderRAMDiskBandwidthPerformance as of 12/1/19Cost
CrownCloud KVM (LA)1GB20GB +
Snapshot
1TB/month598Mb/DN 281Mb/UP
2CPU Core
$25/year
Best Buy!
Naranjatech KVM (The Netherlands)1GB20GB1TB/monthHosting since 2005
VAT: EU res.
20€/year w/code:
SBF2019
BudgetNode KVM (LA)1GB40GB RAID101TB/monthAlso available in U.K PM @Ishaq on LET before payment$24/year
FreeRangeCloud KVM (Ashburn VA, Winnipeg, Freemont CA)1GB20GB SSD3TB/monthPick EGG loc'n
Open ticket for last 5GB SSD
$30/year w/code:
LEBEGG30

Installing Incredible PBX 16 LITE with CentOS 7

If you’ve installed previous iterations of Incredible PBX, today’s drill is similar. Here is a thumbnail sketch of the install procedure for Incredible PBX 16 LITE. Begin by installing a minimal CentOS 7 (64-bit) platform or pick the CentOS 7 option with 1GB RAM and 20GB of storage from your cloud provider’s menu of choices. Then log into your server as root and issue the following commands:

passwd
yum -y update
yum -y install net-tools nano wget tar
wget http://incrediblepbx.com/incrediblepbx-16-LITE.tar.gz
tar zxvf incrediblepbx-16-LITE.tar.gz
rm -f incrediblepbx-16-LITE.tar.gz
# to add swap file on non-OpenVZ cloud platforms with no swap file
./create-swapfile-DO
# kick off Phase I install
./IncrediblePBX16-LITE.sh
# after reboot, kick off Phase II install
./IncrediblePBX16-LITE.sh
# add HylaFax/AvantFax, if desired
./incrediblefax13.sh
# set desired timezone
./timezone-setup
# set new extension passwords
./reset-extension-passwords
# remember to enable TUN/TAP if using VPS Control Panel with OpenVZ
# reconfigure PortKnocker if installing on an OpenVZ platform
echo 'OPTIONS="-i venet0:0"' >> /etc/sysconfig/knockd
service knockd restart
# set up NeoRouter VPN client, if desired
nrclientcmd
# check network speed
wget -O speedtest-cli https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py
chmod +x speedtest-cli
./speedtest-cli

Planning Ahead for That Rainy Day

If you haven’t already learned the hard way, let us save you from a future shock. Hardware fails. All of it. So spend an extra hour now so that you’ll be prepared when (not if) disaster strikes. First, once you have your new PBX configured the way you plan to use it, make a backup of your PBX by running the Incredible Backup script: /root/incrediblebackup13

Copy down the name of the backup file that was created. You’ll need it in a few minutes.

Second, build yourself an identical VirtualBox platform on your desktop PC. It’s the same steps as outlined above.

Next, create a /backup folder on your VirtualBox PBX and copy the backup file from your main server to your VirtualBox server and restore it after logging in to VirtualBox PBX as root:

mkdir /backup
scp root@main-pbx-ip-address:/backup/backup-file-name.tar.gz /backup/.
/root/incrediblerestore13 /backup/backup-file-name.tar.gz

Complaints that you "forgot" to make a backup and your hardware has failed or your provider has gone out of business are not welcomed. We’re sorry for your loss. Case closed.

Completing the Incredible PBX Setup Procedure

Unless your desktop PC and server are both on the same private LAN, the install procedure should be performed from a desktop PC using SSH or Putty. This will insure that your desktop PC is also whitelisted in the Incredible PBX firewall. Using the console to perform the install is NOT recommended as your desktop PC will not be whitelisted in the firewall. This may result in your not being able to log in to your server. Once you have network connectivity, log in to your server as root from a desktop PC using your root password. Accept the license agreement by pressing ENTER.

Kick off the Phase I install. Once your server reboots and you log back in as root, start the Phase II install. All of your passwords will be randomly assigned with the exception of the root user Linux password. You can set it at any time by issuing the command: passwd. With the exception of your root user password, the remaining passwords can be displayed using the command: /root/show-passwords.

Finally, if your PBX is sitting behind a NAT-based router, you’ll need to redirect incoming UDP 5060 and UDP 10000-20000 traffic to the private IP address of your PBX. This is required for all of the SIP providers included in the Incredible PBX LITE build. Otherwise, all inbound calls will fail.

Configuring Skyetel for Incredible PBX 16 LITE

If you’ve decided to go with Skyetel, here’s the drill. Sign up for Skyetel service and take advantage of the Nerd Vittles BOGO special. First, complete the Prequalification Form here. You then will be provided a link to the Skyetel site to complete your registration. Once you have registered on the Skyetel site and your account has been activated, open a support ticket and request the BOGO credit for your account by referencing the Nerd Vittles special offer. Skyetel will match your deposit of up to $250 which gets you up to $500 of helf-price calling. Credit is limited to one per person/company/address/location. Effective 10/1/2023, $25/month minimum spend required.

Skyetel does not use SIP registrations to make connections to your PBX. Instead, Skyetel utilizes Endpoint Groups to identify which servers can communicate with the Skyetel service. An Endpoint Group consists of a Name, an IP address, a UDP or TCP port for the connection, and a numerical Priority for the group. For incoming calls destined to your PBX, DIDs are associated with an Endpoint Group to route the calls to your PBX. For outgoing calls from your PBX, a matching Endpoint Group is required to authorize outbound calls through the Skyetel network. Thus, the first step in configuring the Skyetel side for use with your PBX is to set up an Endpoint Group. Here’s a typical setup for Incredible PBX LITE:

  • Name: MyPBX
  • Priority: 1
  • IP Address: PBX-Public-IP-Address
  • Port: 5060
  • Protocol: UDP
  • Description: lite1.incrediblepbx.com

To receive incoming PSTN calls, you’ll need at least one DID. On the Skyetel site, you acquire DIDs under the Phone Numbers tab. You have the option of Porting in Existing Numbers (free for the first 60 days after you sign up for service) or purchasing new ones under the Buy Phone Numbers menu option.

Once you have acquired one or more DIDs, navigate to the Local Numbers or Toll Free Numbers tab and specify the desired SIP Format and Endpoint Group for each DID. Add SMS/MMS and E911 support, if desired. Call Forwarding and Failover are also supported. That completes the VoIP setup on the Skyetel side. System Status is always available here.

Configuring VoIP.ms for Incredible PBX LITE

To sign up for VoIP.ms service, may we suggest you use our signup link so that Nerd Vittles gets a referral credit for your signup. Once your account is set up, you’ll need to set up a SIP SubAccount and, for Authentication Type, choose Static IP Authentication and enter your Incredible PBX LITE server’s public IP address. For Transport, choose UDP. For Device Type, choose Asterisk, IP PBX, Gateway or VoIP Switch. Order a DID in their web panel, and then point the DID to the SubAccount you just created. Be sure to specify atlanta1.voip.ms as the POP from which to receive incoming calls.

Configuring V1VoIP for Incredible PBX LITE

To sign up for V1VoIP service, sign up on their web site. Then login to your account and order a DID under the DIDs tab. Once the DID has been assigned, choose View DIDs and click on the Forwarding button beside your DID. For Option #1, choose Forward to IP Address/PBX. For the Fowarding Address, enter the public IP address of your server. For the T/O (timeout) value, set it to 2o seconds. Then click the Update button. Under the Termination tab, create a new Endpoint with the public IP address of your server so that you can place outbound calls through V1VoIP.

Configuring Anveo Direct for Incredible PBX LITE

To sign up for Anveo Direct service, sign up on their web site and then login. After adding funds to your account, purchase a DID under Inbound Service -> Order DID. Next, choose Configure Destination SIP Trunk. Give the Trunk a name. For the Primary SIP URI, enter $[E164]$@server-IP-address. For Call Options, select your new DID from the list. You also must whitelist your public IP address under Outbound Service -> Configure. Create a new Call Termination Trunk and name it to match your server. For Dialing Prefix, choose six alphanumeric characters beginning with a zero. In Authorized IP Addresses, enter the public IP address of your server. Set an appropriate rate cap. We like $0.01 per minute to be safe. Set a concurrent calls limit. We like 2. For the Call Routing Method, choose Least Cost unless you’re feeling extravagant. For Routes/Carriers, choose Standard Routes. Write down your Dialing Prefix and then click the Save button.

Before you can make outbound calls through Anveo Direct from your PBX, you first must configure the Dialing Prefix that you wrote down in the previous step. Newer downloads include an add-anveo-pin script to update your PIN in Incredible PBX. If you don’t have the script, login to your server as root and use nano to edit extensions_additional.conf in the /etc/asterisk directory. Search (Ctl-W) for anveo-pin and replace anveo-pin with the 6-digit alphanumeric PIN for your account. Press Ctrl-X, Y, then Enter to save your settings. Reload your dialplan with the command: asterisk -rx "dialplan reload"

Configuring a Softphone for Incredible PBX LITE

We’re in the home stretch now. You can connect virtually any kind of telephone to your new PBX. Plain Old Phones require an analog telephone adapter (ATA) which can be a separate board in your computer from a company such as Digium. Or it can be a standalone SIP device such as ObiHai’s OBi100 or OBi110 (if you have a phone line from Ma Bell to hook up as well). SIP phones can be connected directly so long as they have an IP address. These could be hardware devices or software devices such as the YateClient softphone. We’ll start with a free one today so you can begin making calls. You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum when you’re ready to get serious about VoIP telephony.

We recommend YateClient which is free. Download it from here. Run YateClient once you’ve installed it and enter the credentials for the 701 extension on Incredible PBX. You can find them by running /root/show-passwords. You’ll need the IP address of your server plus your extension 701 password. In the YateClient, fill in the blanks using the IP address of your Server, 701 for your Username, and whatever Password was assigned to the extension when you installed Incredible PBX. Click OK to save your entries.

Once you are registered to extension 701, close the Account window. Then click on YATE’s Telephony Tab and place some test calls to the numerous apps that are preconfigured on Incredible PBX. Dial a few of these to get started:

DEMO - Apps Demo
123 - Reminders
947 - Weather by ZIP Code
951 - Yahoo News
TODAY - Today in History
LENNY - The Telemarketer's Worst Nightmare

If you are a Mac user, another great no-frills softphone is Telephone. Just download and install it from the Mac App Store.

Audio Issues with Incredible PBX LITE

Only if you experience one-way or no audio on some calls, add your external IP address and LAN subnet in /etc/asterisk/sip_general_custom.conf like the following example:

nat=force_rport,comedia
externip=xxx.xxx.xxx.xxx
localnet=192.168.0.0/255.255.0.0 

Then issue the following commands:

sed -i 's|nat=no|nat=force_rport,comedia|' /etc/asterisk/sip_additional.conf
systemctl restart asterisk

Displaying Formatted CDR Data

By default, web access is limited to whitelisted IP addresses so it’s safe to access your Call Detail Report (CDR) using a browser. Unfortunately, the only browser that currently handles this with automatic formatting is Firefox. To begin, install the FireCSV extension in Firefox. Next, log in to your server as root and change to the /var/www/html folder. Issue the command ln -s /var/log/asterisk/cdr-csv/Master.csv mycdr.csv to create a symlink to your CSV data. Now you can access your CDR data with Firefox by navigating to http://server-ip/mycdr.csv.

There’s also a simple way to display CSV files from the Linux command line using this tip from StackOverflow:

column -s, -t < /var/log/asterisk/cdr-csv/Master.csv | less -#2 -N -S

Incredible PBX LITE Administration

We've eased the pain of administering your new PBX with a collection of scripts which you will find in the /root folder after logging in with SSH or Putty. Here's a quick summary of what each of the scripts does.

add-fqdn is used to whitelist a fully-qualified domain name in the firewall. Because Incredible PBX LITE blocks all traffic from IP addresses that are not whitelisted, this is what you use to authorize an external user for your PBX. The advantage of an FQDN is that you can use a dynamic DNS service to automatically update the IP address associated with an FQDN so that you never lose connectivity.

add-ip is used to whitelist a public IP address in the firewall. See the add-fqdn explanation as to why this matters.

del-acct is used to remove an IP address or FQDN from the firewall's whitelist.

add-anveo-pin is used to add or update your Anveo Direct outbound calling PIN.

reset-conference-pins is a script that automatically and randomly resets the user and admin pins for access to the preconfigured conferencing application. Dial C-O-N-F from any registered SIP phone to connect to the conference.

reset-extension-passwords is a script that automatically and randomly resets ALL of the SIP passwords for extensions 701-705. Be careful using this one, or you may disable existing registered phones and cause Fail2Ban to blacklist the IP addresses of those users. HINT: You can place a call to the Ring Group associated with all five extensions by dialing 777.

reset-reminders-pin is a script that automatically and randomly resets the pin required to access the Telephone Reminders application by dialing 123. It's important to protect this application because a nefarious user could set up a reminder to call a number anywhere in the world assuming your SIP provider's account was configured to allow such calls.

show-feature-codes is a cheat sheet for all of the feature codes which can be dialed from any registered SIP phone. It documents how powerful a platform Incredible PBX 16 LITE actually is.

show-passwords is a script that displays ALL of the passwords associated with Incredible PBX 16 LITE. This includes SIP extension passwords, voicemail pins, conference pins, telephone reminders pin, and your Anveo Direct outbound calling pin (if configured). Note that voicemail pins are configured by the user of a SIP extension the first time the user accesses the voicemail system by dialing *97.

update-IncrediblePBX is the Automatic Update Utility which checks for server updates from incrediblepbx.com every time you log into your server as root using SSH or Putty. Do NOT disable it as it is used to load important fixes and security updates when necessary. We recommend logging into your server at least once a week.

pbxstatus (shown above) displays status of all major components of Incredible PBX 16 LITE.

Call Detail Records available in spreadsheet format at /var/log/asterisk/cdr-csv/Master.csv.

