Home » Search results for 'web sites 101' (Page 3)

Search Results for: web sites 101

The Most Versatile VoIP Provider: FREE PORTING

Incredible PBX 13-13 Application User’s Guide

For those just beginning the Incredible PBX® 13-13 adventure, start here. Once your system is up and running, you’ll be ready to kick the tires. And today we’ll cover the applications for Asterisk® that are included in the latest and greatest Incredible PBX Whole Enchilada. If you have questions, post them on the PIAF Forum for some quick and friendly assistance.

Here’s a Table of Contents to the Incredible PBX 13-13 Applications with hotlinks. Enjoy!

  1. Checking System Status
  2. Enabling Speech Recognition for Asterisk
  3. Wolfram Alpha for Siri-like queries by phone*
  4. Automatic Update Utility
  5. Resetting Incredible PBX Passwords
  6. Apache Authentication for Apps
  7. IPtables Firewall WhiteList
  8. PortKnocker Remote Access
  9. Travelin’ Man 4 Remote Access by Phone
  10. Conference Bridge
  11. CallerID Name (CNAM) Lookups
  12. Faxing with Incredible PBX
  13. Voicemail 101 with Incredible PBX
  14. Email Delivery of MP3 Voicemails
  15. Reconfiguring SendMail for SmartHosts
  16. SMS Blasting with Google Voice
  17. SMS Voice Messaging with Google Voice*
  18. SMS Messaging with VoIP.ms
  19. SIP URI Calling with Speed Dials
  20. IVR Demo of Incredible PBX Applications*
  21. Backup and Restore Options
  22. AsteriDex – The Poor Man’s Rolodex®
  23. Voice Dialing with AsteriDex*
  24. Speed Dialing with AsteriDex
  25. Scheduling Reminders by Phone or Web
  26. DISA Access with Incredible PBX
  27. Yahoo! News Headlines
  28. Weather Forecasts with Incredible PBX*
  29. ODBC Application Support
  30. Today in History
  31. Time of Day

* Requires Voice Recognition implementation. See #2 above.

1. Checking Current Status of Incredible PBX

There are several ways to check the status of your server. First, log into your server as root and type: status or pbxstatus. You can even add the default phone number for your server by inserting it in /etc/pbx/.phone.

The second option is to use a browser to access your server. Choose the Incredible PBX Admin option after pointing a browser to the IP address of your server:

Once you log in with your admin password, the Dashboard of your server will display the status of trunks, users, and active calls on your server. In addition, you can review the latest news and security alerts from the RSS Feeds of Nerd Vittles, Incredible PBX, FreePBX®, and Asterisk. For additional status information, choose Reports:Asterisk Info.

2. Adding Speech Recognition to Asterisk

Google changed the licensing of their speech recognition engine last year and now restricts use to "personal and development use." Assuming you qualify, the very first order of business is to enable speech recognition for your new PBX. We no longer recommend Google Speech Recognition because of the licensing issues and Google’s propensity to break things regularly. Instead, we recommend IBM’s Speech Recognition and TTS engines. For most users, there will be no cost. And the services are second to none. For a complete installation and setup tutorial, see our original article on Incredible PBX 13-13. Once speech recognition is enabled, the Incredible PBX feature set grows exponentially. You’ll have access to the Voice Dialer for AsteriDex as well as SMS Voice Messaging and Wolfram Alpha for a Siri-like encyclopedia.

NOV. 1 UPDATE: IBM has moved the goal posts effective December 1, 2018:

Here’s how to activate Google speech recognition on Incredible PBX if you choose not to use the IBM solution. Don’t skip any steps!

1. Using an existing Google/Gmail account, you first must join the Chrome-Dev Group.

2. Using the same account, create a new Speech Recognition Project.

3. Click on your newly created project and choose APIs & auth.

4. Turn ON the Speech API by clicking on its Status button in the far right margin. HINT: If you forgot to complete Step #1, the Speech API option will be missing!

5. Click on Credentials in APIs & auth and choose Create New Key -> Server key. Leave the IP address restriction blank!

6. Write down your new API key or copy it to the clipboard.

7. Log into your server as root and issue the following command:

nano -w /var/lib/asterisk/agi-bin/speech-recog.agi

8. When the nano editor opens, go to line 70 of speech-recog.agi: my $key = "". Insert your API key from Step #6 above between the quotation marks and save the file: Ctrl-X, Y, then Enter.

3. Using Wolfram Alpha with Incredible PBX

Ever wished your Asterisk server could harness the power of a 10,000 CPU Supercomputer to answer virtually any question you can dream up about the world we live in? Well, so long as it’s for non-commercial use, today’s your lucky day. Apple demonstrated with Siri™ just how amazing this technology can be by coupling Wolfram Alpha® to a speech-to-text engine on the iPhone. Now you can do much the same thing using voice recognition on the Incredible PBX for Asterisk-GUI.

Before using Wolfram Alpha from any phone connected to your PBX, you first must configure it by obtaining and adding a Wolfram Alpha application ID to Incredible PBX. Here are the simple steps:

1. Obtain your free Wolfram Alpha APP-ID here.

2. Log into your server as root and issue the following command:

nano -w /var/lib/asterisk/agi-bin/wolfram.sh

3. When the nano editor opens, insert your IBM STT and Wolfram APP-ID credentials in the spaces provided. Then save the file.

To use Wolfram Alpha, dial 4747 (that’s S-I-R-I backwards) from any extension.

Here are some sample queries to get you started:

Weather in Charleston South Carolina
Weather forecast for Washington D.C.
Next solar eclipse
Otis Redding
Define politician
Who won the 1969 Superbowl? (Broadway Joe)
What planes are flying overhead now?
Ham and cheese sandwich (nutritional information)
Holidays 2015 (summary of all holidays for 2015 with dates and DOW)
Medical University of South Carolina (history of MUSC)
Star Trek (show history, air dates, number of episodes, and more)
Apollo 11 (everything you ever wanted to know)
Cheapest Toaster (brand and price)
Battle of Gettysburg (sad day 🙂 )
Daylight Savings Time 2015 (date ranges and how to set your clocks)
Tablets by Samsung (pricing, models, and specs)
Doughnut (you don’t wanna know)
Snickers bar (ditto)
Weather (local weather at your server’s location)

4. Automatic Update Utility for Incredible PBX

A key security component of Incredible PBX is its Automatic Update Utility. Each time you log into your server as root, the Automatic Update Utility is run. It installs the latest fixes and security patches for your server. Don’t disable it! In fact, don’t delete anything from the /root folder. You’ll need all of it sooner or later.

We recommend you log into your server as root at least once a week to keep your server current. Ditto for the web interface to Incredible PBX. Insofar as security is concerned, we make a best effort to keep the components of Incredible PBX up to date. The Linux operating system was installed by you before the Incredible PBX install began. That’s a nice way of saying Linux security is primarily your responsibility. When an egregious Linux vulnerability comes along that we know about, we will try to notify you of the issue on the PIAF Forum and on the RSS Feed that is part of the Incredible PBX GUI. Check the RSS Feeds at least once a week as well. As a condition of use of the free Incredible PBX product, you accepted ultimate responsibility for the security and reliability of your server. None of this discussion changes any of that.

5. Resetting Incredible PBX Passwords

Yes. It happens to all of us. We forget our passwords. Incredible PBX includes a convenient utility that lets you reset many of the passwords associated with Incredible PBX. Just log into your server as root and issue the command: /root/update-passwords

To reset Incredible PBX GUI admin password, issue command: /root/admin-pw-change

To reset the AvantFax admin password which is accessible within the Incredible PBX GUI, issue the following command: /root/avantfax-pw-change

6. Apache Authentication with Incredible PBX

With the exception of the Admin GUI and WebMin, all web-based applications included in Incredible PBX require successful Apache authentication to gain access. When you installed Incredible PBX, you should have created an admin account for Apache. If not, issue the following command using a secure password after logging in as root:

htpasswd -cb /etc/pbx/wwwpasswd admin newpassword

With the exception of AsteriDex and Reminders, you gain access to other Incredible PBX applications with the admin Apache account. For the remaining apps, you may wish to (but don’t have to) assign different account names and passwords to various departments in your organization. To set up these accounts, use the syntax above substituting the name of the department for "admin" and the department password for "newpassword."

7. Managing the IPtables Linux Firewall

As installed, Incredible PBX includes a preconfigured, locked-down Linux firewall that restricts incoming IPv6 traffic to localhost and, via a Travelin’ Man 3 WhiteList application, limits incoming IPv4 traffic to your server’s public and private IP addresses, your desktop computer’s IP address (that was used for the install), private LAN and NeoRouter VPN traffic, and a collection of our favorite VoIP providers. You can WhiteList additional IP addresses for additional providers or for SIP and IAX phones located outside your firewall. The following firewall management scripts are accessible from the /root directory:

  • ./add-ip — WhiteList an additional IP address or IP address range (CIDR)
  • ./add-fqdn — WhiteList a site using a fully-qualified domain name (FQDN)
  • ./del-acct — Remove previously designated entry from the WhiteList
  • ./ipchecker — Check whether specified FQDNs have changed & update IPtables
  • iptables-restart — Used exclusively to restart IPtables and test for failed FQDNs
  • iptables -nL — Check the current status of your IPtables firewall

IPtables can be manually configured (if you know what you’re doing) by editing iptables and ip6tables in /etc/sysconfig. Additional IPtables rules are included and managed in /usr/local/sbin/iptables-custom. NEVER use traditional iptables commands such as iptables save to update your IPtables configuration, or you will permanently delete all of your FQDN entries! Instead, use the provided utilities to whitelist additional sites and then restart IPtables using iptables-restart. This protects the FQDN entries in your setup while also checking for invalid FQDN entries and removing them temporarily so that IPtables will successfully restart. If you use service iptables restart to restart IPtables and there happens to be an FQDN entry for a host that is either down or has disappeared, IPtables will fail to restart and your server will be left with NO firewall protection! Using the traditional IPtables mechanisms also will disable Fail2Ban. Incredible PBX periodically checks for changed FQDN entries using the ipchecker script configured in /etc/crontab.

If you elect to integrate Facebook into your Incredible PBX setup, you will need to manually uncomment the last 3 lines in /usr/local/sbin/iptables-custom in order to whitelist the Facebook servers. Then restart the firewall: iptables-restart

WARNING: By default, Incredible PBX whitelists all of the non-routable LAN subnets including 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. If you elect to install Incredible PBX in the Amazon Cloud, be advised that Amazon treats the 172.16.0.0/12 subnet as routable IP addresses. This means that anyone in the Amazon Cloud (including the bad guys) will have direct access to your server. While they still need a password or vulnerability to gain access, it nevertheless exposes your server to needless hacking attempts. We strongly recommend that you comment out the 172.16.0.0/12 entry in /usr/local/sbin/iptables-custom if you intend to deploy your server in the Amazon Cloud. Then restart the firewall: iptables-restart

8. PortKnocker Remote Access

IPtables is a powerful firewall that keeps the bad guys out. It also will keep legitimate users (including you) from gaining remote access to your server unless you had the forethought to WhiteList your remote IP address before you left on that family vacation. Unfortunately, you don’t always know your IP address in advance. And dynamic IP addresses assigned with hotel WiFi frequently change. To address this problem, Incredible PBX includes a preconfigured PortKnocker utility. This lets you send three secret "knocks" on random TCP ports to your server to tell it to let you in either temporarily (until IPtables is restarted) or permanently.

To reconfigure PortKnocker to permanently whitelist IP addresses from which you issue a successful knock, login as root and issue the command: iptables-knock activate

For PortKnocker to work, you obviously need to know the secret knocks. You’ll find them in /root/knock.FAQ. Record them in your wallet or inside your suitcase for that rainy day! There are PortKnocker apps for almost all smartphones as well as for Windows, Mac, and Linux computers. Install your favorite AND test access before you leave town. You can change the ports by editing /etc/knockd.conf. Then restart PortKnocker: service knockd restart

Finally, be aware that PortKnocker does not need any special access to your server to work; however, if your server is behind a hardware-based firewall, then you must map the three PortKnocker TCP ports to the private IP address of your server, or the knocks obviously will never get delivered to your server.

If you installed Incredible PBX on a cloud platform, then your server may use a network port other than eth0. Typically, it’s venet0:0 on OpenVZ servers. You can decipher the name of your network port for your public IP address by issuing the command: ifconfig. In this case, the config file needs to be modified and then PortKnocker needs to be restarted. Edit /etc/sysconfig/knockd and insert the following: OPTIONS="-i venet0:0". Restart PortKnocker with the command: service knockd restart

Review our PortKnocker tutorial for additional configuration tips.

9. Travelin’ Man 4 Remote Access (dial TM4)

In addition to PortKnocker, Incredible PBX also includes a telephone-based solution to temporarily gain remote access to your server. This does require a bit of preplanning since you must create account credentials for the person to whom you wish to give remote access via a phone call. The complete tutorial for Travelin’ Man 4 is available on the PIAF Forum. All of the pieces already are in place on your server so skip down to the Configuration & Operation sections for details on implementation. The tutorial also covers the Administrator Utilities in /root/tm4 which let you set up remote user accounts.

10. Using the Conference Bridge (dial CONF)

A new turnkey Asterisk 13 Conference Bridge has been added to Incredible PBX. A conference bridge allows a group of people to participate in a joint phone call. Typically, participants dial into a virtual meeting room from their own phone. This virtual meeting room supports dozens or even hundreds of participants depending upon server capacity.

You do not need a timing source for conferencing with Incredible PBX! Old-style Asterisk Conference Rooms which required a timing source are disabled.

To access the Conference Bridge, dial C-O-N-F (2663) from any phone connected to your server. Remote users can be added to a conference by providing a DID that points to an IVR which includes Conference Bridge access. Once connected to the conference bridge, a caller is prompted for the Conference Bridge PIN and his or her name. You can decipher or modify the user and admin passwords to access the Conference Bridge in the Incredible PBX GUI: Applications:Conferences. Then edit 2663 and review the User and Admin PINs.

11. CallerID Name (CNAM) Lookups

By default, Incredible PBX is configured to automatically provide OpenCNAM CallerID name lookups for the first ten calls received each hour. These lookups are only from cached entries in the OpenCNAM database; however, you can enable the commercial lookup service if desired. The cost is four tenths of a cent per successful query.

To enable the OpenCNAM Professional Tier, set up an account at OpenCNAM.com. Once you’ve obtained your credentials, edit the OpenCNAM entry in Admin:CID Superfecta:Default. You may also wish to enable AsteriDex lookups and move the scheme to the top of your list of lookup schemes.

To activate CallerID Superfecta for incoming calls, edit each of your Inbound Routes and Enable Superfecta Lookup with the Default Scheme in the Other tab.

12. Faxing with Incredible PBX

If you can press the ENTER key 25 times, you are fully capable of installing Incredible Fax on your new server. Log into your server as root and run /root/incrediblefax13.sh. Provide an email address for delivery of incoming faxes and press ENTER each time you are prompted to make a selection. Once you reboot your server, you’re all set. As part of the install, you provided an email address for delivery of incoming faxes. That’s all the setup that is required to have incoming faxes sent to most of your DIDs delivered via SendMail in PDF format. The best way to figure out whether a particular provider supports fax technology on their DIDs is to send a test fax to yourself. FaxZERO lets you send 5 free faxes of up to 3 pages every day. Give it a whirl.