Forwarding Calls to Your Cellphone. Keep in mind that inbound calls to your DIDs automatically ring all five SIP extensions, 701-705. The easiest way to also ring your cellphone is to set one of these five extensions to forward incoming calls to your cellphone. After logging into your PBX as root, issue the following command to forward calls from extension 705 to your cellphone: asterisk -rx "database put CF 705 6781234567"

To remove call forwarding: asterisk -rx "database del CF 705"

Originally published: Monday, July 8, 2019



Need help with Asterisk? Visit the VoIP-info Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Introducing Incredible PBX LITE featuring Raspbian 10



As you may know, the Raspberry Pi Foundation introduced the $35 Raspberry Pi 4 last week. In addition to jaw-dropping hardware enhancements, the introduction also included the new Raspbian 10 (Buster) platform which was surprising since Debian 10 isn’t scheduled for official release until the end of this week. As with prior releases, Raspbian 10 brought with it some major headaches for the VoIP community not the least of which is FreePBX® cannot (yet) be installed. But sometimes there’s a silver lining accompanying bad news.

Several Debian 10 issues caused us to rethink what a VoIP platform for the Raspberry Pi actually should look like. After all, most Raspberry Pi hobbyists aren’t interested in mastering the intricacies of Asterisk® and FreePBX. They’re more concerned with a stable, fast VoIP communications platform that’s easy to deploy and will operate without hiccups in a home or small office environment. Thus was born Incredible PBX LITE, a new turnkey VoIP platform that requires zero configuration out of the box and supports five SIP telephones and up to four trunk providers for low-cost worldwide calling. Simply sign up with one of these VoIP service providers, acquire a telephone number (DID), enter the IP address of your PBX, and you can instantly make and receive calls using up to five SIP telephones or softphones.

UPDATE: If you’d prefer the full-featured Incredible PBX 16-15 for the Raspberry Pi, it’s now available here as well.

What’s Included? Despite its name, Incredible PBX LITE still serves up a VoIP powerhouse featuring Asterisk 13, an Apache web server, the latest MariaDB SQL server (formerly MySQL), SendMail, and most of the Incredible PBX feature set including SIP, SMS, Opus, voice recognition, FLITE Text-to-Speech VoIP applications plus fax support, Click-to-Dial, News, Weather, Reminders, and hundreds of features that typically are found in commercial PBXs: Conferencing, IVRs and AutoAttendants, Email Delivery of Voicemail, Voicemail Blasting…

What’s Missing? We’ve removed the entire FreePBX GUI platform while retaining most of its feature set. We’ve also eliminated the need to run a web server or database server although they’re still there. And gone are the days of having to configure extensions and trunks as well as inbound and outbound routes before you can actually use your PBX to make your first call. The tradeoff is a noticeable performance improvement. While a Raspberry Pi 4 isn’t required to run Incredible PBX LITE, doing so provides another three-fold performance boost compared to a Raspberry Pi 3B+. Simply stated, Incredible PBX LITE performance now rivals what you would expect on a powerful cloud-based platform such as Digital Ocean or Vultr.

Choosing a SIP Provider. As we mentioned, Incredible PBX LITE comes preconfigured to support four of the major SIP providers: Skyetel, VoIP.ms, V1VoIP, and Anveo Direct. We obviously hope you’ll choose Skyetel not only because they financially support Nerd Vittles and our open source projects, but also because it is a clearly superior platform offering crystal-clear communications and triple-redundancy so you never miss a call. Skyetel also sets itself apart from the other providers in the support department. They actually respond to issues, and there’s never a charge. As the old saying goes, they may not be the cheapest, but you get what you pay for. Even without taking advantage of Nerd Vittles half-price offer on up to $500 of Skyetel services, they’re still dirt cheap compared to the Bell Sisters and cable companies. Traditional DIDs are $1 per month. Outbound conversational calls are $0.012 per minute. Incoming conversational calls are a penny a minute, and CallerID lookups are $0.004. With all four providers, you only pay for minutes you use. Using more than one is a good idea. Effective 10/1/2023, $25/month minimum spend required.


Assembling the Required Raspberry Pi Components

Before you can deploy Incredible PBX LITE, you’ll first need the necessary Raspberry Pi hardware. Here’s the short list and, if you’re in a hurry, the $35 Raspberry Pi 3B+ will cost you less than $3 extra to get it quickly from Amazon using our referral link. If you prefer to wait for a Raspberry Pi 4, read on. Either way, the RasPi remains one of the world’s best bargains! Assuming you already own an HDMI-compatible monitor and a USB keyboard

  • Raspberry Pi 4B from a Raspberry Pi reseller
  • $8 15.3W USB-C RasPi 4 (only) Power Supply
  • $8 32GB microSDHC Class 10 card (strongly recommended!)
  • $5 Official RasPi 4 Case
  • Getting Started with Incredible PBX LITE

    Here’s everything to know about installation and setup. "Automatic" means just watch. Steps #1 and #2 are self-explanatory. For the remaining steps, we’ll further document the procedures in the sections below.

    1. Download and unzip Incredible PBX LITE image from SourceForge
    2. Transfer Incredible PBX LITE image to microSD card
    3. Boot Raspberry Pi from new microSD card (16GB minimum)
    4. Login to RasPi console as root:password to initialize your server (Automatic)
    5. In raspi-config Advanced Options, Expand FileSystem to fill your SD card
    6. In Localization Options, set Locale, TimeZone, Keyboard, & WiFi Country
    7. Reboot after writing down your server IP address (Automatic)
    8. Login via SSH or Putty as root:password to set passwords & setup firewall (Automatic)
    9. Register for and configure at least one trunk provider for Incredible PBX LITE
    10. Install Incredible Fax: /root/incrediblefax13_raspi3.sh (Credentials: admin:password)

    First Boot of Incredible PBX LITE with Wi-Fi

    Incredible PBX LITE requires Internet connectivity to complete its automated install. If you’re using a wired network connection, you can skip to the next section. With the Raspberry Pi 3B and 4B, WiFi is built into the hardware. But you still have to insert your SSID name and SSID password to make a connection to your WiFi network. To do so, follow these next steps carefully. Insert the Incredible PBX LITE microSD card into your Raspberry Pi 3 or 4 and apply power to the hardware. When the bootup procedure finishes, login as root with the default password: password. At the first prompt, DO NOT PRESS THE ENTER KEY! Instead, press Ctrl-C to break out of the setup script. At the command prompt, issue the following commands to bring up the WiFi config file:

    cd /etc/wpa_supplicant
    nano -w wpa_supplicant.conf
    

    If your WiFi network does not require a password, then uncomment the four lines below and save the file: Ctrl-X, Y, then Enter. Now restart your server: reboot. When the reboot finishes, you now should have network connectivity.

    network={
     key_mgmt=NONE
     priority=1
    }
    

    If your WiFi network requires a password, scroll down to the SSID entry and replace YourSSID with the actual SSID of your WiFi network. Make sure you preserve the entry with the quotes as shown. Next, replace YourSSIDpassword with the SSID password of your WiFi network. Save the file: Ctrl-X, Y, then Enter. Now restart your server: reboot. When the reboot finishes, you now should have network connectivity.

    Once the reboot process finishes, you should see an entry on about the middle line displayed on your monitor which reads: "My IP address is…". Write down the IP address shown. You’ll need it in a minute. Skip the next section since you are using a WiFi connection.

    If you don’t see an IP address assigned to your server, then correct the network deficiency (invalid WiFi credentials, DHCP not working, Internet down), and reboot until you see an IP address assigned to your server. DO NOT PROCEED WITHOUT AN ASSIGNED IP ADDRESS.

    First Boot of Incredible PBX Using Wired Connection

    Incredible PBX LITE requires Internet connectivity to complete its automated install. After connecting your server to your local network with a network cable, insert the Incredible PBX LITE microSD card into your Raspberry Pi and apply power to the hardware. When the bootup procedure finishes, you should see an entry on about the middle line displayed on your monitor which reads: "My IP address is…". Write down the IP address shown. You’ll need it in the next step.

    If you don’t see an IP address assigned to your server, then correct the network deficiency (cable not connected, DHCP not working, Internet down), and reboot until you see an IP address assigned to your server. DO NOT PROCEED WITHOUT AN ASSIGNED IP ADDRESS.

    Completing the Incredible PBX Initialization Procedure

    Unless your desktop PC and RasPi are both on the same private LAN, the remainder of the install procedure should be completed from a desktop PC using SSH or Putty. This will assure that your desktop PC is also whitelisted in the Incredible PBX firewall. Using the console to complete the install is NOT recommended as your desktop PC will not be whitelisted in the firewall. This may result in your not being able to log in to your server. Once you have network connectivity, log in to your server as root from a desktop PC using the default password: password. Accept the license agreement by pressing ENTER. You then will be redirected to raspi-config. This is the utility used to expand your Incredible PBX LITE image to use your entire microSD card. If you fail to complete this step, your microSD card will be restricted to 16GB. In the raspi-config utility, choose Localization Options and set Locale, TimeZone, Keyboard, & WiFi Country. Then choose Advanced Options. All of the defaults should be satisfactory with the exception of the first item: Expand Filesystem. Choose this option and activate the resizing directive. Review the other items and then exit and reboot.

    Once your server reboots and you log back in as root, all of your passwords will be randomly assigned with the exception of the root user Linux password. You can set it by issuing the command: passwd. With the exception of your root user password, the remaining passwords can be displayed using the command: /root/show-passwords.

    Finally, if your PBX is sitting behind a NAT-based router, you’ll need to redirect incoming UDP 5060 and UDP 10000-20000 traffic to the private IP address of your PBX. This is required for all of the SIP providers included in the Incredible PBX LITE build. Otherwise, all inbound calls will fail.

    SECURITY ALERT: There was a configuration error in the initial setup which leaves the firewall deactivated. This gets corrected by the Incredible PBX Automatic Update Utility the next time you login to your server as root. Please do so immediately.

    Configuring Skyetel for Incredible PBX LITE

    If you’ve decided to go with Skyetel, here’s the drill. Sign up for Skyetel service and take advantage of the Nerd Vittles BOGO special. First, complete the Prequalification Form here. You then will be provided a link to the Skyetel site to complete your registration. Once you have registered on the Skyetel site and your account has been activated, open a support ticket and request the BOGO credit for your account by referencing the Nerd Vittles special offer. Skyetel will match your deposit of up to $250 which gets you up to $500 of helf-price calling. Credit is limited to one per person/company/address/location.

    Skyetel does not use SIP registrations to make connections to your PBX. Instead, Skyetel utilizes Endpoint Groups to identify which servers can communicate with the Skyetel service. An Endpoint Group consists of a Name, an IP address, a UDP or TCP port for the connection, and a numerical Priority for the group. For incoming calls destined to your PBX, DIDs are associated with an Endpoint Group to route the calls to your PBX. For outgoing calls from your PBX, a matching Endpoint Group is required to authorize outbound calls through the Skyetel network. Thus, the first step in configuring the Skyetel side for use with your PBX is to set up an Endpoint Group. Here’s a typical setup for Incredible PBX LITE:

    • Name: MyPBX
    • Priority: 1
    • IP Address: PBX-Public-IP-Address
    • Port: 5060
    • Protocol: UDP
    • Description: lite1.incrediblepbx.com

    To receive incoming PSTN calls, you’ll need at least one DID. On the Skyetel site, you acquire DIDs under the Phone Numbers tab. You have the option of Porting in Existing Numbers (free for the first 60 days after you sign up for service) or purchasing new ones under the Buy Phone Numbers menu option.

    Once you have acquired one or more DIDs, navigate to the Local Numbers or Toll Free Numbers tab and specify the desired SIP Format and Endpoint Group for each DID. Add SMS/MMS and E911 support, if desired. Call Forwarding and Failover are also supported. That completes the VoIP setup on the Skyetel side. System Status is always available here.

    Configuring VoIP.ms for Incredible PBX LITE

    To sign up for VoIP.ms service, may we suggest you use our signup link so that Nerd Vittles gets a referral credit for your signup. Once your account is set up, you’ll need to set up a SIP SubAccount and, for Authentication Type, choose Static IP Authentication and enter your Incredible PBX LITE server’s public IP address. For Transport, choose UDP. For Device Type, choose Asterisk, IP PBX, Gateway or VoIP Switch. Order a DID in their web panel, and then point the DID to the SubAccount you just created. Be sure to specify atlanta1.voip.ms as the POP from which to receive incoming calls.

    Configuring V1VoIP for Incredible PBX LITE

    To sign up for V1VoIP service, sign up on their web site. Then login to your account and order a DID under the DIDs tab. Once the DID has been assigned, choose View DIDs and click on the Forwarding button beside your DID. For Option #1, choose Forward to IP Address/PBX. For the Fowarding Address, enter the public IP address of your server. For the T/O (timeout) value, set it to 2o seconds. Then click the Update button. Under the Termination tab, create a new Endpoint with the public IP address of your server so that you can place outbound calls through V1VoIP.

    Configuring Anveo Direct for Incredible PBX LITE

    To sign up for Anveo Direct service, sign up on their web site and then login. After adding funds to your account, purchase a DID under Inbound Service -> Order DID. Next, choose Configure Destination SIP Trunk. Give the Trunk a name. For the Primary SIP URI, enter $[E164]$@server-IP-address. For Call Options, select your new DID from the list. You also must whitelist your public IP address under Outbound Service -> Configure. Create a new Call Termination Trunk and name it to match your server. For Dialing Prefix, choose six alphanumeric characters beginning with a zero. In Authorized IP Addresses, enter the public IP address of your server. Set an appropriate rate cap. We like $0.01 per minute to be safe. Set a concurrent calls limit. We like 2. For the Call Routing Method, choose Least Cost unless you’re feeling extravagant. For Routes/Carriers, choose Standard Routes. Write down your Dialing Prefix and then click the Save button.

    Before you can make outbound calls through Anveo Direct from your PBX, you first must configure the Dialing Prefix that you wrote down in the previous step. Login to your server as root and use nano to edit extensions_additional.conf in the /etc/asterisk directory. Search (Ctl-W) for anveo-pin and replace anveo-pin with the 6-digit alphanumeric PIN for your account. Press Ctrl-X, Y, then Enter to save your settings. Reload your dialplan with the command: asterisk -rx "dialplan reload"

    Audio Issues with Incredible PBX LITE

    Only if you experience one-way or no audio on some calls, add your external IP address and LAN subnet in /etc/asterisk/sip_general_custom.conf like the following example:

    nat=yes
    externip=xxx.xxx.xxx.xxx
    localnet=192.168.0.0/255.255.0.0 
    

    Then restart Asterisk: systemctl restart asterisk

    Configuring a Softphone for Incredible PBX LITE

    We’re in the home stretch now. You can connect virtually any kind of telephone to your new PBX. Plain Old Phones require an analog telephone adapter (ATA) which can be a separate board in your computer from a company such as Digium. Or it can be a standalone SIP device such as ObiHai’s OBi100 or OBi110 (if you have a phone line from Ma Bell to hook up as well). SIP phones can be connected directly so long as they have an IP address. These could be hardware devices or software devices such as the YateClient softphone. We’ll start with a free one today so you can begin making calls. You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum when you’re ready to get serious about VoIP telephony.

    We recommend YateClient which is free. Download it from here. Run YateClient once you’ve installed it and enter the credentials for the 701 extension on Incredible PBX. You can find them by running /root/show-passwords. You’ll need the IP address of your server plus your extension 701 password. In the YateClient, fill in the blanks using the IP address of your Server, 701 for your Username, and whatever Password was assigned to the extension when you installed Incredible PBX. Click OK to save your entries.

    Once you are registered to extension 701, close the Account window. Then click on YATE’s Telephony Tab and place some test calls to the numerous apps that are preconfigured on Incredible PBX. Dial a few of these to get started:

    DEMO - Apps Demo
    123 - Reminders
    947 - Weather by ZIP Code
    951 - Yahoo News
    TODAY - Today in History
    LENNY - The Telemarketer's Worst Nightmare
    

    If you are a Mac user, another great no-frills softphone is Telephone. Just download and install it from the Mac App Store.

    Incredible PBX LITE Administration

    We’ve eased the pain of administering your new PBX with a collection of scripts which you will find in the /root folder after logging in with SSH or Putty. Here’s a quick summary of what each of the scripts does.

    add-fqdn is used to whitelist a fully-qualified domain name in the firewall. Because Incredible PBX LITE blocks all traffic from IP addresses that are not whitelisted, this is what you use to authorize an external user for your PBX. The advantage of an FQDN is that you can use a dynamic DNS service to automatically update the IP address associated with an FQDN so that you never lose connectivity.

    add-ip is used to whitelist a public IP address in the firewall. See the add-fqdn explanation as to why this matters.

    del-acct is used to remove an IP address or FQDN from the firewall’s whitelist.

    proximity is a script used in conjunction with bluetooth to decipher whether your smartphone is within range of your server. If not, the script forwards calls to extension 701 to an extension or external smartphone of your choice. Edit the proximity script to add your preferences. Then uncomment the proximity line in /etc/crontab. Complete setup details on setup are available in our previous tutorial.

    reset-conference-pins is a script that automatically and randomly resets the user and admin pins for access to the preconfigured conferencing application. Dial C-O-N-F from any registered SIP phone to connect to the conference.

    reset-extension-passwords is a script that automatically and randomly resets ALL of the SIP passwords for extensions 701-705. Be careful using this one, or you may disable existing registered phones and cause Fail2Ban to blacklist the IP addresses of those users. HINT: You can place a call to the Ring Group associated with all five extensions by dialing 777.

    reset-reminders-pin is a script that automatically and randomly resets the pin required to access the Telephone Reminders application by dialing 123. It’s important to protect this application because a nefarious user could set up a reminder to call a number anywhere in the world assuming your SIP provider’s account was configured to allow such calls.

    show-feature-codes is a cheat sheet for all of the feature codes which can be dialed from any registered SIP phone. It documents how powerful a platform Incredible PBX LITE actually is.

    show-passwords is a script that displays ALL of the passwords associated with Incredible PBX LITE. This includes SIP extension passwords, voicemail pins, conference pins, telephone reminders pin, and your Anveo Direct outbound calling pin (if configured). Note that voicemail pins are configured by the user of a SIP extension the first time the user accesses the voicemail system by dialing *97.

    update-IncrediblePBX is the Automatic Update Utility which checks for server updates from incrediblepbx.com every time you log into your server as root using SSH or Putty. Do NOT disable it as it is used to load important fixes and security updates when necessary. We recommend logging into your server at least once a week.

    pbxstatus (shown above) displays status of all major components of Incredible PBX LITE.

    Call Detail Records available in spreadsheet format at /var/log/asterisk/cdr-csv/Master.csv.

    Originally published: Monday, July 1, 2019



    Need help with Asterisk? Visit the VoIP-info Forum.


     

    Special Thanks to Our Generous Sponsors


    FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

    BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

    The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

    VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
     

    Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
     



    Safely Deploying Incredible PBX on the Wide Open Internet

    We’ve previously documented the benefits of SIP URI calling. Because the calls are free from and to anywhere in the world, the use case is compelling. The drawbacks, particularly with Asterisk® servers, have primarily centered around the security implications of exposing SIP on a publicly-accessible server. Today we want to take another look at an open Internet SIP implementation for Asterisk based upon the pioneering work of Dr. Lin Song back in the PBX in a Flash heyday. We’ve embellished Lin’s original IPtables creation and our original article with some additional security mechanisms for Fail2Ban, Asterisk, FreePBX®, and Travelin’ Man 3. Special thanks also for a terrific tutorial from JavaPipe. All of today’s implementation is open source code which you are more than welcome to use or improve pursuant to GPL3.

    July 22 UPDATE: New Incredible PBX 16-15-PUBLIC deployment tutorial is now available here.

    Consider this. If everyone in the world had an accessible SIP address instead of a phone number, every call to every person in the world via the Internet would be free. That pretty much sums up why SIP URIs are important. The syntax for SIP URIs depends upon your platform. With Asterisk they look like this: SIP/somebody@FQDN.yourdomain.com. On SIP phones, SIP URIs look like this: sip:somenameORnumber@FQDN.yourdomain.com. Others use somenameORnumber@FQDN.yourdomain.com. Assuming you have a reliable Internet connection, once you have “dialed” a SIP URI, the destination SIP device will ring just as if the called party had a POTS phone. Asterisk® processes SIP URIs in much the same way as calls originating from commercial trunk providers except anonymous SIP calls are blocked.

    While we have tested today’s design extensively including implementation of a cloud-based server with no security issues since deployment over four months ago, we still don’t recommend this SIP design for mission-critical PBXs because there remain some security risks with denial of service attacks and zero-day vulnerabilities. For these deployments, Incredible PBX® coupled with the Travelin’ Man 3 firewall which blocks SIP access except from whitelisted IP addresses and FQDNs has no equal. When properly deployed, the bad guys cannot even see your server much less attack it. A typical use case for today’s new SIP design would be a public Asterisk server that provides anonymous SIP access to the general public without any exposure to the corporate jewels. For example, we’ve put up a demonstration server that provides news and weather reports. In the corporate world, an equivalent deployment might provide access to a product database with pricing and availability details. Our rule of thumb before deploying today’s platform would be to ask yourself what damage could be inflicted if your server were totally compromised. If the answer is zero, then proceed. Otherwise, stick with Incredible PBX and the Travelin’ Man 3 firewall. The ideal platform for deployment using the same rule of thumb as above is one of the $1 a month cloud platforms.

    ProviderRAMDiskBandwidthPerformance as of 12/1/19Cost
    CrownCloud KVM (LA)1GB20GB +
    Snapshot
    1TB/month598Mb/DN 281Mb/UP
    2CPU Core
    $25/year
    Best Buy!
    Naranjatech KVM (The Netherlands)1GB20GB1TB/monthHosting since 2005
    VAT: EU res.
    20€/year w/code:
    SBF2019
    BudgetNode KVM (LA)1GB40GB RAID101TB/monthAlso available in U.K PM @Ishaq on LET before payment$24/year
    FreeRangeCloud KVM (Ashburn VA, Winnipeg, Freemont CA)1GB20GB SSD3TB/monthPick EGG loc'n
    Open ticket for last 5GB SSD
    $30/year w/code:
    LEBEGG30

    Overview. There are a number of moving parts in today’s implementation. So let’s briefly go through the steps. Begin with a cloud-based installation of Incredible PBX. Next, we’ll upgrade the Fail2Ban setup to better secure a publicly-accessible Asterisk server. We’ll also customize the port for SSH access to reduce the attack rate on the SSH port. You’ll need a fully-qualified domain name (FQDN) for your server because we’ll be blocking all access to your server by IP address. If you want to allow SIP URI calls to your server, you’ll need this FQDN. If you want to also allow SIP registrations from this same FQDN, then a single FQDN will suffice; however, with OpenVZ platforms, we recommend using a different (and preferably more obscure) FQDN for SIP registrations since registered users have an actual extension on your PBX that is capable of making outbound calls which usually cost money. In this case, the obscure FQDN performs double-duty as the equivalent of a password to your PBX. For example, an FQDN such as hk76dl34z.yourdomain.com would rarely be guessed by an anonymous person while sip.yourdomain.com would be fairly obvious to attempted intruders. But that’s your call.

    Using whatever FQDN you’ve chosen for SIP registrations, we’ll add an entry to /etc/asterisk/sip_custom.conf that looks like this: domain=hk76dl34z.yourdomain.com. That will block all SIP registration attempts except from that domain. It will not block SIP invitations! The next step will be to add a new [from-sip-external] context to extensions_override_freepbx.conf. Inside that context, we’ll specify the FQDN used for public SIP URI connections to your server, e.g. sip.yourdomain.com. This will block SIP invitations except SIP URIs containing that domain name. We’ll also define all of the extensions on your Asterisk server which can be reached with SIP URI invitations. These could be actual extensions, or ring groups, or IVRs, or Asterisk applications. The choice is yours. These SIP URI authorizations can be either numeric (701@sip.yourdomain.com) or alpha (weather@sip.yourdomain.com) or alphanumeric (channel7@sip.abc.com). Finally, we’ll put the new IPtables firewall rules in place and adjust your existing iptables-custom setup to support the new publicly-accessible PBX. For example, we’ll still use whitelist entries for web access to your server since anonymous users would cause nothing but mischief if TCP ports 80 and 443 were exposed. It’s worth noting that KVM platforms provide a more robust implementation of IPtables that can block more types of nefarious traffic. We’ve supplemented the original article with a KVM update below. With OpenVZ platforms, we have to rely upon Asterisk to achieve IP address blocking and some types of packet filtering. So why not choose a KVM platform? It’s simple. These platforms typically cost twice as much as equivalent OpenVZ offerings. With this type of deployment, KVM is worth it.

    Installing Incredible PBX Base Platform

    Today’s design requires an Incredible PBX platform on a cloud-based server. Start by following this tutorial to put the pieces in place. We recommend you also install the Whole Enchilada addition once the base install is finished. Make sure everything is functioning reliably before continuing.


    Upgrading the Fail2Ban Platform

    Because this will be a publicly-accessible server, we’re going to tighten up the Asterisk configuration in Fail2Ban and lengthen the bantime and findtime associated with Fail2Ban’s Asterisk log monitoring. We also recommend that you whitelist the IP addresses associated with your server and PCs from which you plan to access your server so that you don’t inadvertently block yourself.

    Log into your server as root and issue the following commands. When the jail.conf file opens in the nano editor, scroll down to line 34 and add the IP addresses you’d like to whitelist to the existing ignoreip settings separating each IP address with a space. Then press Ctrl-X, Y, then Enter to save your changes. Verify that Fail2Ban restarts successfully.

    cd /etc/fail2ban
    wget http://incrediblepbx.com/fail2ban-public.tar.gz
    tar zxvf fail2ban-public.tar.gz
    rm -f fail2ban-public.tar.gz
    nano -w jail.conf
    service fail2ban restart
    

    If you ever get locked out of your own server, you can use the Serial Console in your VPS Control Panel to log into your server. Then verify that your IP address has been blocked by issuing the command: iptables -nL. If your IP is shown as blocked, issue this command with your address to unblock it: fail2ban-client set asterisk unbanip 12.34.56.78

    Obtaining an FQDN for Your Server

    Because we’ll be blocking IP address SIP access to your server, you’ll need to obtain one or perhaps two FQDNs for your server. If you manage DNS for a domain that you own, this is easy. If not, you can obtain a free FQDN from ChangeIP here. Thanks, @mbellot.

    For the FQDN that you’ll be using for SIP registrations on your server, configure Asterisk to use it by logging into your server as root and issuing the following command using your new FQDN, e.g. xyz.yourdomain.com. Thanks, @ou812.

    echo "domain=xyz.yourdomain.com" >> /etc/asterisk/sip_custom.conf
    

    SECURITY ALERT: Never use the SIP URI MOD on a server such as this one with a publicly-exposed SIP port as it is possible for some nefarious individual to spoof your FQDN in the headers of a SIP packet and easily gain outbound calling access using your server’s trunk credentials.

    Customizing the [sip-external-custom] Context

    All FreePBX-based servers include a sip-external-custom context as part of the default installation; however, we need a customized version to use for a publicly-accessible PBX. You can’t simply update the context in /etc/asterisk/extensions.conf because FreePBX will overwrite the changes the next time you reload your dialplan. Instead we have to copy the context into extensions_override_freepbx.conf and make the changes there. So let’s start by copying the new template there with the following commands:

    cd /tmp
    wget http://incrediblepbx.com/from-sip-external.txt
    cd /etc/asterisk
    cat /tmp/from-sip-external.txt >> extensions_override_freepbx.conf
    rm -f /tmp/from-sip-external.txt
    nano -w extensions_override_freepbx.conf
    

    When the nano editor opens the override file, navigate to line #10 of the [from-sip-external] context and replace xyz.domain.com with the FQDN you want to use for SIP invites to your server. These are the connections that are used to actually connect to an extension on your server (NOT to register). As noted previously, this can be a different FQDN than the one used to actually register to an extension on your server. Next, scroll down below line #27, and you will see a series of lines that actually authorize anonymous SIP connections with your server. There are two numeric entries and also two alpha entries to access the News and Weather apps on your server. The 13th position in the dialplan is required for all authorized calls.

    exten => 947,13,Dial(local/947@from-internal)
    exten => 951,13,Dial(local/951@from-internal)
    exten => news,13,Dial(local/951@from-internal)
    exten => weather,13,Dial(local/947@from-internal)
    

    You can leave these in place, remove them, or add new entries depending upon which extensions you want to make publicly accessible on your server. Here are some syntax examples for other types of server access that may be of interest.