You also can send faxes using standard document types with the AvantFax web application. Log into AvantFax from the main Incredible PBX GUI by clicking on the AvantFax icon. The default credentials are admin:password. Choose the Send a Fax option from the main menu, fill in the blanks, and attach your document. AvantFax uses the default dialplan so use the prefix desired to send the fax using your preferred provider. HINT: Google Voice does an excellent job with both incoming and outgoing faxes, and the calls are free in the U.S. and Canada.

With the latest release of Incredible PBX 13-13, fax recognition is supported on incoming calls. Edit each of your Inbound Routes and enable Detect Faxes with Detection Type=SIP, Fax Ring=Yes, Fax Detection Time=4, and Fax Destination=Custom Destination:Fax (HylaFax) in the Fax tab.

Copies of all incoming faxes also are available for retrieval within AvantFax.

13. Voicemail 101 for Incredible PBX

Voicemail functionality is enabled on an extension-by-extension basis as part of the extension setup under the Voicemail tab. Once enabled, you can set up your mailbox and retrieve your messages by dialing *97 from the mailbox extension, or dial *98 to retrieve messages from any extension. Shortcut dialing is also supported, e.g. *98707 would retrieve messages for extension 707. You can leave a message for or forward calls to any extension’s mailbox without actually calling the extension. Just prepend * to any extension number before dialing, e.g. *701. A number of the system settings for voicemail can be tweaked under the Voicemail tab as well. For example, you can automatically delete voicemails once they have been delivered by email. Voicemail Blasting to multiple mailboxes is also supported. Just choose this option under the Applications tab and follow your nose.

14. Email Delivery of MP3 Voicemails

Speaking of email delivery, your voicemails also can be delivered to any email address of your choosing. For every extension under the Voicemail tab for the Extension, simply add an Email Address and enable the Email Attachment. With Incredible PBX, the voicemail message will be attached to the email in MP3 format so it’s suitable for playback with most email clients on desktop PCs, Macs, and smartphones. Be advised that some Internet service providers (such as Comcast) block downstream SMTP servers. You can check whether your outbound email is flowing by accessing WebMin (below) and choosing Servers -> SendMail Mail Server -> Mail Queue. Or you can issue the following command using your destination email address:

echo "test" | mail -s testmessage your-name@your-email-provider.com

If you find outbound mail is accumulating after checking in WebMin, then you’ll need to add your ISP’s SMTP server address as a SmartHost for SendMail as documented in the next section.

15. Reconfiguring SendMail for a SmartHost

Many residential Internet service providers block downstream SMTP servers such as the SendMail server running with Incredible PBX. If you’re sending emails but they never arrive and you’ve checked your SPAM folder, then chances are your ISP is the culprit. The simple solution is to add your ISP’s SMTP server as a SmartHost for SendMail. This means outbound emails will be forwarded to your ISP for actual email transmission over the Internet. Here’s how. Edit /etc/mail/sendmail.cf and search for DS. Immediately after DS, add the FQDN of your ISP’s SMTP server, e.g. DSsmtp.comcrap.net (no spaces!). Save the file and then restart SendMail: service sendmail restart. Your email and voicemail messages with attachments should begin flowing without further delay.

16. SMS Blasting with Google Voice

Out of the box, Incredible PBX supports SMS Message Blasting if you have a functioning Google Voice account set up. Before first use, you must add your credentials, address list, and text message to the SMS Blaster scripts in the /root folder.

In smsblast, insert your credentials:

GVACCT="yourname@gmail.com"
GVPASS="yourpassword"
MSGSUBJECT="Little League Alert"

In smslist.txt, insert one or more recipients for your message. These can be a combination of SMS addresses and email addresses and will be delivered accordingly.

NOTE: For most cellphone providers, you also can send an email message for SMS delivery by the provider. The complete list of providers is available here. Email messaging for SMS requires that you know the cellphone provider for your recipient while standard SMS messaging does not.

# In lieu of SMS number, email is also OK
8431234567 Doe John
mary@doe.com Doe Mary
8435551212@txt.att.net Mr T

In smsmsg.txt, enter the text message to be sent.

Once you have all three files configured, run the script: /root/smsblast.

NOTE: Google has tightened security for using plain-text Google Voice passwords as this application and the next one require. Before you begin, log into your server as root and issue the following command: gvoice. Try logging in with your Google Voice credentials including @gmail.com in your username. If the login fails, perform the following steps using a web browser after logging into the same Google account: (1) Perform the Google Voice Reset Procedure. (2) Enable Less Secure Apps using this Google tool. Then immediately try logging in to gvoice from the CLI again.

17. Voice-Activated SMS Messaging (dial SMS)

In addition to message blasting, you also can dial 767 from any extension and dictate an SMS message to send through your Google Voice account. When prompted for the destination, simply enter the 10-digit SMS number of the recipient. This new implementation of SMS Dictator requires both Google Voice and IBM STT credentials. Follow this tutorial to get started with the latest code.

18. SMS Messaging with VoIP.ms

Incredible PBX for Asterisk-GUI also supports SMS messaging through VoIP.ms if you have an account and an SMS-enabled DID. See the VoIP.ms wiki for setup info on the VoIP.ms side.

To install the VoIP.ms SMS scripts, follow these steps:

cd /root
mkdir sms-voip.ms
cd sms-voip.ms
wget http://incrediblepbx.com/voipms-SMS.tar.gz
tar zxvf voipms-SMS.tar.gz

Edit voipms-sms.php and insert your VoIP.ms number that supports SMS messaging (no spoofing allowed!):

$SMSsender="8005551212";

Edit class.voipms.php and insert your VoIP.ms API credentials:

    /*******************************************\
     *  VoIPms - API Credentials
    \*******************************************/
    var $api_username   = 'yourname@youremail.com';
    var $api_password   = 'yourpassword';

Send an SMS message through VoIP.ms with the following command where smsnumber is the 10-digit number of the SMS recipient and "sms message" is the text message surrounded by quotes:

/root/sms-voip.ms/voipms-sms.php smsnumber "sms message"

NOTE: VoIP.ms has indicated that sooner or later there will be a penny per message charge for SMS messages; however, as of today, they’re still free.

19. SIP URI Calling with Incredible PBX

With one line of dialplan code, you can add Speed Dials for free SIP URI calling worldwide. The dialplan code is stored in the [CallingRule_SIP_URI] context in extensions_custom.conf. Just clone one of the existing entries, designate an extension to dial to connect to the SIP URI, and enter the SIP URI for the destination. Numerous SIP providers support assignment of SIP URI’s to DIDs for unlimited free calling from anywhere in the world. Here’s a sample using a speed dial code of 53669 that connects you to SIP URI 2233435945@sip2sip.info: exten = 53669,1,Dial(SIP/2233435945@sip2sip.info)

20. IVR Demo of Incredible PBX Apps

The easiest way to try out a number of the Incredible PBX applications is to take the IVR Demo for a spin. Just pick up any phone and dial 3366 (D-E-M-O). The sample code for the IVR is available for review and modification in the IVR section of the GUI. There’s also a sample Stealth AutoAttendant. This plays a brief greeting and then rings an extension or ring group. During the greeting, you could configure the application to allow button presses to branch to other applications on your PBX, hence the Stealth name since the codes are not disclosed to callers.

21. Backup & Restore with Incredible PBX

Incredible Backup and Restore scripts are still under development for Incredible PBX 13-13 because of recent changes in Asterisk. If backups are important to you, we strongly recommend you consider a $2.50/month cloud server at Vultr using our referral code. For an additional 50 cents per month, you get weekly image backups of your server that can be restored with a couple of button clicks. It’s the cheapest insurance you can buy for your PBX!

22. AsteriDex – The Poor Man’s Rolodex

AsteriDex is a web-based phonebook application for Incredible PBX. You can access it from the main web menu. Scripts are also available to import your contacts from Outlook and Google Contacts.

23. Voice Dialing with AsteriDex (dial 411)

If you have voice recognition enabled on your server, you can call anyone in your AsteriDex database by dialing 411.

24. Speed Dialing with AsteriDex (dial 000+)

For those without voice recognition, Incredible PBX includes two speed dialing utilities. The first is accessed by dialing 412. Then enter any 3-digit dialcode from your AsteriDex database to complete the call. If you’d prefer to skip the intermediate step, dial 000 + the 3-digit speed dial code desired. The call will be placed immediately using your default outbound routes.

For a complete listing of your AsteriDex dial codes, execute this query:

mysql -u root -ppassw0rd asteridex -e "select name,dialcode from user1 order by name"

To automatically generate the 3-digit speed dial codes for everyone in your AsteriDex database using the first three letters of each name, run the following script from your web browser: http://your-server-ip/asteridex4/dialcode.php.

25. Telephone Reminders (dial 123)

Incredible PBX includes a sophisticated reminders system that lets you schedule individual or recurring reminders using your phone by dialing 123 or a web browser. A complete tutorial is available here. For phone reminders, a password is required to access the reminder system. Typically, these reminders set up a return call at a scheduled time that then plays back either a recorded message or a TTS message generated from the text you entered in the browser application. Incredible PBX also includes a new addition that lets you schedule web reminders that are delivered by email or SMS message.

26. DISA Access with Incredible PBX

Direct Inward System Access (aka DISA) is one of the great PBX inventions of the last 50 years. It’s also one of the most dangerous. It lets someone connect to your PBX and obtain dial tone to place an outbound call using your trunks… on your nickel. Typically, it is offered as an option with an IVR or AutoAttendant. The DISA extension is not preconfigured with Incredible PBX; however, you can easily set it up in the GUI by choosing Applications:DISA. Make up a very secure PIN before exposing DISA access to the outside world. It’s your phone bill.

27. Yahoo! News (Dial 951)

Yahoo! news headlines are available by dialing 951. The news option also is included in the sample IVR application.

28. Weather Forecasts by Phone (dial 947)

You can obtain a current weather forecast for most zip codes by dialing 947 (Z-I-P) and entering the 5-digit zip code.

29. ODBC Application Support for Asterisk

If you’ve recently logged into your server as root, Automatic Update #4 added ODBC/MySQL application support for Asterisk. You can try out a few sample applications that are included to get you started. Dial 222 and enter 12345 for the employee number. This retrieves an employee name from the MySQL timeclock database using Asterisk. Dial 223 to retrieve an AsteriDex name and phone number by entering the 3-character dialcode. You then have the option of placing the call by pressing 1. Once you have created accounts for Travelin’ Man 4, you can dial 864 (T-M-4) to WhiteList an IP address for that account after entering the account number and matching PIN. Use the * key for periods in the IP address.

30. Today in History (Dial T-O-D-A-Y)

It’s always interesting to find out what happened Today in History. And Incredible PBX now delivers it by phone. Just dial 86329 (T-O-D-A-Y) for a walk down memory lane.

31. Time of Day

Speaking of yesteryear, if you grew up dialing TI-4-1212 for the time of day, Ma Bell may have discontinued the service, but we haven’t. Now you can do it on your very own PBX.

If you want your users to be able to dial in for the time directly by dialing extension, here’s how. In the GUI, choose Admin:Custom Destinations:Add Destination. Set up a Time of Day description with a target of new-time,s,1 and save your entry. Now Enable an Application:Misc Application:Add Application with a Feature Code of 8463, Time of Day description, and point it to Custom Destination:Time of Day. Save your entry and then dial 8463 (T-I-M-E) for the Time of Day.

WebMin: The Linux Swiss Army Knife

There is no finer Linux application than WebMin. There is no more dangerous Linux application than WebMin. You’ve been warned. We heartily recommend WebMin as a tool to LOOK at your server’s settings. We strongly discourage changing anything in WebMin unless you totally know what you are doing. This is especially true with management of Linux applications that make up the core of Incredible PBX: the Linux kernel, SendMail, IPtables, Apache, MySQL, PHP, and…

To access WebMin, visit the following link with a web browser using the actual IP address of your server: https://ip-address:9001/. The username is root. The password is your root password. WebMin has root privileges to your server. Reread paragraph 1 and act accordingly.

For an exhaustive tutorial on WebMin, download The Book of WebMin by Joe Cooper. For a more recent commercial offering, take a look at Michal Karzyński’s WebMin Administrator’s Cookbook.

Enjoy your new Gotcha-Free PBX, and… Happy Cyber Monday! It’s always been one of the happiest days of the year around our office.

Check out the new Incredible PBX 13-13 ISO. Complete tutorial available here.

Originally published: Monday, November 27, 2017


Support Issues. With any application as sophisticated as this one, you’re bound to have questions. Blog comments are a terrible place to handle support issues although we welcome general comments about our articles and software. If you have particular support issues, we encourage you to get actively involved in the PBX in a Flash Forums. It’s the best Asterisk tech support site in the business, and it’s all free! Please have a look and post your support questions there. Unlike some forums, ours is extremely friendly and is supported by literally hundreds of Asterisk gurus and thousands of users just like you. You won’t have to wait long for an answer to your question.



NEW YEAR’S TREAT: If you could use one or more free DIDs in the U.S. with unlimited inbound calls and unlimited simultaneous channels, then today’s your lucky day. TelecomsXChange and Bluebird Communications have a few hundred thousand DIDs to give away so you better hurry. You have your choice of DID locations including New York, New Jersey, California, Texas, and Iowa. The DIDs support Voice, Fax, Video, and even Text Messaging (by request). The only requirement at your end is a dedicated IP address for your VoIP server. Once you receive your welcome email with your number, be sure to whitelist the provider’s IP address in your firewall. For Incredible PBX servers, use add-ip to whitelist the UDP SIP port, 5060, using the IP address provided in your welcoming email.

Here’s the link to order your DIDs.

Your DID Trunk Setup in your favorite GUI should look like this:

Trunk Name: IPC
Peer Details:
type=friend
qualify=yes
host={IP address provided in welcome email}
context=from-trunk

Your Inbound Route should specify the 11-digit DID beginning with a 1. Enjoy!



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

3CX in the Cloud: 8 Great Ways to Secure Your Server




Now that many of you have taken advantage of the opportunity to deploy a free 3CX server, it seemed like an opportune time to share what we’ve learned while deploying 3CX on hosted platforms in the cloud. If you’ve followed our Nerd Vittles adventures over the years, you already know that our number one consideration with any PBX deployment is security. Without that, you’re just paying somebody else’s phone bill. While 3CX is extremely secure as delivered, once you choose a cloud-based platform, it’s a new ballgame. There is no 3CX firewall sitting between your PBX and the Internet.

We hear some of you saying, "I love Asterisk. Why would I want to move to 3CX?" The short answer is don’t move, add a new 3CX server to supplement your existing Asterisk® infrastructure. Why? Because the 3CX Clients for Windows, Macs, iOS, and Android are incredibly compelling. You can make a connection from anywhere using WiFi or cellular infrastructure and make crystal clear calls with zero hassles. Better yet, folks can reach you on your mobile phone from anywhere in the world at zero cost by dialing your SIP URI using any SIP device including SIP softphones and other 3CX Clients. And the 3CX Client is literally plug-and-play. Send the welcome email for the extension you wish to activate on the 3CX Client, and in one-click your 3CX Client is automatically configured and on line. By interconnecting your 3CX server with your existing Asterisk infrastructure, you get the best of both worlds without the messy NAT and firewall problems that were daily fare using Asterisk alone. But we’re getting ahead of ourselves, let’s get your 3CX server in the Cloud properly secured before moving on to the fun stuff.