    ; Call VoIP Users Conference
    exten => 882,13,Dial(SIP/vuc@vuc.me)
    exten => vuc,13,Dial(SIP/vuc@vuc.me)
    ; Call Default CONF app
    exten => 2663,13,Dial(local/${EXTEN}@from-internal)
    exten => conf,13,Dial(local/2663@from-internal)
    ; Call Bob at Local Extension 701
    exten => 701,13,Dial(local/${EXTEN}@from-internal)
    exten => bob,13,Dial(local/701@from-internal)
    ; Call Default Inbound Route thru Time Condition
    exten => home,13,Goto(timeconditions,1,1)
    ; Call Inbound Trunk 8005551212
    exten => 8005551212,13,Goto(from-trunk,${DID},1)
    ; Call Lenny
    exten => 53669,13,Dial(local/${EXTEN}@from-internal)
    exten => lenny,13,Dial(SIP/2233435945@sip2sip.info)
    ; Call any toll-free number (AT&T Directory Assistance in example)
    exten => information,13,Dial(SIP/18005551212@switch.starcompartners.com)
    

    Once you’ve added your FQDN and authorized SIP URI extensions, save the file: Ctrl-X, Y, then Enter.

    One final piece is required to enabled anonymous SIP URI connections to your server:

    echo "allowguest=yes" >> /etc/asterisk/sip_general_custom.conf
    

    Now restart Asterisk: amportal restart

    UPDATE for DialPlan Junkies: We received a few inquiries following publication inquiring about the dialplan design. We’ve taken advantage of a terrific feature of Asterisk which lets calls fall through to the next line of a dialplan if there is no match on a Goto(${EXTEN},13) command. For example, if a caller dials ward@sip.domain.com and there is a line 12 in the dialplan directing the call to ward,13 which exists, call processing will continue there. However, if the extension does not exist, the call will not be terminated. Instead, if there exists a more generic line 13 in the dialplan, e.g. exten => _X.,13,Goto(s,1), call processing will continue there. We use this trick to then redirect the call to an ‘s’ extension sequence to announce that the called extension could not be reached. It’s the reason all of the whitelisted extensions have to have the same line 13 designation so that call processing can continue with the generic line 13 when a specific extension match fails.

    Configuring IPtables for Public SIP Access

    You may recall that, with Incredible PBX, we bring up the basic IPtables firewall using the /etc/sysconfig/iptables rules. Then we add a number of whitelist entries using /usr/local/sbin/iptables-custom. We’re going to do much the same thing with today’s setup except the rule sets are a bit different. Let’s start by putting the default iptables-custom file in place:

    cd /usr/local/sbin
    wget http://incrediblepbx.com/iptables-custom-public.tar.gz
    tar zxvf iptables-custom-public.tar.gz
    rm -f iptables-custom-public.tar.gz
    nano -w iptables-custom
    

    When the nano editor opens, scroll to the bottom of the file. You’ll note that we’ve started a little list of notorious bad guys to get you started. Fail2Ban will actually do a pretty good job of managing these, but for the serious recidivists, blocking them permanently is probably a good idea. In addition to the bad guys, you’ll want to whitelist your own IP addresses and domains so that you don’t get blocked from FreePBX web access to your server. The syntax looks like the following two examples:

    /usr/sbin/iptables -I INPUT -s pbxinaflash.dynamo.org -j ACCEPT
    /usr/sbin/iptables -I INPUT -s 8.8.8.8                -j ACCEPT
    

    Whenever you make changes to your IPtables configuration, remember to restart IPtables using the following command ONLY: iptables-restart

    Now let’s put the final IPtables piece in place with the default IPtables config file:

    cd /etc/sysconfig
    wget http://incrediblepbx.com/iptables-public.tar.gz
    tar zxvf iptables-public.tar.gz
    rm -f iptables-public.tar.gz
    nano -w iptables
    

    When the nano editor opens the file, scroll down to line 55 which controls the TCP port for SSH access to your server. We strongly recommend you change this from 22 to something in the 1000-2000 range. HINT: Your birth year is easy to remember. In the next step, we’ll make the change in your SSH configuration as well.

    Next, scroll down to lines 148 and 149. Replace YOUR_HOSTNAME.no-ip.com on both lines with the FQDN of your server that will be used to accept SIP invitations (connections) on your server. These entries have no effect on SIP registrations which we covered above!

    Once you’ve made these changes, save the file BUT DO NOT RESTART IPTABLES JUST YET.

    Securing the SSH Access Port

    TCP port 22 is probably one of the most abused ports on the Internet because it controls access to SSH and the crown jewels by default. Assuming you changed this port in the IPtables firewall setup above, we now need to change it in your SSH config file as well. Edit /etc/ssh/sshd_config and scroll down to line 12. Change the entry to: Port 1999 assuming 1999 is the port you’ve chosen. Be sure to remove the comment symbol (#) at the beginning of the line if it exists. Then save the file.

    You’ll also want to update the SSH port in Fail2Ban. Edit /etc/fail2ban/jail.conf and search for port=ssh. In the [ssh-iptables] context, change the entry to port=1999 assuming 1999 is your chosen port. Save the file and reboot your server. Then you should be all set.

    Dealing with the Bad Guys

    You’ll be amazed how quickly and how many new friends you’ll make on the public Internet within the first few hours. You can watch the excitement from the Asterisk CLI by logging into your server as root and issuing the command: asterisk -rvvvvvvvvvv. Another helpful tool is to monitor your IPtables status which will show IP addresses that have been temporarily blocked by Fail2Ban: iptables -nL. This will catch most of the bad guys and block them. But some are smarter than others, and many know how to spoof IP addresses in SIP packets as you will quickly see. Unlike on KVM platforms, IPtables on most OpenVZ platforms cannot search packets for text strings which is a simple way to block many of these attackers. HINT: You get what you pay for. And, in some cases, attackers disguise their address or use yours. We’ve now found that ${SIPURI} holds the caller’s true identity so we’ve updated the code accordingly. Whether to permanently block these guys is completely up to you. A typical SIP INVITE before such a call is dropped only consumes about 100 bytes so it’s usually not a big deal. You also can manually block callers using the Fail2Ban client with the desired IP address: fail2ban-client set asterisk banip 12.34.56.78.

    Additional Security on KVM Platforms

    As we mentioned above, a KVM platform provides considerably more security for your public-facing server because you can block entire countries using the ipset extension to IPtables. You can read all about it here. After considerable discussion and suggestions on the PIAF Forum, we would offer the following code which blocks the countries we have identified as causing the majority of problems. First, modify your /etc/sysconfig/iptables configuration and insert the following code in the IPSPF section of the script around line 93. You can change the list of blocked countries to meet your own needs. Just be sure to make the same country-code changes in the blockem.sh script which we will cover in step 2. A list of available country codes can be found here. Save your changes, but do NOT restart IPtables just yet.

    -A IPSPF -m set --match-set cn src -j DROP
    -A IPSPF -m set --match-set ru src -j DROP
    -A IPSPF -m set --match-set ps src -j DROP
    -A IPSPF -m set --match-set kp src -j DROP
    -A IPSPF -m set --match-set ua src -j DROP
    -A IPSPF -m set --match-set md src -j DROP
    -A IPSPF -m set --match-set nl src -j DROP
    -A IPSPF -m set --match-set fr src -j DROP
    -A IPSPF -m set --match-set SIPFLOOD src -j DROP
    

    Second, we want to add a new /etc/blockem.sh script and make it executable (chmod +x /etc/blockem.sh). With the exception of the SIPFLOOD entry which is our custom Bad Guys List, make sure the country list in line #5 below matches the dropped countries list you added to IPtables in step #1 above.

    #!/bin/bash
    cd /etc
    wget -qO - http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz| tar zxvf -
    for i in \\
    cn ru ps kp ua md nl fr
    do
    /usr/sbin/ipset create -exist $i hash:net
    for j in $(cat $i.zone); do /usr/sbin/ipset add -exist $i $j; done
    done
    wait
    sleep 5
    wget http://incrediblepbx.com/badguys.tar.gz
    tar zxvf badguys.tar.gz
    rm -f badguys.tar.gz
    /usr/sbin/ipset restore -! < /etc/SIPFLOOD.zone
    wait
    sleep 5
    service iptables restart
    wait
    sleep 5
    /usr/local/sbin/iptables-custom
    wait
    sleep 5
    service fail2ban restart
    wait
    exit 0
    

    Third, try things out by running the script: /etc/blockem.sh. Verify that IPtables is, in fact, blocking the listed countries: iptables -nL.

    Finally, we recommend adding the script to /etc/rc.d/rc.local replacing the existing iptables-restart line. In that way, it gets run whenever you reboot your server.

    In choosing a KVM platform, we've had good luck with the $5/month Digital Ocean platform where you still can get a $50 credit to kick the tires for 60 days, Vultr (similar pricing to D.O. also with a $50 credit). With either of these providers, you can add automatic backups for an extra dollar a month. In the bargain basement (may not be here tomorrow) category, we like the following providers. Many other low-cost options are documented on the LowEndBox site. Just don't invest more than you can afford to lose... and make a backup.1

    Connecting a SIP Phone to OpenSIPS or LinPhone

    If you followed along in our OpenSIPS adventure, then it's easy to test some SIP URI calls to your new server. You can connect virtually any kind of SIP telephone or endpoint to OpenSIPS. Another easy way to try out SIP calling is to first set up a free LinPhone Account.

    You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum. For today we'll get you started with one of our favorite (free) softphones, YateClient. It's available for almost all desktop platforms. Download YateClient from here. Run YateClient once you’ve installed it and enter the credentials for your OpenSIPS or LinPhone account you've previously created. You’ll need the IP address of your OpenSIPS server or LinPhone's FQDN (sip.linphone.org) plus your account’s password. Fill in the Yate Client template using the IP address or FQDN as well as your Username and whatever Password you assigned to the account when you created it. Click OK to save your entries.

    Once the Yate softphone shows that it is registered, try a test call to one of the SIP URIs you authorized on your new Asterisk server or try ours:

    If you don't happen to have an OpenSIPS server or a LinPhone SIP account to play with but you have another Asterisk server, then the simple way to enable SIP URI extensions is by editing /etc/asterisk/extensions_custom.conf. In the [from-internal-custom] context, add an extension that can be used to contact any desired SIP URI. Then reload your dialplan: asterisk -rx "dialplan reload". Now dial that extension (2468 in the following example) from any phone connected to your Asterisk server. The entry would look something like this to call our SIP URI for the latest weather forecast:

    NEWS FLASH: A new One-Minute Installer to use Incredible PBX on the open Internet is now available here.

    Originally published: Monday, June 3, 2019



    Need help with Asterisk? Visit the VoIP-info Forum.


     

    Special Thanks to Our Generous Sponsors


    FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

    BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

    The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

    VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
     

    Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
     



    1. Digital Ocean and Vultr provide modest referral credits to Nerd Vittles for those that use our referral code. It in no way colors our recommendations regarding these two providers, both of whom we use extensively. []

    Best of Both Worlds: Safely Marrying Asterisk to OpenSIPS




    Last week we introduced OpenSIPS, the multi-functional, multi-purpose signaling SIP server which can fulfill almost any communications function one can dream up except the unified communications tasks typically performed with a PBX such as Asterisk®. Today we want to marry the two platforms to give you the best of both worlds. For Incredible PBX® users, the primary advantage of adding an OpenSIPS front end is the elimination of the complexities associated with interacting with your PBX from remote sites with ever changing, dynamic IP addresses coupled with NAT firewalls over which you have no control. While there are many approaches to interconnecting the two platforms, we’re not comfortable with the exposure that a simple registration passthrough design introduces for many Asterisk users. Instead we prefer a model that lets everybody contact you and your users without providing the world the access necessary to allow anonymous strangers a platform from which to launch endless attempts to compromise your Asterisk server and individual Asterisk accounts.

    Not all users on an Asterisk PBX need anonymous lurkers to have worldwide, public access to their individual phones. For most, DIDs suffice for public access. For users that do need such access, we will begin by creating a SIP account on your OpenSIPS server that is separate and apart from your Asterisk user account or extension. Also keep in mind that anonymous SIP calls require a match on the SIP URI to reach the person or function desired. You can enable and disable these SIP URI-accessible functions on your OpenSIPS server as desired. And you can determine how obscure to make each of the SIP URIs. Security through obscurity works and deters many SIP attacks. Now let’s address what you can and cannot do with this setup.

    Using a SIP phone from anywhere in the world, any SIP user CAN:

    • Make SIP URI calls to authorized extensions and ring groups on your Asterisk PBX
    • Make SIP URI calls to authorized clients registered to a 3CX PBX with a SIP UUID
    • With a legitimate password, make DISA-like calls with Asterisk trunks, if enabled
    • With an invalid DISA password, converse with Lenny
    • With a legitimate password, check and manage authorized Asterisk voicemail accounts
    • With a legitimate password, participate in authorized Asterisk conferences
    • Access other authorized Asterisk applications available from Asterisk extensions

    Using a SIP phone from anywhere in the world, an OpenSIPS-registered User also CAN:

    • Make PSTN calls from OpenSIPS-registered SIP phones, if enabled
    • Receive calls from Asterisk forwarded to any OpenSIPS-registered SIP phone
    • Receive calls from Asterisk forwarded to any 3CX-registered client or SIP phone

    Using any SIP phone registered to a SIP proxy, you CANNOT:

    • Log into any Asterisk user account without whitelist permission and credentials
    • Make 911 calls

    Prerequisites: To complete today’s setup, we’re assuming you have (1) an Incredible PBX server running Asterisk 13, (2) an OpenSIPS server built with version 1.2.0 or later of the Incredible PBX for OpenSIPS installer, and (3) either a registered SIP account and SIP URI on your OpenSIPS PBX or a SIP account with a provider such as a free linphone.org account.

    Running pbxstatus on your OpenSIPS server will tell you which version you have. If you don’t have pbxstatus or the version is below 1.2.0, please initialize your Debian 8 platform, download the latest release, and reinstall following the our OpenSIPS tutorial here. There were major changes in the OpenSIPS configuration to support Asterisk connectivity which made an in place upgrade too complex. Our apologies.

    Before creating user accounts on your OpenSIPS server, give some thought to a numbering scheme that won’t conflict with extension registrations on your Asterisk server. For example, if your Asterisk server uses extensions 701 through 750, then you may wish to consider using 7701 through 7750 on your OpenSIPS server. The one-to-one match keeps things simple without running into conflicts between the Asterisk extension numbers and the OpenSIPS user accounts. We’ll use the 700 (Asterisk) and 7700 (OpenSIPS) extension ranges in our examples which follow. And we’ve reworked the original OpenSIPS tutorial in keeping with this design to simplify Asterisk integration for new readers just joining the party.

    We want to express our sincere appreciation to Bill Simon for his patient tutelage in walking us through some of the potential landmines in marrying an OpenSIPS server with Asterisk. Should your organization ever need professional help with a SIP deployment, there is no finer SIP authority than Simon Telephonics.


    1. Configuring Asterisk for Inbound OpenSIPS Calls

    Assuming you have an Incredible PBX 13 platform, open the GUI as admin using a browser from your desktop. First, let’s create a Trunk for the OpenSIPS server. Choose Connectivity -> Trunks -> Add SIP (chan_sip) Trunk. For Trunk Name, use opensips. Next, click on the SIP Settings tab in the dialog. For Trunk Name, again use opensips. In PEER DETAILS, enter the following and replace xxx.xxx.xxx.xxx twice with the actual IP address of your OpenSIPS server. Then click Submit and Reload Dialplan when prompted.

    type=peer
    host=xxx.xxx.xxx.xxx
    context=from-opensips
    insecure=port,invite
    disallow=all
    allow=ulaw
    deny=0.0.0.0/0.0.0.0
    permit=xxx.xxx.xxx.xxx/255.255.255.255
    

    Next, using SSH or Putty, login to your Asterisk server as root and issue these commands replacing xxx.xxx.xxx.xxx with the IP address of your OpenSIPS server (choose option 0 when prompted for access type):

    cd /root
    ./add-ip opensips xxx.xxx.xxx.xxx
    wget http://incrediblepbx.com/from-opensips.tar.gz
    tar zxvf from-opensips.tar.gz
    rm -f from-opensips.tar.gz
    nano -w from-opensips.txt
    

    When the editor opens, scroll down to line 16 and enter a very secure PIN (up to 10 digits) for access to the DISA-like service to make outbound calls via SIP URI. It’s your phone bill so make it long (up to 10 digits) and something that is not easily guessed. On line 20, we have configured DISA for numbers up to 11 digits. If your dialplan requires international dialing support, you can adjust 11 to the desired number of digits. Then save the file and copy the dialplan code into extensions_custom.conf and reload your dialplan:

    cd /etc/asterisk
    cat /root/from-opensips.txt >> extensions_custom.conf
    asterisk -rx "dialplan reload"
    

    IMPORTANT NOTE: Just because you have configured this DISA option on your Asterisk server does not mean it is available via SIP URI. In fact, no SIP URI access to your Asterisk server is enabled at this juncture. You still must set up the SIP URI connections on your OpenSIPS server. Whether to do that and which features to activate are completely up to you.

    2. Configuring OpenSIPS for Asterisk Connectivity

    Beginning with version 1.2.0 of the Incredible PBX installer for OpenSIPS, the server itself is preconfigured to support Asterisk connectivity using AVPs. Implementation only requires command line execution of an AVP script to enable each feature you wish to activate. A similar script can be used to deactivate any AVP feature previously activated. To install the scripts on your OpenSIPS server, log in as root using SSH or Putty and issue these commands:

    cd /root
    wget http://incrediblepbx.com/asterisk-features-for-opensips.tar.gz
    tar zxvf asterisk-features-for-opensips.tar.gz
    rm -f asterisk-features-for-opensips.tar.gz
    

    The function of each of the Asterisk scripts is self-explanatory from the script names:

    • asterisk-add-forward
    • asterisk-delete-forward
    • asterisk-list-forwards

    Three pieces of information are required to add a SIP URI forward from OpenSIPS to your Asterisk server using the AVP asterisk-add-forward script:

    • UUID of SIP URI (from any SIP phone, dial UUID@opensips.yourdomain.com to connect)
    • Asterisk Extension (destination where incoming OpenSIPS call should be forwarded)
    • Asterisk Public IP Address

    To add a SIP URI for extension 701 on your Asterisk server at xx.xx.xx.xx reachable at 701@opensips.yourdomain.com, the command would look like this where xx.xx.xx.xx is the public IP address of your Asterisk server and opensips.yourdomain.com is the FQDN of your OpenSIPS server: /root/asterisk-add-forward 701 701 xx.xx.xx.xx

    CAUTION: Other than for forwards like this, do NOT set up User accounts in the OpenSIPS Control Panel using the same numbers as existing extensions on your Asterisk server. Otherwise, if your SIP phone is registered to a 701 user account on your OpenSIPS server, you lose the ability to connect to any extension on your Asterisk server if a 701 account requiring registration also existed on the Asterisk platform.

    To use a name in the SIP URI or enable a second SIP URI for the same Asterisk 701 extension (jdoe@opensips.yourdomain.com): /root/asterisk-add-forward jdoe 701 xx.xx.xx.xx

    Simply repeat the steps above for every SIP URI you wish to enable for an Asterisk extension.

    To enable DISA-like access via SIP URI using dial as UUID (dial@opensips.yourdomain.com): /root/asterisk-add-forward dial *1 xx.xx.xx.xx

    Keep in mind that you need not use "dial" as the UUID. You can make up any name you like. So long *1 is the DISA extension, the UUID can be as obscure as desired e.g. disa5038now.

    For voicemail access via SIP URI, you can do it in two ways. For generic access triggering prompts for both the voice mailbox number and the mailbox PIN, use the following: /root/asterisk-add-forward vm *98 xx.xx.xx.xx

    For voicemail access to a specific mailbox (701) with only a prompt for the mail PIN, use: /root/asterisk-add-forward vm701 *98701 xx.xx.xx.xx

    For access to a specified conference (2663) with a prompt for the conference PIN, use: /root/asterisk-add-forward conf2663 2663 xx.xx.xx.xx

    For access to Weather Reports (947) with a prompt for the ZIP Code, use something like this: /root/asterisk-add-forward weather 947 xx.xx.xx.xx

    For News Headlines (951), use: /root/asterisk-add-forward news 951 xx.xx.xx.xx

    To delete any previously created UUID forward: /root/asterisk-delete-forward

    To list existing UUID forwards for SIP URIs: /root/asterisk-list-forwards

    Calling Tip: If your softphone is registered to an OpenSIPS User account, you can call any of the enabled forwarding entries by entering the UUID without @opensips.yourdomain.com, e.g. dialing vm would connect to the Asterisk voicemail system with a prompt for mailbox.

    3. Enabling Inbound Calls from Asterisk to a SIP Phone

    In today’s design, incoming calls to your Asterisk PBX can be forwarded to a user account on your OpenSIPS server or a free linphone.org user account by (1) creating a free User account in the OpenSIPS Control Panel or at linphone.org, (2) logging into that user account with a SIP phone or softphone, (3) creating a custom extension in the Incredible PBX GUI that points to the SIP URI of your user account on the OpenSIPS server or your free linphone.org SIP user account or a 3CX client, and (4) adding that custom extension to either a Ring Group that includes your Asterisk extension or enabling FindMe/FollowMe for your Asterisk extension and designating the custom extension as the No Answer Destination. Need support for multiple Asterisk users? Not a problem. Repeat the drill for each user.

    The procedure for adding a User Account in the OpenSIPS Control Panel was covered in last week’s article. The procedure for creating a free Linphone User Account was covered in an earlier article so we won’t repeat it here. Another obvious SIP URI destination is any 3CX Client if you’ve previously set up a free 3CX server following our 3CX tutorial. Refer back to those articles if you need a refresher.

    On the Asterisk side, login to the Incredible PBX GUI as admin with your favorite browser. Then choose Applications -> Extensions -> Add Custom Extension. For the User Extension and Display Name, we recommend using the 7701 numbering scheme for remote accounts. Then click on the Advanced tab and enter the SIP URI of your OpenSIPS, Linphone, or 3CX User account as the Dial option, e.g. SIP/yourname@sip.linphone.org or SIP/7701@opensips.yourdomain.com. Click Submit and Apply Config to reload dialplan.

    To assure that incoming calls ring on both your Asterisk phone (701) and your registered SIP phone, we recommend setting up a Ring Group on the Asterisk side that includes both the 701 extension and the new 7701 custom extension. Then adjust your Inbound Routes to point to the number of this Ring Group instead of to 701. In this way, you can preserve the voicemail functionality associated with your 701 extension. FYI: None of these servers proxy audio and video of your calls. They provide a SIP registration service only.

    The other alternative to a Ring Group is to enable FindMe/FollowMe in the 701 extension settings and then specify Extension:701 as the No Answer Destination. With this approach, voicemail will never be triggered on calls sent to extension 701 on your PBX. Since OpenSIPS lacks voicemail, you would lose calls not answered on your registered SIP phone or softphone.

    TIP: We use 3CX clients exclusively for inbound calls on iPhones and Android devices because we have found they are far superior in dealing with both push notifications and NAT routing. 3CX clients actually ring when someone calls AND you can hear both sides of every call.

    4. Outbound PSTN Calling from OpenSIPS

    The DISA setup documented above allows your existing Trunks to continue to be managed and secured exclusively on your Asterisk server with no trunk exposure on the OpenSIPS platform at all. Thus, if either your public-facing OpenSIPS server or Linphone is ever compromised, nobody will be able to make any calls on your nickel because there will be no trunks available to process the outbound calls. Your DISA password is never exposed.

    For some (like us), a two-step outbound calling procedure is just too painful. In that case, with providers such as Skyetel, you can deploy a PSTN calling platform on both your Asterisk server and on OpenSIPS. We documented the Skyetel trunk setup for OpenSIPS in our tutorial last week. The good news is nothing precludes deployment of Skyetel at multiple sites even if you only use Skyetel on the OpenSIPS platform for outbound calling. And this completely avoids implementing a DISA solution which has security implications of its own. Effective 10/1/2023, $25/month minimum spend at Skyetel is required.

    Enabling direct PSTN calling with OpenSIPS means nobody can ever make PSTN calls merely by guessing a SIP URI. It requires an actual SIP registration to OpenSIPS, and you have Fail2Ban to assist with securing that process. So the outbound calling design is completely up to you. Direct PSTN calling from OpenSIPS is no less safe so long as none of your OpenSIPS User account passwords are compromised.

    5. Enabling Calls from Asterisk to OpenSIPS Users

    For OpenSIPS AVP forwards that have been enabled to Asterisk extensions, you probably will also want to provide a way for Asterisk users to return those calls directly to OpenSIPS users since that will be the CallerID that displays when an OpenSIPS user places a call directly to a forwarded Asterisk extension. Assuming a SIP phone has been registered to User account 7709, when that OpenSIPS user places a call to a forwarded Asterisk extension 701, it means the Asterisk user will see 7709 displayed as the CallerID for the incoming call even though the User of the OpenSIPS 7709 extension may also be associated with extension 709 on the Asterisk side. If the Asterisk callee attempts to return the call by dialing 7709 instead of 709, the call would fail. To avoid confusion by Asterisk users, the simple solution is to add an additional Custom SIP extension for every OpenSIPS User account.

    For example, on the Asterisk side, login to the Incredible PBX GUI as admin with your favorite browser. Then choose Applications -> Extensions -> Add Custom Extension. For the User Extension, enter 7709. For the Display Name, enter the name of the person using that OpenSIPS user account. Next, click on the Advanced tab and enter the SIP URI for this OpenSIPS User account as the Dial option, e.g. SIP/7709@opensips.yourdomain.com. Click Submit and Apply Config to reload dialplan.

    FYI: Matching Custom Extension numbers on the Asterisk platform to identical extensions on your OpenSIPS server does not create the registration problems we cautioned against earlier. Only Asterisk extensions requiring actual SIP registration need to remain unique from accounts on your OpenSIPS platform.

    6. A Few Words About Security

    If you’ve been using Incredible PBX with its Travelin’ Man 3 firewall, it’s not unlike living in a gated community where most of the outside world doesn’t even know you exist. Adding a "second home" with OpenSIPS is not unlike buying a summer place next door to Fred Sanford in Watts. You might as well have set up shop in the middle of Russia because, for all intents and purposes, you have. Anybody in the world can guess your IP address and spend the day trying to break into your server. So the name of the game is vigilance. Especially for the first few weeks, you need to run iptables -nL regularly and see how quickly your Fail2Ban blacklist is filling up. If you heeded our advice and set up your OpenSIPS server on a KVM platform (instead of OpenVZ), we’ve got a handy little script that will let you move bad guys snagged by Fail2Ban to the permanent IPset blacklist. Just download the script and run it daily to move the Fail2Ban entries to permanent block status in the IPset blacklist:

    cd /root
    wget http://incrediblepbx.com/move-fail2bans-to-ipset.tar.gz
    tar zxvf move-fail2bans-to-ipset.tar.gz
    rm -f move-fail2bans-to-ipset.tar.gz
    ./move-fail2bans-to-ipset
    

    Once you have verified that the IP addresses actually are being populated in the IPset blacklist table (ipset list | sort), you can add the script to /etc/crontab to run automatically each night:

    echo "2 4 * * * root /root/move-fail2bans-to-ipset > /dev/null 2>&1" >> /etc/crontab
    

    If you’d like a head start on your IPset blacklist, simply download our latest list and then reboot your server:

    cd /etc
    wget http://incrediblepbx.com/badguys.tar.gz
    tar zxvf badguys.tar.gz
    rm -f badguys.tar.gz 
    

    Another potential vulnerability is SSH. This command will tell you who has attempted to login to your server as root: cat /var/log/auth.log | grep password. If you ever see a failed login and it wasn’t a mistake on your part, change your SSH access port immediately if not sooner: nano -w /etc/ssh/sshd_config. Then restart SSH: /etc/init.d/ssh restart. Better yet, set up SSH public key authentication.