Five years ago, we first introduced our Failsafe PBX Security Tips to Sleep Like a Baby. That’s well worth a careful read before we begin. For today, we’ll be implementing most of the Travelin’ Man 3 Security Model with a few tweaks to take advantage of existing 3CX security features. We’ll walk you through (1) choosing a cloud platform, (2) deploying the IPtables Linux firewall, (3) implementing a WhiteList to hide your server from those that don’t need access, (4) installing PortKnocker to make it easy for end-users to give themselves access to your PBX, (5) configuring FQDNs and implementing dynamic DNS updates for remote users, (6) setting up a BlackList to complement 3CX’s existing Anti-Hacking mechanisms, (7) deploying IPset to facilitate blocking entire countries from accessing your server, and (8) protecting SSH by setting up Fail2Ban and changing ports.

Let’s spend a moment considering the best security methodology for your cloud-based server. The short answer is IT DEPENDS. If all of your users are situated in the same location and never travel and you don’t care to enable SIP URI calling from anywhere in the world to save on phone costs, then the solution is pretty easy. We can lock your server down to the public IP address of your private LAN, and nobody else will ever see your server. Once you add users outside your home office, things get more complicated. If they are all sitting behind local routers with public IP addresses that are static, things are still fairly straightforward. We can whitelist all of the static IP addresses, and again nobody else will see your 3CX server. If you have users that travel for a living or need 3CX Client connectivity from their smartphones or from PCs at various locations that only have dynamic IP addresses, then things get more complicated. You can take your chances and expose SIP communications ports while locking down other access, or you can lock down everything, assign FQDNs to each user, and use dynamic DNS clients running on Android or iOS devices or local PCs to regularly update IP addresses of users in the firewall whitelist.

Another option that we use when traveling is PortKnocker which will be installed as part of our Travelin’ Man 3 security suite. The way this works is you send a single packet to three different TCP ports on your server using a predefined sequence of 3 port numbers. When there is a match, the server will automatically whitelist your IP address. Then you can log into SSH or the Web portal or use a 3CX Client in the usual way. There are PortKnocker clients for smartphones (Android’s DroidKnocker and iOS PortKnock), or you can use the command line from a Linux server to immediately authorize remote access from any IP address. No firewall modification is required. By default, Travelin’ Man 3 temporarily authorizes IP address access until the next server reboot. But you can elect to permanently whitelist the IP addresses if desired. Again, all of this can be performed remotely by end-users without ever touching your server or calling upon assistance from an administrator.

Finally, we’ve provided utilities in /root to assist an administrator in whitelisting IP addresses (add-ip) or FQDNs (add-fqdn) as well as removing whitelisted entries (del-acct). In addition, if you prefer to leave your server exposed, we’ve included tools to blacklist IP addresses (add-blacklist), and our discussion below will provide some alternatives to secure SSH access. Whichever path you choose, just be aware that server security it totally your responsibility, not ours and not 3CX’s. We strongly recommend that you regularly monitor the Event Log in the 3CX Dashboard for security issues and attempted breaches. You then can make firewall adjustments to address the problems or to further lock down your server.

LEGAL DISCLAIMER: ALL OF THE SECURITY CODE WHICH FOLLOWS IS DISTRIBUTED AS IS AND PURSUANT TO THE GPL2 LICENSE. YOU AGREE TO ASSUME ALL RISKS BY USING THIS SOFTWARE. YOU ARE FREE TO MODIFY IT TO MEET YOUR REQUIREMENTS SO LONG AS YOU COMPLY WITH THE GPL LICENSE TERMS AVAILABLE HERE.

For today’s tutorial, we will cover both the WhiteList 3CX firewall methodology and the less secure BlackList alternative. We’ll walk you through exposing the necessary ports if you elect to use this relaxed security configuration for your server. Just be aware that it’s your phone bill at stake particularly if you have authorized calls to countries outside the location of your server as part of your 3CX setup.

1. Choosing a 3CX Cloud Platform

Here are a few things to consider when choosing a cloud platform for your 3CX server. Keep in mind that the cloud giants like Amazon charge for data bandwidth usage AND data storage AND processing cycles. Even though Amazon uses what are traditionally considered non-routable IP addresses internally, be advised that Amazon internally routes these private LAN addresses. What that means is that, if you have whitelisted private LAN addresses in the 172.16.0.0/12 range, you will expose your server to hacking attempts from anyone with an Amazon S3 account. For that reason coupled with the pricing structure, we recommend against using Amazon as your 3CX cloud platform.

We also recommend you stick with VPS hosting plans using the KVM architecture and avoid OpenVZ unless it’s hosted with Virtuozzo 7. The traditional shared kernel architecture of OpenVZ means you will forfeit the ability to use powerful tools such as IPset to blacklist country-wide IP addresses from countries such as China and Russia. Over 90% of the attacks we see on our web sites originate from IP addresses in just those two countries. Fortunately, the new Virtuozzo 7 implementations of OpenVZ support ipset. SSDnodes in Montreal is the provider we use.

The rest of the cloud platform equation comes down to balancing the feature set and performance against the cost. At the bottom of the barrel is CloudAtCost which offers lifetime cloud services for a one-time charge PLUS an annual maintenance charge. Performance and reliability range from awful to tolerable. As an experimental platform, it’s worth considering. For anything beyond that, don’t waste your time or money.

Our preferences in low-cost, moderate performance cloud platforms include OVH virtual private servers ($3.49/mo. for 2GB RAM, 10GB SSD, 100Mbps unlimited bandwidth, and DDoS protection), Vultr VPS ($5/mo. for 1GB RAM, 25GB SSD, 1TB bandwidth), and Digital Ocean ($5/mo. for 512MB RAM, 20GB SSD, 1TB bandwidth plus $10 usage credit). For high performance, long-term use, nobody beats our corporate sponsor, RentPBX.com, at $15/mo. with referral code: NOGOTCHAS.1

2. Deploying the IPtables Linux Firewall

We’ve taken the pain out of deploying IPtables as a 3CX firewall. Our Travelin’ Man 3 script for 3CX does the heavy lifting for you by installing and preconfiguring IPtables and a collection of other security components. There are two alternatives when running the installer. You can completely lock down your server and use a firewall whitelist to enable access from specified IP addresses or FQDNs. There are utilities to allow administrators and end-users to add their own addresses to the whitelist. The other option is to run 3CX without the whitelist functionality and employ blacklisting to reduce the exposure of your server. This obviously increases the security risks but reduces the administrative burden on administrators and end-users. And, as you probably know, 3CX includes some security mechanisms to block or reduce attacks on your server. A third option using 3CX Clients or SBCs in networks that prevent VoIP calls is to deploy 3CX’s VPN-like Tunnel. This is well documented in this server tutorial and this client tutorial. It’s worth a careful look if you’re in a country that blocks VoIP calls, and it works with either TM3 firewall configuration. A fourth option which we will save for another day is to employ virtual private networks such as OpenVPN and NeoRouter. With VPNs, there’s more work on the front end but less day-to-day administration once properly configured.

If you don’t have widely scattered users and traveling users that need to employ 3CX Clients, the WhiteList option is far preferable. It sets up a WhiteList of devices that are authorized to access your PBX. Nobody else can even see the server on the Internet. To get started, log into your server as root using SSH or Putty. Be sure to login from a computer that will be used to manage your server so that this computer’s IP address gets whitelisted. You don’t want to lock yourself out of your own server! Then issue the following commands at the Linux prompt to run the TM3 installer, accept the license agreement, and choose either the WhiteList or BlackList option when prompted:

cd /
wget http://incrediblepbx.com/tm3-3cx.tar.gz
tar zxvf tm3-3cx.tar.gz
rm -f tm3-3cx.tar.gz
cd /root
./tm3-3cx.sh

When the installer finishes, press ENTER. You now have a functioning 3CX firewall with IPtables and Fail2Ban functionality to protect SSH logins from hacking attempts, IPset to block server access from certain countries, PortKnocker to facilitate remote user access to servers employing a WhiteList, and a collection of utilities in /root to facilitate WhiteListing and BlackListing of IP addresses and FQDNs by administrators.

3. Implementing the 3CX Firewall WhiteList

For the more technical types, here’s an overview of how the IPtables firewall is configured and functions. Currently, only IPv4 is protected. The basic setup is handled in /etc/iptables/rules.v4 by making a copy of rules.v4.tm3 and whitelisting 3 IP addresses: your server, your user PC from which you logged into SSH, and your public IP address. Additional whitelist entries are added using add-ip or add-fqdn in /root. Or end users can whitelist themselves using the PortKnocker credentials stored in /root/knock.FAQ. IPtables ALWAYS must be restarted/reloaded using the command: iptables-restart. This assures that all necessary components are reloaded including the base rules.v4 IPtables config plus the custom config in /usr/local/sbin/iptables-custom plus Fail2Ban. An administrator can remove whitelisted entries using /root/del-acct using the *.iptables filename associated with the entry to be removed. PortKnocker whitelist entries are stored by creation date.

Two templates for the TM3 custom configuration are stored in /usr/local/sbin. The WhiteList is iptables-custom.secure. The BlackList is iptables-custom.insecure. As part of the install, one or the other is copied into iptables-custom for use with your IPtables firewall. The code is well documented so that administrators can easily make modifications to support your own requirements. Simply rerun the tm3-3cx.sh installer once you have made changes, and your server will be reconfigured. Be advised that any previously added whitelist entries should be removed (/root/*.iptables) BEFORE rerunning the installer as these entries will not be replicated.

4. Using PortKnocker with the TM3 Firewall

There are two ways to use PortKnocker for end user management of the WhiteList. The default methodology is to temporarily WhiteList qualifying IP addresses whenever a successful port knock is performed from any remote site. This WhiteList addition to the firewall lasts only until the firewall is restarted with iptables-restart or the server is rebooted. For a mobile workforce, this is probably the preferable alternative with frequently updated remote IP addresses. The other alternative is to permanently add successful PortKnock IP addresses to the iptables-custom whitelist. The administrator can activate this by running the following command: iptables-knock activate. As with other WhiteList additions, these are stored in /root as *.iptables. To use PortKnocker, remote users will need the secret knock credentials stored in /root/knock.FAQ. Should you ever need to modify these codes when an employee is fired, simply edit /etc/knockd.conf and change the codes. Remember to revise /root/knock.FAQ with the new codes. Then restart PortKnocker: /root/knock-tester.sh.

5. Configuring Dynamic DNS for End Users

Here’s an easier way to set up remote users whose IP addresses regularly change either because of an ISP’s dynamic IP addressing scheme or because the user travels or frequently uses 3CX Clients from a smartphone. The trick here is to assign a fully-qualified domain name (FQDN) to each remote user’s device and then deploy a dynamic DNS update application on their device to keep the user’s current IP address in sync with their FQDN. As part of the TM3 implementation on 3CX, we included the /root/ipchecker script which checks for IP address changes every 10 minutes and updates the firewall whitelist accordingly. All that is required from the administrator is running /root/add-fqdn once for each remote user. Everything else is automatic on the 3CX server and the end user device.

There are a number of Dynamic DNS providers. Some are free and others have a modest annual fee. When it comes to DNS service, you get what you pay for. And our favorite remains dyndns.com. There are hundreds of domain names from which to choose, and there are update clients for most client platforms: Windows, Mac, Linux, iOS, and Android.

The setup procedure is straight-forward. (1) Choose a FQDN for each of your users on the dynamic DNS provider site. (2) Install and configure the DNS updater on each client device. (3) Run /root/add-fqdn on your 3CX server to add the FQDNs of each user to the TM3 WhiteList. (4) Restart IPtables: iptables-restart.

6. Implementing BlackLists with the TM3 Firewall

If an administrator elects NOT to deploy the 3CX firewall with a WhiteList and opts for the open 3CX firewall, then there are some additional steps to assure that your server remains secure. First, you’ll want to carefully monitor the 3CX Event Log in the 3CX web dashboard. When you spot hacking attempts that are being temporarily blocked by your 3CX server, immediately add them to your IPtables BlackList: /root/add-blacklist ipaddress. Thereafter, those users will no longer be able to access your server. After adding less than a handful of entries, our exposed server has not seen any further hacking attempts. YMMV!

7. Configuring Country Blocking with IPtables

The primary reason individual blacklist entries are unnecessary is because the TM3 installer automatically configures IPset to block access from a number of problematic countries. You can review these in /etc/block-china.sh and make modifications based upon your own requirements. Keep in mind that, if you add or remove countries from the script, you will need to add/remove the same entries in /usr/local/sbin/iptables-custom to assure that all of the countries you intend to block are assimilated into your firewall’s blacklist. Then reload the IPset tables and restart IPtables with this command: /etc/block-china.sh. To begin, you’ll need to decipher the country code for additional countries you wish to block. The country listing with codes is available here. The IPset country zones are available here.

The syntax for a new country addition in /etc/block-china.sh looks like this with the country name inserted in lines 1 & 4 and the country code inserted in lines 2 & 3:

/sbin/ipset -N china hash:net
rm cn.zone
/usr/bin/wget -P . http://www.ipdeny.com/ipblocks/data/countries/cn.zone
for i in ; do /sbin/ipset -A china ; done

The blacklist entries in /usr/local/sbin/iptables-custom look like this using the country name from above:

/sbin/iptables -A INPUT -p tcp -m set --match-set china src -j DROP
/sbin/iptables -A INPUT -p udp -m set --match-set china src -j DROP

None of the country modifications take effect until you reload the IPset tables and restart IPtables. Both are accomplished by running /etc/block-china.sh.

8. Hardening SSH with 3CX in the Cloud

If you chose to implement the TM3 WhiteList option, SSH on your 3CX server is insulated from SSH attacks because the bad guys can’t see or access port 22 on your server. However, if you’re using the non-WhiteList approach with IPtables, then some additional safeguards to secure SSH are appropriate. As part of the TM3 security suite, Fail2Ban was installed to block repeated attempts to login to SSH. While this offers some protection, be advised that Fail2Ban scans logs and, as such, requires a sufficient time slice of processing power to complete the task regularly. Some of the more vicious hacking attempts originate from extremely powerful server platforms that can monopolize processor resources thereby depriving Fail2Ban of the necessary horsepower to adequately protect your server from brute force SSH attacks. The most important thing you can do to protect SSH on your server is to regularly review /var/log/auth.log for hacking attempts and block those IP addresses using the add-blacklist script.

The most effective way to configure SSH access is to deploy key-based authentication using cryptographically secure keys. Once enabled and tested, be sure to remove the ability to login using your root password. But be aware that removing root password access will mean that you cannot login to your server from multiple devices without copying your private key to every device from which you wish to obtain access. An excellent tutorial that will walk you through the basic implementation procedure is available from Digital Ocean.

The other effective way to minimize SSH attacks is to change the default access port on your server from port 22 to some other TCP port above 1024. While there are arguments against this approach, if you have a dedicated IP address assigned to your server, the likelihood of a bad guy hijacking your IP address and setting up a script to fake SSH behavior and surreptitiously collect your passwords is extremely remote. Most of the bad guys use toolkits that target port 22 for brute force SSH attacks. By changing the port, you cut your vulnerability by about 99 per cent. Here’s how. First, edit /etc/ssh/sshd_config. Change the line near the top of the file from Port 22 to some port number above 1024. If the line is commented out with #, remove the #. Second, edit /etc/iptables/rules.v4. On or about line 27, change 22 to the port number you assigned in the first step. Third, edit /etc/fail2ban/jail.conf. Scroll down to the [ssh] section of the file and change the port entry to: port = ssh,1234 where 1234 is the port number you assigned in step one. Save the file. Fourth, restart SSH: /etc/init.d/ssh restart. Finally, restart IPtables: iptables-restart.

When using an SSH client to login to your server, the new syntax should look something like this: ssh -p 1234 root@ipaddress where 1234 is the port you assigned for SSH access to your server and ipaddress is the IP address or FQDN of your server. When using putty, be sure to change the port to match the SSH port you assigned for SSH access to your server.