    The other major consideration is the number of holes you punch into the security of your Asterisk server using the OpenSIPS asterisk-add-forward script. Every time you add an extension to this list, you open another (read-only) window into your Asterisk communications world. And anybody can connect to these extensions using either the FQDN of your OpenSIPS server or its IP address. Even though we don’t practice what we preach, we strongly recommend using alphanumeric UUIDs instead of numbers for these access points. That at least avoids random calls from bad guys that are accustomed to numeric numbers only in SIP URIs. Regularly review your OpenSIPS log for unusual strings of forwarded calls and adjust your forwarding UUIDs accordingly: cat /var/log/opensips.log | grep forwarded.

    In our previous article, we’ve already addressed how important it is to limit User accounts to your FQDN and never the IP address of your OpenSIPS server. In this way, you limit OpenSIPS registration exposure to your FQDN and never the IP address of your server. Fail2Ban also assists here by blocking failed login attempts after a single failure unless you have whitelisted the IP address in Fail2ban’s ignoreip list in /etc/fail2ban/jail.conf and restarted Fail2Ban with this command: /etc/init.d/fail2ban restart. These are the only entry points that offer the ability to actually register to your server. AVPs never do. Obviously, a successful SIP registration is much more dangerous than a random phone call on a SIP URI set up using AVP extension forwarding.

    Finally, passwords now matter on your Asterisk PBX for any port forward you’ve established with OpenSIPS. For example, if you’ve set up a generic forward to access voicemail, then it means anybody guessing the SIP URI you created can spend the day (at no cost) attempting to break into ANY voicemail account on your Asterisk server by guessing the PIN. Fail2Ban will not protect you here. If you’ve set up DISA-like access to your Asterisk server on OpenSIPS, then the same applies except now the attacker gets a blank check to make commercial calls if they can guess your access PIN. Worried yet? We hope so. Sure beats a $100,000 phone bill.

    7. Taking OpenSIPS for a Test Drive

    We usually provide a Demo Line for readers to try out our latest creations. For obvious reasons, we prefer not to disclose our OpenSIPS FQDN to the general public. But we have set up a port forward from a DID that we temporarily configured on our OpenSIPS server. So, if you’d like to sample the voice quality of placing a call to a DID in Atlanta forwarded to an OpenSIPS server in New York forwarded to an Asterisk server in Miami and then back to you, try calling 843-606-0555 for a weather report in your favorite ZIP code. We’re betting you will be dumbfounded by the quality of the call. Enjoy!

    Originally published: Monday, May 20, 2019



    Need help with Asterisk? Visit the VoIP-info Forum.


     

    Special Thanks to Our Generous Sponsors


    FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

    BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

    The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

    VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
     

    Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
     



    The 5-Minute Wonder: OpenSIPS Server Takes the Cake


    We covered Kamailio in our Part I article. And we’ve skipped writing about SIP server contestants two, three, and four because they each had a healthy dose of insurmountable problems… at least for us. So today we’re pleased to present Part V in our SIP server series. And, as the headline exclaims, with OpenSIPS we’ve found a platform that finally is worthy of your attention. Our requirements were fairly straightforward. We wanted an open source SIP server to which we could connect users to make and receive free as well as commercial calls worldwide. We also wanted a SIP server with good documentation that was simple to install and to integrate into our existing Asterisk platforms without hiring a consultant. And finally we were searching for a SIP server that could be secured easily without providing free phone service to every bad guy on the planet. OpenSIPS has it all.

    OpenSIPS is a multi-functional, multi-purpose signaling SIP server used by carriers, telecoms or ITSPs for solutions like Class4/5 Residential Platforms, Trunking / Wholesale, Enterprise / Virtual PBX Solutions, Session Border Controllers, Application Servers, Front-End Load Balancers, IMS Platforms, Call Centers, and many others. Source: opensips.org

    We’ve often complained that the problem with many open source projects is that the developers get so focused on making money that they skimp on the documentation to encourage consulting work or participation in expensive conferences. We have found just the opposite with OpenSIPS. In fact, much of today’s implementation is based upon an excellent tutorial by the folks at PowerPBX. Down the road, if you find yourself in need of a consultant, their services would be a good place to start. What we’ve added to the PowerPBX design is security, support for clients behind NAT-based routers, and an integration scheme for Asterisk®, FreePBX®, and Incredible PBX® platforms so that you get the best of both worlds, a public facing SIP server with the UC feature set that most organizations expect. Last but not least, our turnkey GPL installer will get you up and running in about 5 minutes.

    Choosing a KVM/OVZ7 Platform for OpenSIPS

    Let’s begin by addressing the appropriate platform for an OpenSIPS server. The server needs to have a public IP address that is static, and the server should not be situated behind a NAT-based router. It only complicates things and is beyond the scope of what we plan to address. For those that are frequent visitors, you already know that we’ve been pushing everyone to kiss their local hardware goodbye and join the cloud revolution. When it comes to public-facing VoIP platforms like OpenSIPS, most of us don’t have a choice. You need a static IP address on the open Internet. And, for the sake of security, a KVM or OVZ7 cloud platform is a must since older OpenVZ platforms don’t support the ipset component of IPtables which makes it easy to block hundreds of thousands of IP addresses without a performance hit on your server. While we previously have identified older OpenVZ providers for our Incredible PBX platforms protected by the Travelin’ Man 3 firewall, pure whitelist access simply isn’t an option if you wish to retain the functionality of a VoIP application such as OpenSIPS.

    Ten to twenty gigabytes of disk space should be more than ample for OpenSIPS. The amount of RAM in your server depends upon the volume of calls your server will be handling. If it’s a dozen simultaneous calls then 1GB of RAM will suffice. If it’s 100,000 calls, then take a look at this article for tips on sizing your server. For today’s implementation, we’ll be using Debian 8 so any low-cost provider or KVMs at Digital Ocean, Vultr, and OVH should be fine.1

    We recently went on the hunt to identify KVM or OVZ7 cloud providers around the world that could offer a KVM VPS with 1GB RAM, 20GB storage, and 1TB of monthly bandwidth for about $25 a year. No small feat! But our friends at LowEndTalk have come through. Read the message thread and find an offer with a site that best meets your requirements. Many of the KVM offers require you to open a ticket to get the special pricing and configuration outlined above. Here’s a short list of our favorites, but remember to only use the KVM or OVZ7 offerings below for OpenSIPS!

    ProviderRAMDiskBandwidthPerformance as of 12/1/19Cost
    CrownCloud KVM (LA)1GB20GB +
    Snapshot
    1TB/month598Mb/DN 281Mb/UP
    2CPU Core
    $25/year
    Best Buy!
    Naranjatech KVM (The Netherlands)1GB20GB1TB/monthHosting since 2005
    VAT: EU res.
    20€/year w/code:
    SBF2019
    BudgetNode KVM (LA)1GB40GB RAID101TB/monthAlso available in U.K PM @Ishaq on LET before payment$24/year
    FreeRangeCloud KVM (Ashburn VA, Winnipeg, Freemont CA)1GB20GB SSD3TB/monthPick EGG loc'n
    Open ticket for last 5GB SSD
    $30/year w/code:
    LEBEGG30

    Choosing OpenSIPS Components to Deploy

    We’ve divided up today’s tutorial into bite-sized pieces so that you can pick and choose where to stop implementing and start using. You do not need to have an Asterisk server to make and receive calls with OpenSIPS. However, OpenSIPS lacks voicemail and AutoAttendant/IVR components so, if those are a requirement, then you either need a VoIP service provider that offers them, or deploy a $50 Incredible PBX for the Raspberry Pi to add the missing pieces.

    What OpenSIPS offers is a free server platform for worldwide SIP communications so that you, your friends, and business associates can call or connect from anywhere using freely available SIP softphones or any of dozens of SIP telephone instruments. We’ll stick with softphones for today, but hardware-based SIP telephones are equally simple to deploy.

    This is not a criticism because it is one of the best tutorials we’ve ever used but, if you want to see how complex a typical OpenSIPS server deployment is, take a look at the PowerPBX tutorial we used as a starting point with OpenSIPS. We’ve compressed most of those procedures into a turnkey installer that only requires you to enter a MySQL root password of passw0rd (with a zero) once you have your Debian 8/64 platform up and running.

    Deploying a Debian 8 Server Platform

    Start by choosing a cloud provider that offers the 64-bit Debian 8 minimal platform as a deployment option. Most do. As noted, we recommend a KVM or OVZ7 platform, but older OpenVZ platforms perform equally well minus support for ipset which makes it easy to block entire countries overrun with bad guys. Choose offerings with at least 1GB RAM and a 10GB drive to get started. Configure your Debian 8 server with a fully-qualified domain name (FQDN). This is critically important with our security design because we will assign all OpenSIPS users/extensions to this FQDN and reserve your server’s IP address purely for connections from service providers and Asterisk servers. This makes it all but impossible for anyone to hack into your server since most script kiddies launch attacks on IP addresses, not FQDNs. Using an unusual FQDN adds an extra layer of security, but that’s your call. If you lack the ability to assign FQDN aliases to a domain which you own, you can obtain a free FQDN from numerous sources including ChangeIP and point it to the IP address of your OpenSIPS server.

    Installing OpenSIPS on a Debian 8 Server

    Now the fun begins. Log into your Debian 8 server as root and issue the following commands to prepare for the OpenSIPS install:

    cd /root
    wget http://incrediblepbx.com/opensips.tar.gz
    tar zxvf opensips.tar.gz
    rm -f opensips.tar.gz
    

    After untarring opensips.tar.gz above, there’s one extra step for those using KVM or OVZ7 platforms. Do NOT make this change if you’re on an older OpenVZ-based server (not recommended!) that shares its kernel with the host machine. Otherwise, the firewall startup will always fail. For KVM and OVZ7 platforms only, issue the following command: cp -p /root/kvm/* /root

    Make sure you have logged into your Debian 8 server as root using SSH or Putty from a desktop PC that you will use to manage OpenSIPS with a browser. The reason is because this IP address automatically will be whitelisted in the OpenSIPS firewall as part of the install process. Otherwise, you will need to manually log into SSH and whitelist the IP address of your desktop PC using /root/add-ip each time you wish to access the OpenSIPS Control Panel since TCP port 80 (HTTP) is not exposed to the public Internet as a security precaution.




     

    To begin the install, issue this command: /root/install

    As the install progresses, you’ll be prompted several times to assign and then to use the MySQL root password. Please use passw0rd (with a zero) as your MySQL password, or the install will fail. This is NOT a security risk unless your Debian 8 root user account is compromised. And, in that case, it won’t matter anyway since the MySQL password could easily be changed. The rest of the install is self-explanatory. There are a couple of steps where you will be prompted for input. Correct responses are indicated before the various prompts. Pay particular attention when you are prompted to change the SSH port from TCP 22 to a port number in the 1000-2020 range as a security precaution. We recommend using the year you were born because it will be easy for you to remember. When the install finishes and you log out of your server, the next SSH login will look like this where XXXX is the SSH port you chose and yyy.yyy.yyy.yyy is the OpenSIPS server address: ssh -p XXXX root@yyy.yyy.yyy.yyy


    Although most of the configuration of your OpenSIPS server will be handled using a web browser and the OpenSIPS Control Panel GUI, we’ve included a few scripts in /root to assist with maintenance of your server platform. Here’s a brief summary of the script functions:

    • pbxstatus – Status of your OpenSIPS server (image sample above)
    • add-ip – Temporarily WhiteList IP address until next iptables-restart
    • ban-ip – Permanently Ban an IP address
    • unban-ip – Unban a previously banned IP address
    • log-purge – Zero out all of the major Linux log files
    • opensips-check – Assures OpenSIPS and RTPproxy are running (runs automatically)
    • Fail2Ban BlackListsiptables -nL | grep -A100000 "opensips ("
    • IPset BlackList (KVM/OVZ7 platforms only) – ipset list | sort

    We secure your server in several ways: (1) by disguising the SSH port, (2) by locking down almost every port on your server with the IPtables firewall with the exception of the SIP ports, (3) by deploying Fail2Ban to scan your OpenSIPS log for errors and lock out attackers for an extended period of time, and (4) by deploying the IPset blacklist on KVM/OVZ7 platforms. With this design, there is a symbiotic relationship between IPtables, Fail2Ban, and IPset. Therefore, it is critically important that you only restart these services using the iptables-restart command. NEVER issue other IPtables commands to restart or save your firewall settings.

    Activating a SIP Server with OpenSIPS Control Panel

    We don’t want to overload you on the first day with your new OpenSIPS platform so we’ll walk you through the preliminary setup steps to create your SIP Domain. Then we’ll show you how to set up user accounts (also known as extensions). Finally we’ll walk you through setting up a trunk to make and receive calls from a commercial SIP provider. When we’re finished today, you’ll be able to make and receive calls using SIP URIs or DIDs which you have purchased from a provider. Then next week we’ll focus on integration of OpenSIPS with an Asterisk platform of your choice using Incredible PBX and FreePBX as an example. Once we’re finished, you’ll be able to handle user account registrations exclusively on your OpenSIPS server while leaving your Asterisk platform completely hidden from public exposure.

    Logging into the OpenSIPS Control Panel

    As deployed, the OpenSIPS Control Panel is accessible via web browser. As noted previously, HTTP Port 80 access is blocked by default unless the IP address of your desktop PC has been whitelisted either as part of the initial install or using the add-ip script in /root. Once your desktop PC’s IP address is whitelisted, point your browser to http://xxx.xxx.xxx.xxx/cp



    The default Username is admin, and the default password is opensips. Once you’re logged in, immediately click on the Users icon in the upper-right corner of the dashboard. Then click the Edit Info pencil icon for user Admin and change your password. Click Save when done.

    Creating Domains with OpenSIPS Control Panel

    In the Left column of the Dashboard, you’ll see two tabs: Users and System. Click on the System tab to expose the available choices. Then choose the Domains option.



    Domains are the essential building blocks in OpenSIPS. You can manage one or a hundred domains on a single OpenSIPS server, and each domain can have its own set of Users, Trunks/Gateways, and Dialplan rules. We’re actually going to create two domains, one for the IP Address of your OpenSIPS server and a second one for the FQDN of your OpenSIPS server. For added security, we will create all User accounts under the FQDN Domain. And we’ll reserve the IP Address Domain for DID Trunks/Gateways from registered, commercial SIP providers. This design allows attackers to attempt to register to accounts on your IP Address Domain until the cows come home, and they will never be successful because there are no existing SIP user accounts there. Keep it that way! With our OpenSIPS design, Fail2Ban will block attackers after a single failed registration attempt. And OpenSIPS itself will identify and block all SIP flood attacks using either Fail2Ban or IPset (on KVM and OVZ7 platforms only).

    Now that you understand the design, let’s set up your domains. After choosing System -> Domains, enter the IP Address of your OpenSIPS server at the SIP Domain prompt. Then click Add New Domain followed by Reload on Server. Repeat the same steps to enter the fully-qualified domain name (FQDN) of your OpenSIPS server. When finished, you should see:


    Creating Users with OpenSIPS Control Panel

    We’ve already explained the security implications and reason for creating User accounts with your FQDN Domain only. Click on Users -> User Management -> Add New to get started. You can use Numbers (what we call Extensions in Asterisk) or Names. Our preference is to use Numbers for the User accounts and then to create Alias Names (as desired) for each User account. You can’t dial names from most SIP telephones. This also keeps the design similar to what many are used to coming from the Asterisk environment. A completed dialog would look something like the following. Use the Domain pull-down to choose your FQDN. Obviously, the passwords must be secure and must match. Then the Register button will be enabled to save. The actual Numbers used for Usernames are completely up to you.



    Create at least a couple User accounts so that you can set up two SIP phones to call yourself and verify that everything is working. These User accounts become an integral part of the SIP URI to receive calls from any SIP phone in the world: 7701@opensips.yourdomain.com

    Before you can actually answer an incoming call to your SIP URI, you’ll need to register the User account using either a softphone or SIP phone. We’ll do that next. But, first, let’s create an Alias to 7701 User so that folks can reach you by calling joe@opensips.yourdomain.com

    Click on Users -> Alias Management -> Add New Alias to get started. Fill in the form using the example below. Make sure that you select your FQDN Domain using the pull-downs for BOTH the Domain and Alias Domain fields. Then click Add to save.


    Registering a Softphone to an OpenSIPS User Account

    There are literally dozens of free SIP soft phones from which to choose. We covered some of our favorites for every platform in previous articles. For our purposes today, we recommend you choose one of the Linphone softphones which are available for the PC, Mac, Linux, Android, and iOS platforms. We also recommend signing up for a free Linphone.org SIP account which doesn’t cost you anything. For today, we will be configuring the softphone to register to your new OpenSIPS server.

    Once you have downloaded and installed the Linphone client, go into the Preferences menu and make the following changes. Some depend upon your calling platform.

    • Audio Codecs: PCMU, G722, PCMA
    • Video Codecs: VP8, H264
    • Call Encryption: None
    • DTMF: RFC2833 only
    • Send InBand DTMF: OFF
    • Send SIP INFO DTMF: OFF
    • SIP UDP 5060: Enabled
    • SIP TCP 5060: Enabled
    • Allow IPv6: Disabled

    Then set up a new SIP Proxy account: Username (7701), Password (as defined), Domain: your FQDN not IP address, Transport: UDP, Outbound Proxy: OFF, Stun Server: stun.linphone.org, ICE: ON, AVPF: OFF, Push Notification: ON, Country Code Prefix: 1 (if required by your commercial SIP provider), Register: YES, Account Enabled: YES. HINT: You can call Alias Names via SIP URI, but you can only register to a SIP account using its actual Username.

    Avoiding Lockouts with NeoRouter VPN

    By design, Fail2Ban is unforgiving when it comes to failed registrations. A single failed registration will get an IP address banned for a full week. The reason is because the new bad guy strategy is to hit your server once to determine whether anybody is home. Then the creep bombards you later with an endless stream of registration attempts. With our design, nobody will be home when they return. The bad news is a single failed registration attempt by you or your users will also trigger a ban. There are several workarounds. The easiest is to set up the NeoRouter client on each of your machines including your OpenSIPS server and use the 10.0.0.x private network for access. These IP addresses never get banned. Our previous tutorial will walk you through setting up a free NeoRouter server and installing the free NeoRouter clients on your machines. The client software already is installed and running on your OpenSIPS server. It only requires that you log in using nrclientcmd and register to your NeoRouter server to obtain a private IP address.

    There are other options to unban an IP address which has accidentally been snagged. First, almost all of the cloud providers include a Console option in their web portals. Second, you can log into your server via SSH from any non-blacklisted IP address to remove the banned IP address. Once you’re logged in, simply run this command using the IP address you wish to unban: /root/unban-ip xxx.xxx.xxx.xxx

    Choosing Commercial SIP Providers

    Recall that you cannot register to a SIP alias on your OpenSIPS server. We’ll take advantage of this restriction in setting up incoming calls from commercial providers’ DIDs. To set up Trunks from commercial providers so that you can not only receive incoming calls but also make outbound calls over their PSTN network connections, you must use providers that support IP address authentication rather than a SIP registration. Many providers support this including our platinum sponsor, Skyetel, as well as providers such as VoIP.ms, Anveo Direct, V1VoIP, and many others. In our OpenSIPS design, you also can use DIDs from providers that support SIP URI forwarding such as CallCentric and LocalPhone; however, you are limited to receiving inbound calls only. VoIP communications really shines here because you don’t have to choose a single provider to meet all of your communications requirements.

    Skyetel is by far the easiest provider to set up with OpenSIPS. See our earlier tutorial for a special offer that will get you half-price calling for up to $500. Effective 10/1/2023, $25/month minimum spend required. Once you’re registered on the Skyetel site, add a new EndPoint Group using the IP address of your OpenSIP server and designate UDP 5060 as the access port. Sign up for a DID and map it to the OpenSIPS Endpoint Group. Done. In the OpenSIPS Control Panel, navigate to System -> Dynamic Routing and click Add Gateway. Using the template below, create 5 Proxy gateways for the following Skyetel data centers:

    • skyetel-NW 52.41.52.34
    • skyetel-SW 52.8.201.128
    • skyetel-NE 52.60.138.31
    • skyetel-SE 50.17.48.216
    • skyetel-EU 35.156.192.164

    The latest installer will automatically whitelist the Skyetel IP addresses in /etc/iptables/rules.v4 just below the existing 10.8.0.0/24 rule. This will protect you in the event that one or more of the Skyetel IP addresses gets blacklisted inadvertently. You should also add the IP addresses of any other providers you need and then issue the command: iptables-restart

    Next, we need to create what Asterisk users know as an Outbound Route. This tells OpenSIPS to send dialed numbers in 11-digit format to Skyetel for termination. We’ve already created the Dial Plan rule for calling out by dialing 1 plus a 10-digit number. So, while you’re still in the Dynamic Routing section of the OpenSIPS Control Panel, click on the Rules tab at the top of the template. Then click Add Rule. Begin by clicking Add ID button and choosing Group ID 0. In the Prefix field, type 1. Now click the Add GW button 3 times after choosing the Skyetel gateways in the following order from the GW pull-down list: skyetel-nw, skyetel-sw, and skyetel-se. Those are the three currently operational Skyetel gateways. When you’re finished, your template should look like the following. Then click the Add button to save the new rule. Click Reload Server to load the new rule into OpenSIPS. Then repeat this procedure leaving the Prefix field blank so that you can make 10-digit calls as well.

    Finally, we need to create what Asterisk users know as an Inbound Route. This tells OpenSIPS where to send incoming calls from our Skyetel DID. OpenSIPS handles inbound routes by defining a User Alias for the Username to which you want to route the incoming DID calls. Click on Users -> Alias Management -> Add New Alias to get started. Fill in the form using the following template and then click Add.

    • Username: 7701 (the extension to which to route the incoming calls)
    • Domain: opensips.xyz.com (the FQDN of your OpenSIPS server)
    • Alias Username: 18435551212 (the 11-digit Skyetel DID)
    • Alias Domain: 11.12.13.14 (the IP address of your OpenSIPS server)
    • Alias Type: dbaliases

    Introducing the VoIP Blacklist

    We’ve always dreamed of an effective VoIP Blacklist, and many have tried. But the crowd-sourced VoIP Blacklist at voipbl.org is the real deal. Everybody can post entries (including the bad guys) and, magically, most of the illegitimate entries get sifted out before the next day’s list is released. We’ve made this easy in two ways. First, the list gets populated every night while you sleep. At last count, there were 84,504 IP addresses. And, second, to contribute to the blacklist, run iptables -nL weekly to see if Fail2Ban has snagged any bad guys. If so, simply run the new /root/blacklist utility which will move them into your local blacklist and also format the entries for easy submission to voip.bl whenever you feel the urge. Simply issue the command cat /root/blcklist.txt to display the entries you just blacklisted. Then cut-and-paste the results and post them to the VoIP Blacklist. The whole process takes less than a minute, and you’ll be contributing to a very valuable VoIP resource while also using it.

    Congratulations! You now have a functioning OpenSIPS server that can process incoming calls from SIP URIs as well as DIDs. And you can make SIP URI and 11-digit PSTN calls using your SIP softphone that’s registered to your OpenSIPS server. See you next week. Enjoy!

    Continue Reading: Best of Both Worlds: Safely Marrying Asterisk to OpenSIPS

    Originally published: Monday, May 13, 2019  Updated: Monday, June 24, 2019



    Need help with Asterisk? Visit the VoIP-info Forum.


     

    Special Thanks to Our Generous Sponsors


    FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

    BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

    The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

    VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
     

    Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
     



    1. Nerd Vittles receives referral fees from some VoIP service providers to help cover the costs of our blog. We never recommend particular companies solely to generate commissions. We also test all services that we recommend. []

    The Very Best Cellphone Plans and Smartphones for 2019


    You can read reviews of the best cellphone plans and smartphones until your eyes glaze over and still end up scratching your head when it comes to making a decision. Our approach is a little different. It’s about making smart choices based upon the specific requirements for you and your family. Let’s get the obvious criteria out of the way first. The cellphone provider that you choose has to work in your home, on your way to work, at your office, and in the places to which you typically travel. In the United States, that used to rule out everyone except AT&T, Verizon, and their MVNOs. Not any more. T-Mobile’s coverage now rivals that of the Bell Sisters, and Sprint isn’t far behind. The second important criteria is how many phones you need. If it’s a plan just for you or you and your spouse, it’s a very different landscape than finding suitable providers for a family of four or five. Age also matters. If it’s just two of you and one of you is at least 55 years old, there’s at least one incredible deal. Another important consideration is how much of your cellular usage is from locations with good Wi-Fi coverage. With most providers and newer smartphones, WiFi usage doesn’t cost you anything when it comes to your monthly cellphone bill. And, last but not least, is a careful analysis of how you use your phones. Binge watching Netflix and sending hundreds of high resolution photos every day through cellular connections is very different than using a phone primarily to make calls, send text messages, and retrieve text-based email. Equally important is whether you need your smartphone to also provide Internet connectivity for a tethered computer or tablet.

    Let’s get the easy choices out of the way first. If you’re shopping for no more than two phones and one of you is at least 55 years old and one or both of you consumes enormous amounts of data without WiFi every month, T-Mobile is the hands-down winner at $70 a month with no tax/fees for two phones with unlimited talk as well as text and 50GB of data in 210+ countries. You may wish to consider the T-Mobile One Plus add-on if you do considerable traveling or regularly use tethering.

    Excluding WiFi, the average cell phone user today consumes between 2GB and 8GB of data per month. If you have an existing cellphone plan, check your bill and see where your usage typically falls. If you’re within the range of 3GB and 12GB per phone per month with no WiFi coverage, then MintMobile’s $15 (3GB), $20 (8GB), and $25 (12GB) plans with unlimited talk and text using the T-Mobile network are the clear winner. HotSpot tethering with a PC is allowed. The only wrinkle is having to pay for a year of service after your 3-month trial ends.

    If you’re part of a family of four or five with heavy cellphone usage, the best "unlimited" deal is probably Cricket Wireless which is an AT&T subsidiary and uses the AT&T network. If you don’t mind data speeds reduced to 3 Mbps with unlimited streaming at 480p, then their $100/month plan for four phones is a great deal even with the usual AT&T throttling after 22GB of data usage per month. Add a fifth phone for $25. Tethering is an extra $10/phone.

    If Sprint works well in your surroundings and you have your own compatible phones, then Sprint’s Unlimited Kickstart offering is worth a careful look. Up to 5 lines can be purchased for $25/month each, but there is no guarantee as to network speeds, streaming is limited to 480p, and there is no tethering. You can move up to their Unlimited Basic Plan with up to 5 phones for a total of $100/month plus taxes and fees for 2 to 5 phones until June 30, 2020.

    MetoPCS from T-Mobile has an offer similar to Sprint’s for 4 lines with unlimited data up to 35GB/month for $100/month with no taxes or additional fees. Pricing escalates to $40/line for two phones and $30/line for three. Tethering is not supported.

    If Verizon is your preference, the least costly unlimited plan is offered by their Visible subsidiary at $40/month with data speeds limited to 5 Mbps and video streaming limited to 480p DVD quality. Tethering is permitted. iPhones and Galaxy S9/S9+ phones are supported. Or you can purchase for $99 or swap any Android phone for the Visible R2 phone from ZTE.

    Things get murkier and more expensive from here. One consideration we haven’t touched upon with the low cost providers is bundling. Depending upon your Internet service provider and cable TV provider, the cost of your cellphone plan can change dramatically. For example, AT&T bundles DirecTV service for 4 TVs plus 4 cellphones sharing 15GB of monthly data for $200/month with lots of fine print. Xfinity/Comcast mobile service on Verizon’s network is available to existing Xfinity Internet customers for $12/GB with no line access fees on up to 5 smartphones. Or you can sign up for "unlimited" service at $45/phone with 20GB throttling. Spectrum has a similar mobile offer using Verizon at $14/GB or $45/phone for Spectrum Internet customers. And Google offers their GoogleFi service for $20/phone plus $10/GB of data actually used. Additional lines are $15. Google uses both T-Mobile and Sprint for service.