Nerd Vittles Exclusive: Grab your new (free) 3CX perpetual license with unlimited SIP trunks, 10 extensions, 4 simultaneous calls, and 10-user conferencing here.

Originally published: Friday, June 23, 2017



Need help with 3CX or VoIP? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

  1. Some of our links refer users to providers that support Nerd Vittles through referral fees or advertising. These funds help cover the costs of our blog. We never recommend particular products solely to generate revenue. However, when pricing is comparable or particular features warrant our recommendation, we support these vendors and deeply appreciate their financial support of our software development efforts. []

Introducing the FUD-Free Firewall for FreePBX Distro and AsteriskNOW

After frequent complaints from our FreePBX® users, we introduced a firewall application for the PBX in a Flash™ and Incredible PBX™ platforms that protected FreePBX resources. That was over 5 years ago. The product became Travelin’ Man™ 3, an IPtables-based WhiteList that totally eliminated access to your Asterisk® server unless a WhiteList entry had been authorized by the administrator. The application was further embellished over the years to facilitate access by remote users. First, we introduced PortKnocker™ for Asterisk® and later we introduced Travelin’ Man 4 to let users call in with a passcode to authorize server access. For the past several years, a preconfigured firewall has been an integral component in what has become the 7-Layer Security Model included in all Incredible PBX builds. TIP: Security is not a new idea for us.

During this evolution, the FreePBX developers introduced their own distribution, the FreePBX Distro™. Conspicuously absent was a functioning firewall. We believed that the shortcoming would be remedied quickly. Hasn’t happened! In the meantime, a number of serious security vulnerabilities arose in the FreePBX product that compromised numerous servers running their distribution because of the absence of a functioning firewall. Digium® recently reintroduced AsteriskNOW™ as a clone of the FreePBX Distro. But still no firewall.

About a month ago, we decided to close the loophole for everyone’s security and develop a firewall for the only FreePBX-based distributions without a firewall, the FreePBX Distro and AsteriskNOW. Last week we began the rollout with a Nerd Vittles article explaining why this was essential, as if an explanation were necessary. Today, you get the GPL code.

Suffice it to say, our article was not well received. The usual Sangoma® players went into Damage Control Mode with what has become a predictable scenario whenever security issues are raised concerning the FreePBX design or vulnerabilities.

Meet The Sangoma 7.

  • The Good Cop: If only you’d purchase Genuine Sangoma Hardware, all of your security problems would disappear
  • The Bad Cop: Enjoy this nice Cup of FUD about your own distro which proves we’re all just alike
  • The Techie Cop: We thought of developing an open source firewall just the other day, and now you’re complaining
  • The Rest of "The Team": Let the Astroturfing Begin… Retweet, favorite, and cheer for the brilliance of My 3 Cops

The Good Cop offered to solve all your security woes if you’d just buy (some more Sangoma) hardware.

The Bad Cop suggested that, with "cookie cutter security, you might as well hand out your password." Just in case you have any doubts about whose approach has stood the test of time, let’s Google the FreePBX Security Vulnerability Track Record.

The Techie Cop claimed we had stolen his 2-day old idea to create an Open Source Firewall. Really?
Earth to Techie Cop: Where have you been for the past five years??

Funny stuff… if it weren’t so damaging to the Asterisk community and those trying to decide whether to put their faith in open source communications software.

Firewall Basics.

We’ve written dozens of articles on Asterisk security and firewall approaches so we won’t repeat all of the information. Here’s what you need to know. Software-based firewalls on Linux servers need to be integrated into the Linux kernel to be secure. IPtables is kernel-based and extremely reliable. Blacklist-based firewall designs, i.e. those that seek to identify the IP addresses of every bad guy on the planet don’t work very well. Bad guys aren’t stupid. They can do their damage by commandeering a little old lady’s Windows machine so you’re never going to collect all of the necessary "bad" IP addresses. They’re also smart enough to poison the blacklists with Internet resources you need such as DNS servers. So don’t waste your time with blacklists. WhiteLists work very well. You identify the IP addresses and FQDNs of all the Internet sites you need to support and all the SIP providers you wish to use. Nobody else even sees your server on the Internet. If the bad guys can’t see your server, they can’t attack it. Simple as that.

Travelin’ Man 3 WhiteList Tutorial.

Here are the fundamentals of the Travelin’ Man 3 design. We allow access from anybody and everybody on your private LAN. They still need a password to access FreePBX or to gain root access, but they can "see" your server. Private LAN addresses are non-routable over the Internet which means the bad guys can’t access your 192.168.0.4 IP address if you’re sitting behind a NAT-based hardware firewall. All of your internal phones will work with no firewall modifications. You may need to adjust these settings if you’re using a Cloud resource such as Amazon because they actually route non-routable IP addresses which would leave your server vulnerable without removing these entries (especially the 172 subnet for Amazon):

#-A INPUT -s 10.0.0.0/8 -j ACCEPT
#-A INPUT -s 172.16.0.0/12 -j ACCEPT
#-A INPUT -s 192.168.0.0/16 -j ACCEPT

Travelin’ Man 3 also authorizes access for certain mandatory services that are needed to keep your server operating properly. In addition, during installation, Travelin’ Man 3 whitelists localhost and the public and private IP addresses of your server as well as your PC or workstation. You obviously don’t want to lock yourself out of your own server.

As of today, Travelin’ Man 3 is primarily an IPv4 whitelist toolkit. IPv6 addresses are only supported to allow localhost access to your server. Any other IPv6 addresses must be added manually in /etc/sysconfig/ip6tables. We recommend not using FQDNs with IPv6 for the time being. And always restart IP6tables after adding new entries: service ip6tables restart.

You have the option of enabling the Incredible PBX collection of IP addresses used by many of the leading SIP providers around the world. Just run the enable-trusted-providers script in /root. The list of included providers is available here. You also have the option of adding (whitelisting) or deleting users’ and providers’ IP addresses and FQDNs yourself. Use the included scripts in the /root folder: add-ip, add-fqdn, and del-acct. For each account you set up, you get to define which access permission or combination of permissions will be available:

0 – ALL Services
1 – SIP (UDP)
2 – SIP (TCP)
3 – IAX
4 – Web
5 – WebMin
6 – FTP
7 – TFTP
8 – SSH
9 – FOP

Once you have made your selection, a user account will be created in /root with the name of the account and an extension of .iptables. Do NOT delete these files. They keep track of current IP addresses and accounts authorized for server access.

If you have remote users on the Internet, e.g. traveling salespeople, you can individually authorize access for them using a dynamic FQDN (add-fqdn) coupled with a dynamic DNS server that keeps IP addresses current as folks move around. Just load a dynamic DNS updater on their smartphone. Then plug the user entries into the included ipchecker script and execute a cron job on your server every few minutes to keep the FQDN entries refreshed. Simple.

echo "*/10 * * * * root /root/ipchecker > /dev/null 2>&1" >> /etc/crontab

IPtables does not directly support FQDN rules through the kernel. However, IPtables lets you configure your firewall rules using FQDNs which get translated into IP addresses whenever IPtables is restarted. The gotcha here is that, if an FQDN is not resolvable, IPtables fails to load, and you’re left with a vulnerable server. Travelin’ Man 3 takes care of this by employing a special restart script that temporarily disables unresolvable IP addresses.

The moral of the story:

ALWAYS USE iptables-restart TO RELOAD IPTABLES OR YOUR SERVER MAY END UP WITH NO FIREWALL!

We’ve also included support for a neat little trick that lets you whitelist remote SIP access to your server using a special FQDN. No further firewall adjustments are necessary. This is supported on most platforms except OpenVZ containers. The way this works is you first assign an obscure FQDN to your server’s IP address. It needs to be obscure because anyone with the FQDN gains SIP access to your server. But chances are pretty good that the bad guys will have a hard time figuring out that xq356jq.dyndns.org points to your server. You then can embed this FQDN in the SIP phone credentials for all of your remote users. The final step is to uncomment the last few lines in /etc/sysconfig/iptables after plugging in your obscure FQDN. Then restart IPtables: iptables-restart.

-A INPUT -p udp --dport 5060:5061 -m string --string "REGISTER sip:xq356jq.dyndns.org" --algo bm -j ACCEPT
-A INPUT -p udp --dport 5060:5061 -m string --string "REGISTER sip:" --algo bm -j DROP
-A INPUT -p udp --dport 5060:5061 -m string --string "OPTIONS sip:" --algo bm -j DROP

Finally, a word of caution about deploying Travelin’ Man 3 on the FreePBX Distro and AsteriskNOW platforms. We currently don’t have a vehicle in place to push security updates out to you as we do with Incredible PBX. This means you will have to remain vigilant to what’s happening in the telecommunications world and load updates yourself. You can stay current in a number of ways. We will post updates to this article in comments below so you can simply check back here periodically. An easier way to keep up with the latest security alerts and updates is to subscribe to the PBX in a Flash RSS Feed. This can be added to the FreePBX Status page by editing RSS Feeds in Settings -> Advanced Settings and adding:

http://pbxinaflash.com/rssfeed.xml

As you can see, there’s nothing "cookie cutter" about Travelin’ Man 3. It’s totally customizable to meet your own unique requirements. All we have done is tame IPtables and eliminate much of its complexity so that you can get a functional firewall up and running quickly. Now it’s deployment time!

Installing Travelin’ Man 3 for the FreePBX Distro & AsteriskNOW.

Log into your server as root from a desktop PC using SSH or Putty. This assures that you will have access from a device other than the console when you are finished. Then issue the following commands:

cd /root
wget http://incrediblepbx.com/tm3-firewall.tar.gz
tar zxvf tm3-firewall.tar.gz
./enable-iptables-whitelist

If you wish to enable the Incredible PBX trusted providers whitelist, issue the following command:

./enable-trusted-providers

ALWAYS use the following command to start or restart IPtables:

iptables-restart

NEVER use the following syntax with Travelin’ Man 3:

service iptables...

CHECK the status of your server at any time:

/root/status

The GPL Is NOT Dead: Coming Soon to FreePBX Distro and AsteriskNOW…

Stay tuned for Incredible PBX GUI, all of the GPL modules you know and love with NO NAGWARE and NO GOTCHAS. This also will assist users that got duped by the Sangoma offer to convert PBX in a Flash into a proprietary FreePBX Distro. After reading the Sangoma disclaimer about the script being donated by an anonymous user, ask yourself this question. When was the last time Sangoma republished code that they did not own or create themselves? Try NEVER.

BEFORE:

AFTER:

Originally published: Monday, August 10, 2015



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

Gotcha-Free PBX: GIT-R-Done with Incredible PBX for Asterisk-GUI (CentOS)


[iframe-popup id="4″]
For the die-hard developers out there, we are pleased to introduce a new version of Incredible PBX™ for Asterisk-GUI that uses GIT repos to build both Asterisk® and Asterisk-GUI with the same feature set of applications as our previous releases. You still get a Gotcha-Free PBX with pure and honest open source GPL code. No patent, trademark, or copyright minefields to trip you up. But this time around you’ll have an Asterisk platform that can be updated in seconds by running a simple upgrade script: upgrade-asterisk-to-current. Special thanks to Matt Jordan & Co. for the new GIT implementation. And our extra special thanks to Denver sports cartoonist, Drew Litton, for letting us share his GIT-R-DONE creation as well.

This time around you’ll need a 64-bit CentOS 6.5/6.6 base platform. When you complete the 30-minute install procedure, you’ll have the very latest version of Asterisk 11 and Asterisk-GUI. Both are compiled from source on your hardware platform to maximize performance. The end result is the VoIP Trifecta… better, cheaper, and faster.

Since the early Windows® days, we haven’t been big fans of GUI-only interfaces. Let’s face it. Some things can be configured more efficiently with less chance for error using other tools. Incredible PBX takes advantage of this hybrid technology by offering the best of all worlds. Administrators can use a GUI where it makes sense and use a text editor or simple web form where it doesn’t. There’s no MySQL middleware to obfuscate your Asterisk settings. So you can configure 8 VoIP trunks from 8 great providers in under 5 minutes. And there’s so much more…

Target Audience: Home or SOHO/SBO in need of a turnkey, Gotcha-Free PBX Development Platform

Default Configuration: Asterisk 11 with enhanced Asterisk-GUI, Kennonsoft GUI, and NANPA dialplan

Platform: 64-bit CentOS 6.5/6.6 running on Dedicated Server, Cloud-Based Server, or Virtual Machine

Minimum Memory: 512MB

Recommended Disk: 20GB+

Default Trunks: Google Voice, CallCentric, DIDlogic, Future-Nine, IPcomms, Les.net, Vitelity, VoIP.ms1

Feature Set: Fax, SMS messaging, VPN, Reminders, ConfBridge Conferencing, AsteriDex, Voicemail, Email, IVR, News, Weather, Voice Dialer, Wolfram Alpha, Today in History, TM3 Firewall WhiteList, Speed Dialer, iNUM and SIP URI (free) worldwide calling, OpenCNAM CallerID lookups, DISA, Call Forwarding, CSV CDRs

Administrator Utilities: Incredible Backup/Restore, Automatic Updater, Asterisk Upgrader, phpMyAdmin, Timezone Config, Plug-and-Play Trunk Configurator, WebMin, External IP Setup, Firewall WhiteList Tools

Getting Started with Incredible PBX for Asterisk-GUI (GIT Edition)

Here’s a quick overview of the installation and setup process for Incredible PBX for Asterisk-GUI:

  1. Choose a Hardware Platform – Dedicated PC, Cloud, or Virtual Machine
  2. Install Linux – 64-bit CentOS 6.5 or Scientific Linux Minimal ISO
  3. Download and Install Incredible PBX for Asterisk-GUI
  4. Install Incredible Fax for Asterisk-GUI (optional)
  5. Set Up Passwords for Incredible PBX for Asterisk-GUI
  6. Configure Trunks with Incredible PBX for Asterisk-GUI
  7. Connect a Softphone to Incredible PBX for Asterisk-GUI

1. Choose a Platform for Incredible PBX for Asterisk-GUI

Incredible PBX for Asterisk-GUI works equally well on dedicated hardware or a virtual machine. Just be sure you’ve met the minimum requirements outlined above and that you have a sufficiently robust Internet connection to support 100Kb of download and upload bandwidth for each simultaneous call you wish to handle with your new PBX.

For Dedicated Hardware, we recommend an Atom-based PC of recent vintage with at least a 30GB drive and 4GB of RAM. That will take care of an office with 10-20 extensions and a half dozen or more simultaneous calls if you have the Internet bandwidth to support it.

For Cloud-Based Implementations, this time around we recommend Digital Ocean because the GIT edition is designed to be a development platform with bleeding edge Asterisk 11 code.

For Virtual Machine Installs, we recommend Oracle’s VirtualBox platform which runs atop almost any operating system including Windows, Macs, Linux, and Solaris. Here’s a link to our original VirtualBox tutorial to get you started. We suggest allocating 1GB of RAM and at least a 20GB disk image to your virtual machine for best performance.

2. Install a Linux Flavor for Incredible PBX for Asterisk-GUI

To be clear, we plan to support many Linux flavors other than RedHat. But Rome wasn’t built in a day so hang in there. We’re flippin’ burgers as fast as we can. For today, you’ll need a 64-bit version of CentOS or Scientific Linux 6.5/6.6. On some platforms, you install 6.5. After the initial update and upgrade steps, you’ll end up with 6.6. There are many flavors of CentOS and Scientific Linux. For Incredible PBX, a minimal install is all you need.