    The elephant in the room with all of these cellphone plans is data throttling. All of the providers do it with impunity, and the short answer is you’ll simply have to choose a provider whose terms of service you can live with. While T-Mobile’s 50GB cap is considerably higher than AT&T’s 22GB, there are plenty of weasel words in T-Mobile’s terms that allow them to do what is necessary to "protect" their network. On the other hand, AT&T actually has locations (including ours) where data throttling reportedly isn’t used at all. We actually have a MiFi device on AT&T’s network that, during some months, has recorded over 100GB of data usage without throttling. So the bottom line is your mileage may vary, and it behooves you to shop around until you find a provider with whom you are comfortable based upon your own usage patterns.


    We haven’t touched upon choosing a smartphone up until now. We all have our favorites and some providers have extremely favorable pricing if you bundle phones as part of your initial signup. If you don’t mind a 2-year-old model of an iPhone, these often can be free. The same holds for older Android top tier phones from Samsung and other providers. Just last week, Google offered its latest Pixel phones at half price for new GoogleFi customers. Whatever we listed today would probably be old news before you finished reading about it. We will mention one incredibly versatile Android phone, and that’s Motorola’s one-year-old Corning® Gorilla® glass, unlocked Moto G6 which can be found for under $200. In appearance it is indistinguishable from Samsung’s Galaxy S7 Edge, and it compares favorably to almost every feature in Apple’s latest $1,000+ iPhone with the possible exception of the camera (see photo above). It’s compatible with all of the carriers mentioned above except Visible. As with many of the newer smartphones, the G6 supports Wi-Fi calling as well as OpenVPN connectivity.

    Originally published: Monday, May 6, 2019



    Need help with Asterisk? Visit the VoIP-info Forum.


     

    Special Thanks to Our Generous Sponsors


    FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

    BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

    The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

    VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
     

    Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
     



    Meet Linphone: Free Worldwide Calling to Anybody with SIP

    Earlier this year we demonstrated how to set up a publicly-accessible Asterisk® server to enable free worldwide calling using SIP URIs which are email-like addresses for VoIP and video calls. But not everyone has an Asterisk server so today’s tutorial extends free calling to everyone with a Windows or Linux PC, a Mac, or any smartphone or tablet. All you need is a desktop computer with wired or wireless Internet access or, on a smartphone or tablet, a cell data plan or WiFi connection will suffice. When friends sign up, their calls also will be free.

    The secret sauce on all of these platforms is the Linphone app (shown above) which can be downloaded and used at no cost. Source code is available for those that want it. Use it as often and for as long as you like. Here are the Linphone download links for each of the platforms:

    The only other piece you’ll need to get started is a free Linphone SIP account. Sign up here. Once you’ve signed up, simply respond to the confirmation email to activate your account. Your registration gets you credentials to plug into your Linphone app that you downloaded above. In addition, it gets you a free Linphone SIP URI which looks something like this: yourname@sip.linphone.org. This is the SIP URI address that anyone in the world can use to contact you. Here are the pieces you’ll need to plug into your desktop or smartphone app:

    • Account Name
    • Account Password
    • Domain: sip.linphone.org

    Be very careful not to lose your password. You can’t retrieve it, and you can’t change it without knowing the original password. All you can do is delete your account and start over.

    The Linphone feature set is downright impressive. Here’s what you and your friends will be using at zero cost:

    IMPORTANT TIP: Missing audio or one-way audio is a common problem on SIP calls. For best results, configure your account in the Linphone app to use UDP for the Transport, disable the Outbound Proxy, configure stun.linphone.org as the Stun Server, and enable ICE. In Network settings, turn off IPv6 and Media Encryption. In Audio settings, enable Opus, G.722, PCMU, and PCMA only. In Video settings, enable both VP8 and H.264. Then close the app and reopen it.

    Once you have your Linphone credentials, another option in addition to using one of the SIP clients above is to acquire a stand-alone SIP telephone which can easily be connected to your Linphone SIP account. While there are literally hundreds of SIP telephones from which to choose, here’s a $35 offering from Grandstream that we use. It’s available from Amazon.1

    Unlike other proprietary communications apps, the beauty of using Linphone with its native SIP URI support is you can call any SIP phone in the world for free whether the recipient uses Linphone or not. For example, to annoy your friends and spammers, you can transfer their calls to Lenny: 2233435945@sip2sip.info or 883510001198938@sip.inum.net. And here are some other SIP URI calls you might want to try. Store them in your Linphone Phonebook.

    Yahoo News Headlines - news@demo.nerdvittles.com
    Yahoo News Headlines - 951@demo.nerdvittles.com
    Weather by Zip Code  - weather@demo.nerdvittles.com
    Weather by Zip Code  - 947@demo.nerdvittles.com
    Directory Assistance - information@demo.nerdvittles.com
    Directory Assistance - 411@demo.nerdvittles.com
    Lenny for Spammers   - 53669@demo.nerdvittles.com
    Technical Support    - 0@sip.incrediblepbx.com
    Call Any TollFree #  - **1800XXXXXXX@tollfree.future-nine.com
    

    There are now more than 2,000 VoIP networks worldwide that support SIP URI access. Any person or organization with an account on any of these networks can be reached at no cost via SIP URI or via several hundred PSTN numbers. Using a SIP URI dialing prefix, you can call any referenced network@sipbroker.com. For example, *656news@sipbroker.com would reach the Nerd Vittles News Headlines from Yahoo. Or choose a local access number from the SipBroker worldwide directory, e.g. 702-789-0530 and then dial *656951 at the prompt.

    Of course, every 3CX platform provides dedicated SIP URIs for every extension on the PBX. Our recent article covers adding SIP URI access to any Asterisk PBX.

    If you want to associate a phone number with your Linphone SIP URI, you can do it in a couple of ways. First, using a smartphone, you can link your cell number to Linphone within the Linphone app itself. If you have a free DID from IPComms, you can point it to your Linphone SIP URI. If you have a $1/month CallCentric DID, it can also be pointed to your Linphone SIP URI. A 25¢/month iNum DID from LocalPhone.com also can be pointed to your SIP URI. LocalPhone supports Nerd Vittles through referral revenue from your 25¢ investment. 🙂

    Speaking of iNUMs, you can reach anyone with an iNUM DID by dialing the iNUM number in SIP URI format: 8835100xxxxxxxx@sip.inum.net. One of the real beauties of signing up for an iNUM number as well is that it can be reached in most places around the globe by dialing a local number from any telephone. As part of the iNum initiative, local access numbers have been established in more than 50 countries around the globe. By placing a local call from any telephone to one of these local access numbers, any individual with an iNum phone number anywhere in the world can be reached without further cost. Here is a current list of the local access numbers. If the link is down (frequently), try here or here or the iNUM listing here. Once your call is answered, simply enter the 15-digit iNum phone number you wish to reach, and you will be connected. It’s worth pointing out that iNUMs aren’t as unwieldy as they may appear. The numbers always begin with 8835100 followed by 8 digits starting with a zero.



    And another iNUM listing from DSL Reports:

    Country             City                     Access Number
    ------------------- ------------------------ ---------------
    Argentina           Buenos Aires             +54 1159839500
    Australia           Sydney                   +61 280148200
    Austria                                      +43 720880500
    Bahrain                                      +973 16199200
    Belgium             Brussels                 +32 28081771
    Brazil              Brasilia                 +556135500791
    Brazil              Florianopolis            +554840420809
    Brazil              Rio De Janeiro           +552135006959
    Brazil              Sao Paulo                +551146803621
    Bulgaria            Sofia                    +359 24917555
    Canada              Calgary                  (403) 775-1446
    Canada              Edmonton                 (780) 669-9257
    Canada              Halifax                  (902) 982-6937
    Canada              London                   (519) 488-9336
    Canada              Montreal                 (514) 907-7500
    Canada              Ottawa                   (613) 686-4519
    Canada              Quebec City              (418) 800-0384
    Canada              St. Johns, Newfoundland  (709) 757-0060
    Canada              Regina                   (306) 988-1600
    Canada              Toronto                  (416) 800-4303
    Canada              Toronto                  (647) 724-8777
    Canada              Vancouver                (778) 786-3497
    Canada              Winnipeg                 (204) 272-8182
    Chile               Santiago                 +56 25813444
    Croatia             Zagreb                   +385 17776363
    Cyprus              Nicosia                  +357 22030500
    Czech Republic      Prague                   +420 246019777
    Denmark                                      +45 69918686
    Dominican Republic  Santiago                 (829) 947-9610
    El Salvador                                  +503 21131899
    Estonia                                      +372 6681881
    Finland             Helsinki                 +358 942419200
    France              Paris                    +33 170619800
    Germany             Frankfurt                +4969257385876
    Germany             Frankfurt                +4969257380439
    Greece              Athens                   +30 2111768444
    Hungary             Budapest                 +36 14088951
    Ireland             Dublin                   +353 15262600
    Israel              Tel Aviv                 +972 37219555
    Italy               Rome                     +39 0662207777
    Japan               Tokyo                    +81 345209777
    Latvia              Vilnius                  +370 52059090
    Lithuania                                    +371 67652500
    Luxembourg                                   +352 20880108
    Malta                                        +35627780107
    Mexico              Guadalajara              +52 3346242977
    Mexico              Mexico City              +52 5511678222
    Mexico              Monterrey                +52 8141703540
    Netherlands         Amsterdam                +31 208080808
    New Zealand         Auckland                 +64 99250499
    Norway              Oslo                     +47 21031306
    Panama                                       +507 8322488
    Peru                Lima                     +51 17085500
    Poland              Warsaw                   +48 223982688
    Portugal            Lisbon                   +351 308803219
    Puerto Rico         Bayamon Norte            (787) 395-7140
    Romania                                      +40 318103500
    Singapore                                    +65 31581212
    Slovakia            Bratislava               +421 233002555
    Slovenia            Ljubljana                +386 16001422
    South Africa        Johannesburg             +27105002854
    South Africa        Pretoria                 +27120042701
    Spain               Barcelona                +34 931815653
    Spain               Madrid                   +34 911883777
    Sweden              Stockholm                +46 852500111
    Switzerland         Zurich                   +41 435006262
    United Kingdom      London                   +44 2033556363
    United States       Albuquerque              (505) 225-8243
    United States       Charlotte                (980) 202-0283
    United States       Charlotte                (980) 236-0398
    United States       Kansas City              (913) 951-0932
    United States       Chicago                  (312) 253-4880
    United States       Houston                  (713) 474-2323
    United States       Los Angeles              (213) 221-3799
    United States       New York                 (646) 843-6969
    United States       Phoenix                  (602) 354-9444
    United States       San Diego                (619) 330-9640
    United States       San Francisco            (650) 360-0999
    United States       Santa Barbara            (805) 308-9649
    United States       Seattle                  (206) 420-5904
    United States       Spokane, WA              (509) 931-0459
    United States       Tacoma, WA               (253) 343-1529
    

    More iNUM details are available here. If sip.inum.net is down, try 81.201.82.50.

    Let’s tie all the pieces together now. Linphone gives you and your friends a free SIP URI as well as a SIP client for any platform to make and receive SIP voice and video calls. You can associate this SIP URI with your cellphone number as well as a free or almost free phone number (DID) that’s available from IPComms, CallCentric, and other providers. If you sign up for a LocalPhone iNUM number, you also can associate it with your Linphone SIP URI. So you can be reached on your Linphone client by SIP URI, by iNUM, and by regular phone numbers. You can place unlimited calls to any SIP URI or iNUM worldwide at no cost. What’s not to like?

    Deploying Linphone as an Asterisk Trunk

    If you don’t have an Asterisk PBX, you can stop reading here. The good news is you can also use a Linphone SIP account as a SIP trunk on your Asterisk PBX. Once configured, you can add an Incoming Route and send the incoming Linphone SIP URI calls to any destination desired: an extension, a ring group, an IVR, or even a Conference Room. Using the FreePBX® or Incredible PBX® GUI, create a chan_SIP Trunk and name it linphone. In the PEER DETAILS, enter the following using your actual Linphone username and password:

    type=friend
    qualify=yes
    insecure=port,invite
    host=sip.linphone.org
    disallow=all
    context=from-trunk
    dtmfmode=rfc2833
    allow=g722&ulaw
    fromuser=your-username
    defaultuser=your-username
    secret=your-password
    

    For the Registration String: your-username:your-password@sip.linphone.org/99999

    Next, create an Inbound Route using 99999 as the DID entry. Route the call to your desired destination, SAVE your settings, and you’re in business.

    There’s one more nice surprise. Linphone accounts work much like the old key telephones and Google Voice setup that we all knew and loved. What that means is you can register the same Linphone account in multiple places, e.g. as an Asterisk trunk and elsewhere using one of the Linphone softphone apps. When incoming calls to your SIP URI arrive, they will ring on both your Asterisk PBX and your Linphone softphone as long as you haven’t routed the Linphone trunk to a destination that automatically answers the calls such as an IVR.

    HINT: If you’re using dual registrations and routing the Linphone trunk to an extension, we recommend disabling voicemail on that extension so that Asterisk doesn’t automatically answer the call and send it to voicemail when the extension is not registered or answered.

    To make outbound calls from extensions on your PBX using the Linphone trunk, the easiest way is to create custom extensions in the [from-internal-custom] context in /etc/asterisk/ extensions_custom.conf. Make up an unused extension number (90210 in this example), enter the Linphone account name you wish to call (acctname in this example), save the file, and reload your dialplan: exten => 90210,1,Dial(SIP/acctname@linphone).

    Another way to create a Custom Extension is using the FreePBX or Incredible PBX GUI. Under Applications -> Extensions -> Add Custom Extension, assign an extension number for the extension. Click on the Advanced tab and enter SIP/acctname@linphone in the Dial field. Click Submit button and reload the dialplan at the prompt. Enjoy your worldwide free calling.

    Originally published: Monday, April 29, 2019



    Need help with Asterisk? Visit the VoIP-info Forum.


     

    Special Thanks to Our Generous Sponsors


    FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

    BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

    The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

    VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
     

    Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
     



    1. This phone requires a wired network connection. Some of our purchase links refer users to Amazon when we find their prices are competitive for the recommended products. Nerd Vittles receives a small referral fee from Amazon to help cover the costs of our blog. We never recommend particular products solely to generate Amazon commissions. However, when pricing is comparable or availability is favorable, we support Amazon because Amazon supports us. []