With dedicated hardware, begin by downloading the 64-bit CentOS 6.6 minimal ISO. Boot your server with the ISO, and begin the install. Here are the simplest installation steps:

Choose Language and Click Continue
Click: Install Destination (do not change anything!)
Click: Done
Click: Network & Hostname
Click: ON
Click: Done
Click: Begin Installation
Click: Root Password: password, password, Click Done twice
Wait for Minimal Software Install and Setup to finish
Click: Reboot

With most cloud-based providers, you simply choose the CentOS 6.5 platform in creating your initial image. 512MB of RAM is plenty so long as you have a swap file. Within a minute or two, you’re ready to boot up the server.

For VirtualBox, download the Scientific Linux 6.6 minimal install .ova image from SourceForge. Then double-click on the image to load it into VirtualBox. Enable Audio and configure Network with Bridge Adapter in Settings. Then start the virtual machine. Default password for root is password.

With VirtualBox, you can skip this step. For everyone else, log into your server as root and issue the following commands to put the basic pieces in place and to reconfigure your Ethernet port as eth0. On some platforms, some of the commands may generate errors. Don’t worry about it! Just make a note of your IP address so you can log back in with SSH from a desktop computer to begin the Incredible PBX install.

For CentOS/Scientific Linux 6.5 minimal install:

setenforce 0
yum -y upgrade
yum -y install net-tools nano wget
ifconfig
sed -i 's|quiet|quiet net.ifnames=0 biosdevdame=0|' /etc/default/grub
grub2-mkconfig -o /boot/grub2/grub.cfg
wget http://incrediblepbx.com/update-kernel-devel
chmod +x update-kernel-devel
./update-kernel-devel
reboot

For CentOS/Scientific Linux 6.6 minimal install:

setenforce 0
yum -y upgrade
yum -y install net-tools nano wget
ifconfig
reboot

3. Install GIT-R-Done Edition of Incredible PBX for Asterisk-GUI

cd /root
yum -y install wget
wget http://incrediblepbx.com/incrediblepbx11gui-git.tar.gz
tar zxvf incrediblepbx11gui-git.tar.gz
#./create-swapfile-DO  #add this step for Digital Ocean droplets
rm -f incrediblepbx11gui-git.tar.gz
sed -i 's|pbxinaflash.com|incrediblepbx.com|' IncrediblePBX11-GUI-git.sh
./IncrediblePBX11-GUI-git.sh
./IncrediblePBX11-GUI-git.sh

4. Install Incredible Fax for Asterisk-GUI (optional)

Administrators have been trying to stomp out faxing for at least two decades. Here’s a hint. It ain’t gonna happen. So go with the flow and add Gotcha-Free Faxing to your server. It’ll be there when you need it. And sooner or later, you’ll need it. This install script is simple enough for any monkey to complete. Run the script and enter the email address for delivery of your faxes. Then, if you’re in the U.S. or Canada, press the Enter key to accept every default entry during the HylaFax and AvantFax installation steps. For other countries, read the prompts and answer accordingly. When the installation finishes, reboot your server to bring faxing on line. Be sure to change your AvantFax admin password. By default, it is password. You can use the script included in the /root folder: avantfax-pw-change. REMINDER: Don’t forget to reboot your server!

cd /root
./incrediblefax11-GUI.sh
./avantfax-pw-change
reboot

Troubleshooting: If your IAXmodems don’t display with a green IDLE notation in the AvantFax GUI, you may need to restart them once more. After a second reboot, all should be well. The restart command is /root/iaxmodem-restart.

5. Initial Configuration of Incredible PBX for Asterisk-GUI

Incredible PBX is installed with the preconfigured IPtables Linux firewall already in place. It implements WhiteList Security to limit server access to connected LANs, your server’s IP address, your desktop computer’s IP address, and a few of our favorite SIP providers. You can add additional entries to this WhiteList whenever you like using the add-ip and add-fqdn tools in /root. There’s also an Apache security layer for our web applications. And, of course, Asterisk-GUI has its own security methodology using Asterisk’s manager.conf. Finally, we randomize extension and DISA passwords as part of the initial install process. Out of the starting gate, you won’t find a more secure VoIP server implementation anywhere. After all, it’s your phone bill.

Even with all of these layers of security, here are 10 Quick Steps to better safeguard your server. You only do this once, but failing to do it may lead to security issues you don’t want to have to deal with down the road. So DO IT NOW!

First, log into your server as root with your root password and do the following:

Make your root password very secure: passwd
Set your correct time zone: ./timezone-setup
Create admin password for web apps: htpasswd -b /etc/pbx/wwwpasswd admin newpassword
Make a copy of your other passwords: cat passwords.FAQ
Make a copy of your Knock codes: cat knock.FAQ
Decipher IP address and other info about your server: status

Second, log into your server as admin using a web browser pointed to your server’s IP address:

Click USERS tab in Incredible PBX GUI
Click Asterisk-GUI Administration
Log in as user: admin with password: password
Immediately change your admin password and login again

Log in to Asterisk-GUI again with your new password. Expand the options available in the GUI:

Options -> Advanced Options -> Show Advanced Options

Last but not least, Incredible PBX includes an automatic update utility which downloads important updates whenever you log into your server as root. We recommend you log in once a week to keep your server current. Now would be a good time to log out and back into your server at the Linux command line to bring your server up to current specs.

6. Configure Trunks with Incredible PBX for Asterisk-GUI

Now for the fun part. If this is your first VoIP adventure, be advised that this ain’t your grandma’s phone system. You need not and should not put all your eggs in one basket when it comes to telephone providers. In order to connect to Plain Old Telephones, you still need at least one provider. But there is nothing wrong with having several. And a provider that handles an outbound call (termination) need not be the same one that handles an incoming call (origination) and provides your phone number (DID). We cannot recommend Vitelity highly enough, and it’s not just because they have financially supported our projects for almost a decade. They’re as good as VoIP providers get, and we use lots of them. If you’re lucky enough to live in the U.S., you’d be crazy not to set up a Google Voice account. It’s free as are all phone calls to anywhere in the U.S. and Canada. The remaining preconfigured providers included in Incredible PBX for Asterisk-GUI are equally good, and we’ve used and continue to use almost all of them. So pick a few and sign up. You only pay for the calls you make with each provider so you have little to lose by choosing several. The PIAF Forum includes dozens of recommendations on VoIP providers if you want additional information.

With the preconfigured trunks in Incredible PBX for Asterisk-GUI, all you need are your credentials for each provider and the FQDN of their server. Log into Asterisk-GUI Administration as admin using a browser. From the System Status screen, click Incredible PBX Apps. Click on each provider you have chosen and fill in the blanks with your credentials. When you’ve saved all of your settings, log into your server as root via SSH and type: service asterisk restart or asterisk-restart. You can also issue the command in the Asterisk-GUI by choosing the Asterisk CLI tab2 in the left column. Doesn’t get any simpler!

Update: It should be noted that Incredible PBX for Asterisk-GUI also supports Anveo Direct trunks; however, they are configured differently because of the way Anveo handles the calls. You’ll need the PIN provided by Anveo to set up your trunk, and Anveo supports CallerID spoofing so you can enter any CallerID number for the trunk that you are authorized to use. You’ll find the Anveo Direct setup link in the Incredible PBX Apps tab. To route an outgoing call through Anveo trunk, dial 2 + any desired 10-digit number.

Here is the complete list of dialing prefixes and the trunks to which they are associated:

  • 1 – Google Voice
  • 2 – Anveo Direct
  • 3 – Future Nine
  • 4 – CallCentric
  • 5 – DIDlogic
  • 6 – IPcomms
  • 7 – Les.net
  • 8 – Vitelity
  • 9 – VoIP.ms

For free iNUM calling worldwide, the following dialing prefixes are supported in conjunction with the last seven digits of any destination iNUM DID. Free iNUM DIDs for your own PBX are available from both of these providers as well.

  • 0XXXXXXX – CallCentric
  • 90XXXXXXX – VoIP.ms

Finally, in addition to the native Asterisk motif implementation of Google Voice (covered below) which uses insecure authentication with Google Voice, we also support the new Simonics SIP gateway to Google Voice using OAUTH authentication. Just click this link for the installation script and tutorial.

7. Configure a Softphone with Incredible PBX for Asterisk-GUI

We’re in the home stretch now. You can connect virtually any kind of telephone to your new Gotcha-Free PBX. Plain Old Phones require an analog telephone adapter (ATA) which can be a separate board in your computer from a company such as Digium. Or it can be a standalone SIP device such as ObiHai’s OBi100 or OBi110 (if you have a phone line from Ma Bell to hook up as well). SIP phones can be connected directly so long as they have an IP address. These could be hardware devices or software devices such as the YateClient softphone. We’ll start with a free one today so you can begin making calls. You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum when you’re ready to get serious about VoIP telephony.

We recommend YateClient which is free. Download it from here. Run YateClient once you’ve installed it and enter the credentials for the 6002 extension on Incredible PBX. You’ll need the IP address of your server plus your extension 6002 password. Choose Users -> 6002 and write down your SIP/IAX Password. You can also find it in /root/passwords.FAQ. Fill in the blanks using the IP address of your server, 6002 for your account name, and whatever password is assigned to the extension. Click OK to save your entries.

Once you are registered to extension 6002, close the Account window. Then click on YATE’s Telephony Tab and place some test calls to the numerous apps that are preconfigured on Incredible PBX. Dial a few of these to get started:

7001 - IVR Demo
123 - Reminders
947 - Weather by ZIP Code
951 - Yahoo News
*61 - Time of Day
TODAY - Today in History

If you are a Mac user, another great no-frills softphone is Telephone. Just download and install it from the Mac App Store.

Configuring Google Voice

If you want to use Google Voice, you’ll need a dedicated Google Voice account to support Incredible PBX. The more obscure the username (with some embedded numbers), the better off you will be. This will keep folks from bombarding you with unsolicited Gtalk chat messages, and who knows what nefarious scheme will be discovered using Google messaging six months from now. So keep this account a secret!

IMPORTANT: Be sure to enable the Google Chat option as one of your phone destinations in Settings, Voice Setting, Phones. That’s the destination we need for The Incredible PBX to work its magic! Otherwise, all inbound and outbound calls will fail.

If you have difficulty finding the Google Chat option after setting up a new Google Voice account, follow this tutorial.

Once you’ve created your Gmail and Google Voice accounts, go to Google Voice Settings and click on the Calls tab. Make sure your settings match these:

  • Call ScreeningOFF
  • Call PresentationOFF
  • Caller ID (In)Display Caller’s Number
  • Caller ID (Out)Don’t Change Anything
  • Do Not DisturbOFF
  • Call Options (Enable Recording)OFF
  • Global Spam FilteringON

Click Save Changes once you’ve adjusted your settings. Under the Voicemail tab, plug in your email address so you get notified of new voicemails. Down the road, receipt of a Google Voice voicemail will be a big hint that something has come unglued on your PBX.

One final word of caution is in order regardless of your choice of providers: Do NOT use special characters in any provider passwords, or nothing will work!

Now you’re ready to configure your Google Voice account in Incredible PBX. You can do it from within Asterisk-GUI by choosing Google Voice within the Incredible PBX Apps tab. Once you entered your credentials, don’t forget to restart Asterisk, or Google Voice calls will fail. If you still have trouble placing or receiving calls, try these tips.

OK, Smarty Pants: Show Me the Beef!

We know what some of you are thinking. "What does a fast food worker really know about VoIP and Gotcha-Free PBXs?? Before I waste a bunch of time on this, show me the beef!" Fair enough. Sit by your phone and click the Call Me icon below. Type in a fake name and your real phone number. Click the Connect button, answer your phone when it rings, and press 1. You’ll be connected to the Incredible PBX IVR for Asterisk-GUI. Pick an option from the menu of choices and take the Incredible PBX apps for a spin on our dime… actually it’s Google’s dime. Everything you see and hear is part of what you get with Incredible PBX for Asterisk-GUI including the ability to set up your own click-to-dial web interface exactly like this one. The demo just happens to be running on our Mac desktop instead of yours. So… what are you waiting for? Click away and try Incredible PBX for yourself. And, by the way, nobody besides the NSA and Google will be monitoring your call. 😉



Nerd Vittles Demo IVR Options
1 – Call by Name (say “Delta Airlines” or “American Airlines” to try it out)
2 – MeetMe Conference (password is 1234)
3 – Wolfram Alpha (say “What planes are overhead?”)
4 – Lenny (The Telemarketer’s Worst Nightmare)
5 – Today’s News Headlines
6 – Weather Forecast (say the city and state, province, or country)
7 – Today in History
8 – Speak to a Real Person (or maybe just voicemail if we’re out)

Homework Assignment: Mastering the Asterisk-GUI

We’ll have more to say about the Incredible PBX applications next week. In the meantime, you have some homework. You need to learn all about Asterisk-GUI and how to make the best use of its powerful feature set. Here’s one word of warning. We mentioned that Incredible PBX was a hybrid system that combines some customized settings with the standard Asterisk-GUI interface. Before modifying existing settings for the default trunks, extensions, and default routes, take a look at the credentials* files in /etc/asterisk. If you modify any of these trunk entries or the Outgoing or Incoming Call Rules in Asterisk-GUI, you may break the Incredible PBX setup. So steer clear of that minefield until you know what you’re doing. Adding new extensions and additional trunks is perfectly fine and will not break anything.

Rather than reinvent the wheel, we’ll point you to some excellent tutorials that already have been written. Start with Chapter 3 of Digium’s Asterisk Appliance™ Administrator Manual. Next, review Chapter 11 of The Asterisk Book (Second Edition). Finally, take a look at a couple of the tutorials that have been written by other companies that incorporated Asterisk-GUI into their hardware products, e.g. Yeastar’s MyPBX SOHO User Manual and Grandstream’s UCM6100 User Manual. Then check back with us next week for Chapter 2.

In the meantime, if you have questions, join the PBX in a Flash Forums and take advantage of our awesome collection of gurus. There’s an expert available on virtually any topic, and the price is right. As with Incredible PBX, it’s absolutely free.

We also are quickly building a collection of tutorials tailored specifically for Incredible PBX for Asterisk-GUI:

Enjoy your new Gotcha-Free PBX!

Now Available: The Gotcha-Free Incredible PBX Application User’s Guide

Originally published: Monday, April 20, 2015


Support Issues. With any application as sophisticated as this one, you’re bound to have questions. Blog comments are a terrible place to handle support issues although we welcome general comments about our articles and software. If you have particular support issues, we encourage you to get actively involved in the PBX in a Flash Forums. It’s the best Asterisk tech support site in the business, and it’s all free! Please have a look and post your support questions there. Unlike some forums, ours is extremely friendly and is supported by literally hundreds of Asterisk gurus and thousands of users just like you. You won’t have to wait long for an answer to your question.



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

  1. Vitelity and Google provide financial support to Nerd Vittles and the Incredible PBX project. []
  2. If, for some reason, the Asterisk CLI tab does not appear on your server, click Options -> Advanced Options -> Show Advanced Options. []

SOHO Delight: Introducing the Ultimate Asterisk Appliance for Under $30

We continue our journey to identify cost-effective, Gotcha-Free Asterisk® solutions. And, yes, we eat our own dog food! So this week we turn our attention to a real sleeper. It’s an Asterisk appliance with an almost unbelievable price and an even more incredible feature set. With the PBX in a Flash™ and Incredible PBX™ projects, we meet hundreds of thousands of new VoIP enthusiasts each year. But let’s face it. Even software products as simple to use as ours present a formidable challenge to some folks that are new to networking and dealing with complex hardware setups. There’s also the corner grocery store and the mom-and-pop restaurants and the shoe repair store and the tire store and the neighborhood bike shop that shouldn’t have to spend hundreds of dollars each month for basic phone service. And then there are those with a cabin in the mountains or a weekend beach house that just want a plug-and-play communications device that’s available when you need it. So this week’s VoIP solution is dedicated to those on a budget that have no interest in spending months learning the intricacies of VoIP technology. These folks just want basic phone service that works at an affordable price. Bells and whistles are nice but not if they add complexity or cost. And, boy, do we have an incredible find to share with you today. What you’ll need in addition to this Asterisk appliance is electricity and a working Internet connection with a router/firewall. That’s it.

WARNING: We do not recommend EVER connecting the JS-200FX directly to the Internet because of potential security issues with this older version of Asterisk.

We purchased our first JS-200FX Asterisk Appliance from X100P.com for $89.95 with $15 for shipping from the Far East. But others tipped us off that refurbished units (that means they’ve actually been tested and they work) are regularly available for considerably less cost. We’ve added a direct link to the manufacturer for your convenience. Either way, the JS-200FX is a steal. In addition to a router and firewall, the appliance includes two FXS ports to connect plain old telephones, integrated WiFi to connect softphones and SIP devices wirelessly, and best of all turnkey Google Voice support for two lines to make free calls in the United States and Canada. Because the Asterisk-GUI is an integral part of the appliance, setup time is under 5 minutes. And we’ll show you how. As we love to say, if you can handle slice-and-bake cookies, you can do this. So here’s the drill:

  1. Sign up for Google Voice service (do it twice for double the fun!)
  2. Boot and login to JS200-FX after connecting network cable from ETH2 to a computer
  3. Configure Networking and Connect CAT5 from ETH1 to Internet router
  4. Configure Google Voice and Make a Call
  5. Configure Asterisk (optional)
  6. Interconnect Remote Asterisk Server (optional)

1. Getting Started with Google Voice

With the JS200-FX, you can use any SIP provider including our platinum sponsor, Vitelity. See below for a deal you can’t refuse. But, if you live in the United States, you’d be crazy not to also use Google Voice. It’s free! To use Google Voice with the JS200-FX, you’ll need at least one dedicated Google Voice account. Create a Gmail account first. The more obscure the username (with some embedded numbers), the better off you will be. This will keep folks from bombarding you with unsolicited Gtalk chat messages. Then visit http://google.com/voice to set up your Google Voice account and phone number. Yes, you can port an existing number into Google Voice!

IMPORTANT: Do NOT under any circumstances take Google’s bait to switch from Google Chat to Hangouts. Click the X (shown above), or you will forever lose the ability to use Google Chat with your Asterisk appliance. Also be sure to enable the Google Chat option as one of your phone destinations in Settings, Voice Setting, Phones. That’s the destination we need for the Asterisk appliance to work its magic! Otherwise, all inbound and outbound calls will fail. Good News! You’re in luck. Google has apparently had a change of heart on discontinuing Google Chat support so it’s enabled by default in all new Google Voice accounts. Once you’ve created a Gmail and Google Voice account, go to Google Voice Settings and click on the Calls tab. Make sure your settings match these:

  • Call ScreeningOFF
  • Call PresentationOFF
  • Caller ID (In)Display Caller’s Number
  • Caller ID (Out)Don’t Change Anything
  • Do Not DisturbOFF
  • Call Options (Enable Recording)OFF
  • Global Spam FilteringON

Click Save Changes once you’ve adjusted your settings. Under the Voicemail tab, plug in your email address so you get new voicemails delivered… and transcribed.

One final word of caution is in order regardless of your choice of providers: Do NOT use special characters in any provider passwords, or nothing will work! If you have trouble placing or receiving calls, try BOTH of these tips.

If you have difficulty finding the Google Chat option after setting up a new Google Voice account, follow this tutorial.

2. Connecting to JS200-FX Asterisk Appliance

Now you’re ready to begin the adventure. Turn the switch on the back of the JS200-FX to ON. Plug in the included CAT5 cable between ETH2 port on the JS200-FX and a desktop computer or notebook. Power on the device and wait about 2 minutes. From your computer, browse to 192.168.10.1 and login to Asterisk-GUI as user admin with password for your password. You’ll be prompted to change your password. Make it secure!

3. Configuring Networking on JS200-FX Asterisk Appliance

In a nutshell, you’ll be using the ETH1 port on the JS200-FX to connect to your Internet router. We’ll use ETH2 to directly connect to the JS200-FX from a computer when things go haywire. Assuming your router hands out private IP addresses with DHCP, you don’t really need to do much in the way of network configuration on the JS200-FX unless you want to set up a static IP address for the appliance. You’ll find that option under Networking -> WAN -> Connection Type. We typically recommend permanently assigning the IP address that was handed out by your router within the router’s configuration menu. The real trick at this point is deciphering what that IP address will be. You can figure that out by plugging a CAT5 cable between ETH1 and your router now. The address will appear in the WAN entry under Networking -> Status.

Next, we’ll want to configure the Wireless Networking. We recommend setting the device up as an Access Point under Wireless -> Basic Settings. Under the Wireless Security tab, switch to WPA2-PSK security and create an 8-character password to access the device on its WiFi gateway. This gives you a way to connect wirelessly and be assigned an IP address in the range 192.168.10.100-200. If that range duplicates the private LAN subnet of your router, change it to 192.168.0.

Finally, click on Firewall -> Remote Admin and activate remote access to Asterisk-GUI using port 80. Whatever you do, DO NOT MAP ANY PORTS FROM YOUR FIREWALL TO THIS ASTERISK APPLIANCE! It is an older version of Asterisk that probably is not without some security holes. So long as it’s safely ensconced behind a hardware-based firewall, you should have little to worry about especially if you only use Google Voice trunks for outside calling.

4. Configuring Google Voice on JS200-FX Asterisk Appliance

This is a 5-second task. In the Asterisk-GUI, click Google Voice. Plug in your Google Voice email address and password. If you wish to enable a second Google Voice account, click Enable Line #2 and enter your credentials for the second account. Save your settings and reload the dialplan when prompted. Now plug in a Plain Old Telephone to the TEL1 port on the JS200-FX. To dial out using the first Google Voice account, dial 941 + 1 + the 10-digit number. To retrieve your voicemail, dial 41. For the second Google Voice account, use the 942 prefix and 42 for voicemail.

VoIP 101: Learning the Basics of Asterisk-GUI Management

Everything from here on out is optional reading. But, if you plan to get the most out of your new PBX, you’ve got to master the basics of the lingo so you’ll know how to navigate through and manage the Asterisk-GUI. For the sake of simplicity, we’ll divide calls into three categories: local calls, incoming calls, and outgoing calls. The latter two categories are External calls from or to destinations outside your PBX.

Local Calls. These are Internal Calls between users of your PBX. Users typically are assigned a local phone number, an Extension, on which to receive calls. You connect a telephone to an extension in order to answer and make calls. Traditional analog phones are called POTS phones (a.k.a. Plain Old Telephones). They connect to an FXS port (only!) which is identified by the TEL1 or TEL2 jacks on the JS200-FX. SIP and IAX phones or softphones are digital devices that connect to extensions configured as SIP or IAX extensions/users.

Incoming Calls. As the name implies, these are calls coming into your PBX. You typically rent a phone number (DID) from a Provider. The provider assigns you credentials and registers the DID to a Trunk. On your PBX, you Create and Register a Trunk with credentials matching those assigned by the provider. When a call is placed to your DID, the provider passes the call to your PBX through the registered Trunk. The PBX then identifies both the DID and the CallerID of the incoming call and routes it to a Destination based upon the rules you establish in your Incoming Calling Rules (a.k.a. Inbound Routes). A typical destination would be an Extension or User, a Ring Group or collection of extensions, a Conference Room where multiple callers can converse at the same time, or a Voice Menu (a.k.a. IVR or AutoAttendant).

Outgoing Calls. These are calls destined for Termination on a telephone outside your PBX. It could be across the street or on the other side of the world. Some of these calls are free and some are not. Outgoing calls begin from a Phone connected to an Extension or User. Once a number is dialed, a Dial Plan determines whether the caller is authorized to make the call. If so, the call is passed to the Outgoing Calling Rules (a.k.a. Outbound Routes). These rules determine which Trunk will actually process the call. As with incoming trunks, you sign up for Termination service with a provider that may be the same or different from your DID provider. Outgoing call rules may send calls with a certain Dialing Prefix to a specified Trunk to take advantage of free calling or reduced cost. These calling rules may strip off dialing prefixes and/or add additional digits to the dialed number before it is passed to the Provider for termination on a remote phone.

5. Configuring Asterisk on JS200-FX Asterisk Appliance

Now that you’ve mastered the basics, there’s so much more you can do. In fact, we could write a book about it. Lucky for us (and for you), others have already done that. To get the most out of this terrific appliance, you’ll need to learn more about Asterisk and the Asterisk-GUI. Fortunately, there’s no shortage of tutorials. Start with the JS200-FX Quick Start Guide (PDF). Then take a careful look at Chapter 3 of Digium’s Asterisk Appliance™ Administrator Manual. Next, review Chapter 11 of The Asterisk Book (Second Edition). Finally, review these tutorials that have been written by other companies that incorporated Asterisk-GUI into their hardware products, e.g. Yeastar’s MyPBX SOHO User Manual and Grandstream’s UCM6100 User Manual.

6. Interconnecting JS200-FX Asterisk Appliance to Remote Asterisk Server

Interconnecting the new Asterisk appliance to a remote Asterisk server to share outbound trunks or to allow free calls to local extensions on the remote server is easy. First, create an IAX trunk on the remote Asterisk server using a very secure password. This setup will give callers on the Asterisk appliance access to the entire dialplan on the remote Asterisk server so be careful. Also make sure the Trunk Name and username are the same.

On the Asterisk appliance, there are 3 steps: create an IAX trunk to make the connection to the remote server, add an outbound route with a dialing prefix to route calls out the new trunk, and enable the new Trunk in your DefaultLocalContext dialplan.

Trunk setup: Trunks -> New IAX Trunk

You’ll need the IP address or FQDN of your remote server. In addition, the username and password must match what you set up (above) on the remote server.

Outbound Route setup: Outgoing Call Rules -> New Calling Rule

In our example, we’re requiring an 8 prefix followed by a 10-digit number to send a call to the remote server for outbound call processing. If you wanted to force a different dialing prefix at the remote server end in order to send calls out through a specific trunk, that prefix should be Prepended in the highlighted field of the outbound route. This setup would not permit calls to local extensions on the remote PBX. To do that, you’d probably want to create an additional outbound route with a Dial Pattern such as _8XXXX! if the extensions on the remote server were all four digits. Don’t forget to also enable that second outbound route in the dialplan setup below!

Dialplan setup: Dial Plans -> Edit DefaultLocalContexts

Just click on the Out_RentPBX checkbox and Save your update. Then reload the Asterisk dialplan, and you’re all set.

Making Free SIP URI Calls Worldwide

One of the hidden beauties of Asterisk is the ability to place SIP URI calls to anyone in the world and talk for free… for as long as you wish. SIP URIs look much like an email address with a name or number, followed by @, followed by an FQDN or IP address, e.g. 2233435945@sip2sip.info. While the SIP URI setup on the JS200-FX Asterisk Appliance is not exactly straightforward, it’s pretty easy once you know some of Asterisk-GUI’s magic tricks. The simplest method is to Create a New Voice Menu which will work like a Speed Dial for the new SIP URI. For example, here’s the setup to add Lenny to your appliance. Name the new voice menu Lenny and assign a number to the new voice menu (53669 spells L-E-N-N-Y). Now add two Actions by clicking Add New Step twice with the entries shown below. Save your Voice Menu. Then Reload the dialplan. Now dial 53669 to speak to Lenny. Or route telemarketers to this extension as part of your dial plan.

Answer
Macro trunkdial-failover-0.3,sip/2233435945@sip2sip.info,,,

If you’re comfortable using an editor, there’s an easier way using the same methodology included in Incredible PBX for Asterisk-GUI. We’ll actually add a new [CallingRule_SIP_URI] context in which to save SIP URI speed dials. Then we’ll add that new context to the default dialplan: [DLPN_DefaultLocalContexts]. In the future, you can easily add additional SIP URI speed dials to this context. Just give each one a unique extension number and plug in the SIP URI using the syntax shown below.

In the Asterisk-GUI, click Options -> Advanced Options -> Show Advanced Options. Then click on the new File Editor tab. In the Config Files pulldown, choose extensions.conf. Click Add Context button and name it: CallingRule_SIP_URI. The new context will be added to the bottom of the file so go there and click on + to edit its contents. Add the following line and click Save:

exten = 53669,1,Dial(SIP/2233435945@sip2sip.info)

Now we need to add the new context to the default dialplan so search through the contexts until you find [DLPN_DefaultLocalContexts]. Click on the + to edit the context. Then add the following line to the end of the existing list and click Save:

include=CallingRule_SIP_URI

Now click Apply Settings button to save your settings to NVRAM and reload the dialplan. That wasn’t so hard, was it?

There’s another advantage to the second approach. Your Call Detail Records now will actually show the speed dial numbers that are called:

Setting Up Incoming SIP URIs for Your PBX

This is only recommended for those that are highly skilled in Asterisk and those that can afford an expensive phone bill. It requires that UDP port 5060 be exposed to the Internet through your firewall. You need to be extremely careful in setting up SIP URIs to avoid unintended consequences such as allowing strangers to place outbound calls through your PBX on your nickel. The steps are straight-forward. First, configure an FQDN for your server and, if your provider uses dynamic IP addresses, set up dynamic DNS refreshes using the facility included in Networking -> Dynamic DNS. Second, use the File Editor to edit the [general] context in sip.conf. Insert your FQDN into the fromdomain and domain variables. Next, insert the following line: allowexternaldomains=no. Then Save the file. Third, edit the [default-public] context in extensions.conf. Insert your desired SIP URIs in this context using the proper syntax. For example, to route a SIP URI for mothership@FQDN.yourdomain.com to extension 6001, the dialplan code would look like this: exten=mothership,1,Goto(default,6001,1). To route the same SIP URI to your first Voice Menu, the code would look like this: exten=mothership,1,Goto(voicemenu-custom-1,s,1). To route the same SIP URI to your first Ring Group, use: exten=mothership,1,Goto(ringroups-custom-1,s,1). To route the incoming SIP URI to an outgoing SIP URI, use: exten=mothership,1,Dial(SIP/somewhere@someFQDN.somedomain.com).

There’s a silver lining to activating an inbound SIP URI. Once it’s properly configured, you can sign up for a free phone number in the Seattle area and map that DID to the SIP URI of your server. All of the incoming calls are free! This gives you some redundancy in the event of a Google Voice outage. Just visit www.ipkall.com to sign up for your free number.

Hardening the JS200-FX Firewall

Particularly if you elect to support incoming SIP URIs, you’ll want to tighten up the SPI Firewall included in the JS200-FX. While we have no simple way to decipher the existing rules, you can add rules of your own to lessen the opportunity for mischief. This is especially important in the SIP arena. Just to be sure you don’t lock yourself out of your own server, we recommend a 4-step process: (1) allowing full access from private LAN subnets, (2) whitelisting the FQDNs and IP addresses from which you will access the JS200-FX, (3) whitelisting the providers that you intend to use as well as the IP addresses of external phone devices, and (4) locking down incoming SIP URI access to a single FQDN for your server. The fourth step keeps random strangers from attempting to gain SIP access by scanning blocks of IP addresses in search of vulnerable servers. It’s a good idea to use an obscure FQDN for your appliance which minimizes the ability of strangers to guess the acceptable SIP URIs, e.g. somefunkyFQDN.somedomain.net would block all incoming SIP URI attempts by either IP address or by guessing any other FQDN. In other words, the FQDN works just like a password. Thus, if you set up a mothership SIP URI (make up your own!), the only incoming SIP URI calls that would be allowed would be those calling mothership@somefunkyFQDN.somedomain.net. Don’t publish the actual SIP URI anywhere!

Also be advised that, if you use FQDNs in the step #2 white list and the dynamic IP address of these FQDNs changes, you will need to manually restart the JS200-FX to enable the new IP address. Currently, there is no ability to check for FQDN changes and automatically restart the appliance.

To create the new firewall rules, choose Firewall -> Custom Rules -> Enable ON. Then enter and SAVE & APPLY the following rules using your actual settings rather than the sample entries below. CAUTION: This data should be entered by accessing the JS200-FX via WiFi at the 192.168.10.1 address, or you may lock yourself out during the update process.

#1 private subnets and loopback - no changes needed in this section
-A INPUT -s 192.168.0.0/16 -j ACCEPT
-A INPUT -s 10.0.0.0/8 -j ACCEPT
-A INPUT -s 172.16.0.0/12 -j ACCEPT
-A INPUT -s 127.0.0.0/8 -j ACCEPT

#2 enter your own IP addresses for WhiteList access below
-A INPUT -s homeFQDN.dyndns.org -j ACCEPT
-A INPUT -s alternateFQDN.dyndns.org -j ACCEPT
-A INPUT -s 129.43.13.220 -j ACCEPT

#3 providers and interconnected servers and phone devices
## atlanta.voip.ms sample entry
-A INPUT -s 174.34.146.162/32 -p udp -m multiport --dports 5060,5061,5062,5063,5064,5065,5066,5067,5068,5069,5080,4569 -j ACCEPT

#4 SIP URI access - enter JS200-FX FQDN in next line and leave the rest
-A INPUT -p udp --dport 5060 -m string --string "REGISTER sip:somefunkyFQDN.somedomain.net" --algo bm -j ACCEPT
-A INPUT -p udp --dport 5060 -m string --string "REGISTER sip:" --algo bm -j DROP
-A INPUT -p udp --dport 5060 -m string --string "OPTIONS sip:" --algo bm -j DROP
-A INPUT -p udp --dport 5060 -j ACCEPT

Implementing 7-Digit Dialing with Your Favorite Area Code

Once you have at least one Google Voice account set up, here’s another trick to implement 7-digit dialing with your favorite area code. Just add an additional line to the [CallingRule_SIP_URI] context substituting your area code for 843:

exten=_NXXXXXX!,1,Macro(trunkdial-failover-0.3,${GoogleVoice_1}/1843${EXTEN},,GoogleVoice_1,)

OK, Smarty Pants: Show Me the Beef!

We know what some of you are thinking. "Do you really know as much about VoIP as Lenny does?? Before wasting 30 bucks on this, show me the beef!" Fair enough. Sit by your phone and click the Call Me icon below. Type in a fake name and your real phone number. Click the Connect button. Answer your phone when it rings. Then press 1. You’ll be connected to the Conferencing System running on the JS200-FX Asterisk Appliance. You can chat with other Nerd Vittles users that have joined before you. So… what are you waiting for? Click away and try the JS200-FX Appliance for yourself.



You can implement this Click-to-Dial technology using your own JS200-FX Asterisk Appliance in about 10 seconds. Once you have configured Google Voice as outlined in Step #1 above, click on the Call Widgets tab under Settings. Click Add a New Call Widget, give it a name, turn off ringing your home or office phone, turn off Call Presentation, and Save Changes. Now simply cut-and-paste the Embed code that’s provided and insert it into a public web page of your choice. Doesn’t get much easier than that, and all your family and friends can call you for free from the convenience of any available telephone in the U.S. or Canada by simply clicking on the Call Me widget on your web site’s home page.

Originally published: Monday, March 16, 2015


Support Issues. With any application as sophisticated as this one, you’re bound to have questions. Blog comments are a terrible place to handle support issues although we welcome general comments about our articles and software. If you have particular support issues, we encourage you to get actively involved in the PBX in a Flash Forums. It’s the best Asterisk tech support site in the business, and it’s all free! Please have a look and post your support questions there. Unlike some forums, ours is extremely friendly and is supported by literally hundreds of Asterisk gurus and thousands of users just like you. You won’t have to wait long for an answer to your question.



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

The Gotcha-Free PBX in the Cloud: Introducing Incredible PBX @ RentPBX.com

We continue the Incredible PBX for Asterisk-GUI adventure today with an open source alternative for which many have been clamoring, an affordable Cloud-based Asterisk® platform with a no-strings-attached graphical user interface. As if the $15 a month hosting plan weren’t enough, the icing on the cake is the quick 2-minute setup on your choice of a dozen servers throughout the U.S. as well as Canada and Europe. If you can find the Enter key on a keyboard, then you can handle the complexity of the RentPBX setup. When you’re finished, you’ll have a turnkey PBX featuring some of the finest open source software on the planet. The software is all free, subject only to the terms of the open source licenses.

Target Audience: Home or SOHO/SBO in need of a turnkey, Gotcha-Free PBX in the Cloud

Default Configuration: Asterisk 11 with enhanced Asterisk-GUI, Kennonsoft GUI, and NANPA dialplan

Platform: CentOS 6.6 running on RentPBX Cloud-Based Server platform

Memory: 385 MB with 415 MB swap

Disk Size: 20 GB

Default Trunks: Google Voice, CallCentric, DIDlogic, Future-Nine, IPcomms, Les.net, Vitelity, VoIP.ms1

Feature Set: Fax, SMS messaging, VPN, Reminders, ConfBridge Conferencing, AsteriDex, Voicemail, IVR, Email, News, Weather, Voice Dialer, Wolfram Alpha, Today in History, TM3 Firewall WhiteList, Speed Dialer, iNUM and SIP URI (free) worldwide calling, OpenCNAM CallerID lookups, DISA, Call Forwarding, CSV CDRs

Administrator Utilities: Incredible Backup/Restore, Automatic Updater, Asterisk Upgrader, phpMyAdmin, Timezone Config, Plug-and-Play Trunk Configurator, WebMin, External IP Setup, Firewall WhiteList Tools

Getting Started with Incredible PBX for Asterisk-GUI (Cloud Edition)

Here’s a quick overview of the installation and setup process for Incredible PBX for Asterisk-GUI @ RentPBX.com:

  1. Sign Up for Gotcha-Free PBX in the Cloud – Choose server location and await credentials
  2. Complete the Install of Incredible PBX and Incredible Fax
  3. Set Up Passwords for Incredible PBX for Asterisk-GUI
  4. Configure Trunks with Incredible PBX for Asterisk-GUI
  5. Connect a Softphone to Incredible PBX for Asterisk-GUI

1. Sign Up for Gotcha-Free PBX in the Cloud at RentPBX.com

Visit RentPBX.com and choose the PBX in a Flash builds and complete the following steps:

When you begin the payment and checkout phase, enter your coupon code to take advantage of the $15/month discounted rate: NOGOTCHAS. Wait for the confirmation email with your server credentials and dedicated IP address.

2. Complete the Install of Incredible PBX and Incredible Fax

Nothing tricky here. It’s a 2-minute setup process. Log into your server as root with your default password using SSH or Putty. Once you’re logged in, RentPBX will randomize all of your passwords for Incredible PBX. Next, you’ll be prompted for the email address to use for delivery of your faxes. Once entered, you’ll be prompted for various information to install HylaFax and AvantFax. Just press the Enter key at every prompt. In a couple minutes, your server will reboot to bring Incredible PBX and Incredible Fax on line. Log back into your server as root and let Incredible PBX run its Automatic Update Utility to bring your system current. That’s it. You now have a turnkey Asterisk® PBX that’s ready for configuration.

3. Initial Configuration of Incredible PBX for Asterisk-GUI

Incredible PBX is installed with the preconfigured IPtables Linux firewall already in place. It implements WhiteList Security to limit server access to your server’s IP address, your desktop computer’s IP address, and a few of our favorite SIP providers. You can add additional entries to this WhiteList whenever you like using the add-ip and add-fqdn tools in /root. There’s also an Apache security layer for web applications. And, of course, Asterisk-GUI has its own security methodology using Asterisk’s manager.conf. Finally, RentPBX randomized extension and DISA passwords as part of the initial setup process. Out of the starting gate, you won’t find a more secure VoIP server implementation anywhere. After all, it’s your phone bill.

Even with all of these layers of security, here are 10 Quick Steps to better safeguard your server. You only do this once, but failing to do it may lead to security issues you don’t want to have to deal with down the road. So DO IT NOW!

First, log into your server as root with your root password and do the following:

Make your root password very secure: passwd
Set your correct time zone: ./timezone-setup
Create admin password for web apps: htpasswd -b /etc/pbx/wwwpasswd admin newpassword
Make a copy of your other passwords: cat passwords.FAQ
Make a copy of your Knock codes: cat knock.FAQ
Decipher IP address and other info about your server: status

Second, log into your server as admin using a web browser pointed to your server’s IP address:

Click USERS tab in Incredible PBX GUI
Click Asterisk-GUI Administration
Log in as user: admin with password: password
Immediately change your admin password

Log in to Asterisk-GUI again with your new password. Expand the options available in the GUI (if required):

Options -> Advanced Options -> Show Advanced Options

Last but not least, Incredible PBX includes an automatic update utility which downloads important updates whenever you log into your server as root. We recommend you log in once a week to keep your server current.

4. Configure Trunks with Incredible PBX for Asterisk-GUI

Now for the fun part. If this is your first VoIP adventure, be advised that this ain’t your grandma’s phone system. You need not and should not put all your eggs in one basket when it comes to telephone providers. In order to connect to Plain Old Telephones, you still need at least one provider. But there is nothing wrong with having several. And a provider that handles an outbound call (termination) need not be the same one that handles an incoming call (origination) and provides your phone number (DID). We cannot recommend Vitelity highly enough, and it’s not just because they have financially supported our projects for almost a decade. They’re as good as VoIP providers get, and we use lots of them. If you’re lucky enough to live in the U.S., you’d be crazy not to set up a Google Voice account. It’s free as are all phone calls to anywhere in the U.S. and Canada. The remaining preconfigured providers included in Incredible PBX for Asterisk-GUI are equally good, and we’ve used and continue to use almost all of them. So pick a few and sign up. You only pay for the calls you make with each provider so you have little to lose by choosing several. The PIAF Forum includes dozens of recommendations on VoIP providers if you want additional information.

With the preconfigured trunks in Incredible PBX for Asterisk-GUI, all you need are your credentials for each provider and the FQDN of their server. Log into Asterisk-GUI Administration as admin using a browser. From the System Status screen, click Incredible PBX Apps. Click on each provider you have chosen and fill in the blanks with your credentials. When you’ve saved all of your settings, log into your server as root via SSH and type: service asterisk restart or asterisk-restart. You can also issue the command in the Asterisk-GUI by choosing the Asterisk CLI tab2 in the left column. Doesn’t get any simpler!

Update: It should be noted that Incredible PBX for Asterisk-GUI also supports Anveo Direct trunks; however, they are configured differently because of the way Anveo handles the calls. You’ll need the PIN provided by Anveo to set up your trunk, and Anveo supports CallerID spoofing so you can enter any CallerID number for the trunk that you are authorized to use. You’ll find the Anveo Direct setup link in the Incredible PBX Apps tab. To route an outgoing call through Anveo trunk, dial 2 + any desired 10-digit number.

Here is the complete list of dialing prefixes and the trunks to which they are associated:

  • 1 – Google Voice
  • 2 – Anveo Direct
  • 3 – Future Nine
  • 4 – CallCentric
  • 5 – DIDlogic
  • 6 – IPcomms
  • 7 – Les.net
  • 8 – Vitelity
  • 9 – VoIP.ms

For free iNUM calling worldwide, the following dialing prefixes are supported in conjunction with the last seven digits of any destination iNUM DID. Free iNUM DIDs for your own PBX are available from both of these providers as well.

  • 0XXXXXXX – CallCentric
  • 90XXXXXXX – VoIP.ms

5. Configure a Softphone with Incredible PBX for Asterisk-GUI

We’re in the home stretch now. You can connect virtually any kind of telephone to your new Gotcha-Free PBX. Plain Old Phones require an analog telephone adapter (ATA). Because your server is actually in the RentPBX Cloud, a standalone SIP device is required. Good choices are ObiHai’s OBi100 or OBi110 (if you have a phone line from Ma Bell to hook up as well). SIP phones can be connected directly so long as they have an IP address. These could be hardware devices or software devices such as the YateClient softphone. We’ll start with a free one today so you can begin making calls. You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum when you’re ready to get serious about VoIP telephony. Don’t forget to WhiteList the IP address of each SIP phone you wish to connect using /root/add-ip or /root/add-fqdn.

We recommend the YateClient softphone which is free. Download it from here. Run YateClient once you’ve installed it and enter the credentials for the 6002 extension on Incredible PBX. You’ll need the IP address of your server plus your extension 6002 password. Choose Users -> 6002 and write down your SIP/IAX Password. You can also find it in /root/passwords.FAQ. Fill in the blanks using the IP address of your server, 6002 for your account name, and whatever password is assigned to the extension. Click OK to save your entries.

Once you are registered to extension 6002, close the Account window. Then click on YATE’s Telephony Tab and place some test calls to the numerous apps that are preconfigured on Incredible PBX. Dial a few of these to get started:

7001 - IVR Demo
123 - Reminders
947 - Weather by ZIP Code
951 - Yahoo News
*61 - Time of Day
TODAY - Today in History

If you are a Mac user, another great no-frills softphone is Telephone. Just download and install it from the Mac App Store.

Configuring Google Voice

If you want to use Google Voice, you’ll need a dedicated Google Voice account to support Incredible PBX. The more obscure the username (with some embedded numbers), the better off you will be. This will keep folks from bombarding you with unsolicited Gtalk chat messages, and who knows what nefarious scheme will be discovered using Google messaging six months from now. So keep this account a secret!

IMPORTANT: Do NOT under any circumstances take Google’s bait to switch from Google Chat to Hangouts, or you will forever lose the ability to use Google Chat with Incredible PBX. Also be sure to enable the Google Chat option as one of your phone destinations in Settings, Voice Setting, Phones. That’s the destination we need for The Incredible PBX to work its magic! Otherwise, all inbound and outbound calls will fail. Thus far, Google has apparently had a change of heart on discontinuing Google Chat support so it’s enabled by default in all new Google Voice accounts. Nothing free lasts forever so make some alternative arrangements before disaster strikes!

Once you’ve created a Gmail and Google Voice account, go to Google Voice Settings and click on the Calls tab. Make sure your settings match these:

  • Call ScreeningOFF
  • Call PresentationOFF
  • Caller ID (In)Display Caller’s Number
  • Caller ID (Out)Don’t Change Anything
  • Do Not DisturbOFF
  • Call Options (Enable Recording)OFF
  • Global Spam FilteringON

Click Save Changes once you’ve adjusted your settings. Under the Voicemail tab, plug in your email address so you get notified of new voicemails. Down the road, receipt of a Google Voice voicemail will be a big hint that something has come unglued on your PBX.

One final word of caution is in order regardless of your choice of providers: Do NOT use special characters in any provider passwords, or nothing will work!

Now you’re ready to configure your Google Voice account in Incredible PBX. You can do it from within Asterisk-GUI by choosing Google Voice within the Incredible PBX Apps tab. Once you’ve entered your credentials, don’t forget to restart Asterisk, or Google Voice calls will fail. If you still have trouble placing or receiving calls, follow these tips.

OK, Smarty Pants: Show Me the Beef!

We know what some of you are thinking. "What does a fast food worker really know about VoIP and Gotcha-Free PBXs?? Before I waste a bunch of time on this, show me the beef!" Fair enough. Sit by your phone and click the Call Me icon below. Type in a fake name and your real phone number. Click the Connect button, answer your phone when it rings, and press 1. You’ll be connected to the Incredible PBX IVR for Asterisk-GUI. Pick an option from the menu of choices and take the Incredible PBX apps for a spin on our dime… actually it’s Google’s dime. Everything you see and hear is part of what you get with Incredible PBX for Asterisk-GUI including the ability to set up your own click-to-dial web interface exactly like this one. The demo just happens to be running on our Mac desktop. So… what are you waiting for? Click away and try Incredible PBX for yourself. And, by the way, nobody besides the NSA and Google will be monitoring your call. 😉



Nerd Vittles Demo IVR Options3
1 – Call by Name (say “Delta Airlines” or “American Airlines” to try it out)
2 – MeetMe Conference (password is 1234)
3 – Wolfram Alpha (say “What planes are overhead?”)
4 – Lenny (The Telemarketer’s Worst Nightmare)
5 – Today’s News Headlines
6 – Weather Forecast (say the city and state, province, or country)
7 – Today in History
8 – Speak to a Real Person (or maybe just voicemail if we’re out)

Homework Assignment: Mastering the Incredible Apps and Asterisk-GUI

Just Released: The Gotcha-Free Incredible PBX Application User’s Guide

Your next stop should be a careful reading of the new Incredible PBX Application User’s Guide. It documents the 31 apps for Asterisk that are included with your new PBX. You also need to learn all you can about Asterisk-GUI and how to make the best use of its powerful feature set. Here’s one word of warning. We mentioned that Incredible PBX was a hybrid system that combines some customized settings with the standard Asterisk-GUI interface. Before modifying existing settings for the default trunks, extensions, and default routes, take a look at the credentials* files in /etc/asterisk. If you modify any of these trunk entries or the Outgoing or Incoming Call Rules in Asterisk-GUI, you may break the Incredible PBX setup. So steer clear of that minefield until you know what you’re doing. Adding new extensions and additional trunks is perfectly fine and will not break anything.

Rather than reinvent the wheel, we’ll point you to some excellent tutorials that already have been written. Start with Chapter 3 of Digium’s Asterisk Appliance™ Administrator Manual. Next, review Chapter 11 of The Asterisk Book (Second Edition). Finally, take a look at a couple of the tutorials that have been written by other companies that incorporated Asterisk-GUI into their hardware products, e.g. Yeastar’s MyPBX SOHO User Manual and Grandstream’s UCM6100 User Manual.

In the meantime, if you have questions, join the PBX in a Flash Forums and take advantage of our awesome collection of gurus. There’s an expert available on virtually any topic, and the price is right. As with Incredible PBX, it’s absolutely free.

We also are quickly building a collection of tutorials tailored specifically for Incredible PBX for Asterisk-GUI:

Enjoy your new Gotcha-Free PBX in the Cloud!


Don’t forget to List Yourself in Directory Assistance so everyone can find you by dialing 411. Add your new number to the Do Not Call Registry to block telemarketing calls. Or call 888-382-1222 from your new number.

Originally published: Monday, February 23, 2015


Support Issues. With any application as sophisticated as this one, you’re bound to have questions. Blog comments are a terrible place to handle support issues although we welcome general comments about our articles and software. If you have particular support issues, we encourage you to get actively involved in the PBX in a Flash Forums. It’s the best Asterisk tech support site in the business, and it’s all free! Please have a look and post your support questions there. Unlike some forums, ours is extremely friendly and is supported by literally hundreds of Asterisk gurus and thousands of users just like you. You won’t have to wait long for an answer to your question.



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

  1. Vitelity, Google, and RentPBX provide financial support to Nerd Vittles and the Incredible PBX project. []
  2. If, for some reason, the Asterisk CLI tab does not appear on your server, click Options -> Advanced Options -> Show Advanced Options. []
  3. Allison is available to record custom voice prompts with the same quality as this one. []

The Gotcha-Free PBX: Raspberry Pi 2, Meet Incredible PBX for Asterisk-GUI ❤


[iframe-popup id="3″]
NOTICE: This version is no longer supported because Digium® has discontinued support of Asterisk-GUI. Check out our latest fully-supported offerings featuring pure open source GPL code: Incredible PBX GUI for Asterisk 11 and Incredible PBX GUI for Asterisk 13.

OK. The Raspberry Pi 2 may not quite rival the Raspberry Pi supercomputer built at Boise State, but it’s getting closer. The supercomputer that included 32 Raspberry Pi’s a year ago can now be built with about 5 Raspberry Pi 2’s. While the footprint may look the same as the $35 Raspberry Pi that you knew and loved two years ago, the RasPi² sports a 900MHz ARMv7 quad core processor with a full gig of RAM under the hood. And even though the Raspberry Pi 2 may be camera-shy, there’s a good reason. It’s a screamer! Early testing indicates a six-fold increase in performance even though it still looks much the same. What hasn’t changed is the price. It’s still $35 in the U.S. if you can find one. We couldn’t wait so we headed to the Pimoroni Shop in the U.K. to order ours with a Pibow case. Shipped within hours, and we got it in 2 days!

Do we have a Valentine’s Treat for you! Today we’re pleased to introduce the all-new Raspberry Pi edition of Incredible PBX for Asterisk-GUI featuring the just-released Raspberry Pi 2 and the just-released Asterisk® 11.16. And, not to worry, if you ever get tired of running your own PBX (and we don’t think you will), Micro$oft announced last week that you’re going to get a free version of Windows 10 for the Raspberry Pi 2 later this year.

Last week we released a tutorial covering all of the new Gotcha Free PBX applications, and that guide applies to today’s Raspberry Pi 2 release as well. That’s the beauty of the new Incredible PBX modular design. And, speaking of design, we don’t build Incredible PBX servers with an included operating system any longer so we’ll walk you through getting the Raspberry Pi 2 squared away with the latest and greatest version of Raspbian before we actually install Incredible PBX.

Target Audience: Home or SOHO/SBO in need of a turnkey, Gotcha-Free PBX

Default Configuration: Asterisk 11 with enhanced Asterisk-GUI, Kennonsoft GUI, and NANPA dialplan

Platform: Raspbian 7 running on a Raspberry Pi 2

Standard Memory: 1024MB

Recommended Disk: 16GB+

Default Trunks: Google Voice, CallCentric, DIDlogic, Future-Nine, IPcomms, Les.net, Vitelity, VoIP.ms1

Feature Set: SMS messaging, VPN, Reminders, ConfBridge Conferencing, AsteriDex, Voicemail, Email, IVR, News, Weather, Voice Dialer, Wolfram Alpha, Today in History, TM3 Firewall WhiteList, Speed Dialer, iNUM and SIP URI (free) worldwide calling, OpenCNAM CallerID lookups, DISA, Call Forwarding, CSV CDRs

Administrator Utilities: Incredible Backup/Restore, Automatic Updater, Asterisk Upgrader, phpMyAdmin, Timezone Config, Plug-and-Play Trunk Configurator, WebMin, External IP Setup, Firewall WhiteList Tools

Getting Started with Incredible PBX for Asterisk-GUI (RasPi 2 Edition)

Here’s a quick overview of the installation and setup process for Incredible PBX for Asterisk-GUI:

  1. Install Linux for Raspberry Pi 2 – Install Raspbian 7 Platform
  2. Configure Raspbian 7 – Optimize Raspbian 7 for Incredible PBX
  3. Download and Install Incredible PBX for Asterisk-GUI
  4. Install Incredible Fax for Asterisk-GUI (optional)
  5. Set Up Passwords for Incredible PBX for Asterisk-GUI
  6. Configure Trunks with Incredible PBX for Asterisk-GUI
  7. Connect a Softphone to Incredible PBX for Asterisk-GUI

1. Install Raspbian 7 Platform for Raspberry Pi 2

For those with Raspberry Pi experience, this is the same drill you’ve performed a dozen times before. For newbies, here’s the procedure. You’ll need a microSD card of at least 8GB, and we strongly recommend a 16GB or 32GB Type 10 card for Incredible PBX. We’ve tested both the SanDisk and Transcend cards, and they work great.

Begin by downloading the very latest RASPBIAN image from RaspberryPi.org to your desktop. After you’ve unzipped the image, you need to get it moved to your microSD card. RaspberryPi.org has excellent tutorials that will walk you through the process using a Linux, Mac, or Windows desktop platform. Don’t forget to unmount the card before removing it!

Once you have your microSD card ready to go, plug it into the slot on the back of the Raspberry Pi 2 and then plug in the power cord. On your attached monitor, you can follow the boot up process. When the login prompt appears, log in as user pi with the password raspberry.

2. Optimizing Raspbian 7 for Incredible PBX for Asterisk-GUI

The first time you boot up your Raspberry Pi 2 with Raspbian 7, it will run the raspi-config script. This allows you to make a number of changes to your Raspberry Pi environment to maximize performance. Let’s take advantage of it.

Option 1. Expand the File System to fill your SD card. Otherwise, there’s insufficient disk space to complete the install.

Option 3. Enable Boot to Desktop (top selection). No Linux GUI please!

Option 8. Change your Hostname under A2 to incrediblepi2.

Tab to the Finish option and press ENTER. Then choose Reboot and YES.

After the reboot, log back in as pi:raspberry and set a very secure root password: sudo passwd root. Decipher your IP address so that you can log in as root via SSH: ifconfig.

We recommend completing the install by logging in as root using a desktop computer via SSH or Putty (for Windows). This gives you the ability to scroll back up and find errors if something happens to come unglued during the install process.

3. Install Incredible PBX on Your Raspberry Pi 2

Adding Incredible PBX to the Raspberry Pi 2 is easy. To restate the obvious, your server needs a reliable Internet connection to proceed. Using SSH (or Putty on a Windows machine), log into your Raspberry Pi 2 as root at the IP address you deciphered in the ifconfig step at the end of the Raspbian install procedure above.

IMPORTANT: Before you begin the Incredible PBX install, expand your console window to at least 80×27, or the Asterisk compilation step may fail. If you’re in doubt about the window dimensions, just maximize the window to full-screen during the install process.

Now let’s begin the Incredible PBX install. After logging in as root, issue the following commands. The install takes less than an hour and runs unattended so there’s no need to watch unless you’re curious how sausage is made. Remember, we compile all of the major components for Incredible PBX as part of the build process. And you can review the open source GPL2 script to see how it’s done if you have an interest or wish to embellish. It’s Gotcha-Free code so go for it and share your discoveries. After all, that’s what open source is all about!

cd /root
wget http://incrediblepbx.com/incrediblepbx11guiPi.tar.gz
tar zxvf incrediblepbx11guiPi.tar.gz
rm -f incrediblepbx11guiPi.tar.gz
./IncrediblePBX11Pi-GUI.sh

4. Install Incredible Fax for Asterisk-GUI (optional)

Administrators have been trying to stomp out faxing for at least two decades. Here’s a hint. It ain’t gonna happen. So go with the flow and add Gotcha-Free Faxing to your server. It’ll be there when you need it. And sooner or later, you’ll need it. This install script is simple enough for any monkey to complete. Run the script and enter the email address for delivery of your faxes. Then, if you’re in the U.S. or Canada, press the Enter key to accept every default entry during the HylaFax and AvantFax installation steps. For other countries, read the prompts and answer accordingly. When the installation finishes, reboot your server to bring faxing on line. Be sure to change your AvantFax admin password by logging in to AvantFax from the Incredible PBX GUI. By default, the admin password is password. You can also use the script included in the /root folder: avantfax-pw-change. REMINDER: Don’t forget to reboot your server!

cd /root
./incrediblefax11-GUI.sh

Outgoing faxes using standard document attachments can be created using the AvantFax GUI. The faxes will be sent out using your default outbound dial rules. For example, a 10-digit number will be sent using the default Google Voice trunk unless you haven’t configured it. Then the next configured trunk will be used. You can add a dial prefix in sending a fax with AvantFax to force the call out a particular trunk.

Incoming faxes will be delivered to the email address you specified when installing Incredible Fax; however, incoming faxes will be ignored until you configure a destination DID to accept the faxes. In the /etc/asterisk directory, edit extensions.conf. As noted, a dedicated DID is required to support incoming faxes! Find the desired incoming fax context which will be of the form: DID_TRUNKNAME_default, e.g. DID_GoogleVoice_default. Toward the end of the context, there will be several destination options for incoming calls to this DID. It looks like this:

;exten = _.,n,Gosub(macro-dumpvars,s,1())  ; in case you ever want to look at all of the Asterisk variables on the CLI
;exten = _.,n,Goto(default,6001,1)         ; routes incoming call to extension 6001
;exten = _.,n,Goto(ringroups-custom-1,s,1) ; routes incoming call to Ring Group #1
;exten = _.,n,Goto(voicemenu-custom-2,s,1) ; routes incoming call to Nerd Vittles Demo IVR
 exten = _.,n,Goto(voicemenu-custom-1,s,1)  ; routes incoming call to Stealth AutoAttendant and then to Ring Group #1

Comment out the destination entry that is not already commented out. Then add the following line just below that entry:

exten = _.,n,Goto(ext-fax,in_fax,1)

Now save the file and reload your Asterisk dialplan: asterisk-reload.

5. Initial Configuration of Incredible PBX for Asterisk-GUI

Incredible PBX is installed with the preconfigured IPtables Linux firewall already in place. It implements WhiteList Security to limit server access to connected LANs, your server’s IP address, your desktop computer’s IP address, and a few of our favorite SIP providers. You can add additional entries to this WhiteList whenever you like using the add-ip and add-fqdn tools in /root. There’s also an Apache security layer for our web applications. And, of course, Asterisk-GUI has its own security methodology using Asterisk’s manager.conf. Finally, we randomize extension and DISA passwords as part of the initial install process. Out of the starting gate, you won’t find a more secure VoIP server implementation anywhere. After all, it’s your phone bill.

Even with all of these layers of security, here are 10 Quick Steps to better safeguard your server. You only do this once, but failing to do it may lead to security issues you don’t want to have to deal with down the road. So DO IT NOW!

First, log into your server as root with your root password and do the following:

Make your root password very secure: passwd
Set your correct time zone: ./timezone-setup
Restart Asterisk: asterisk-restart
Create admin password for web apps: htpasswd -b /etc/pbx/wwwpasswd admin newpassword
Make a copy of your other passwords: cat passwords.FAQ
Make a copy of your Knock codes: cat knock.FAQ
Decipher IP address and other info about your server: status

Second, log into your server as admin using a web browser pointed to your server’s IP address:

Click USERS tab in Incredible PBX GUI
Click Asterisk-GUI Administration
Log in as user: admin with password: password
Immediately change your admin password and login again

Log in to Asterisk-GUI again with your new password. Expand the options available in the GUI:

Options -> Advanced Options -> Show Advanced Options

Last but not least, Incredible PBX includes an automatic update utility which downloads important updates whenever you log into your server as root. We recommend you log in once a week to keep your server current. Now would be a good time to log out and back into your server at the Linux command line to bring your Raspberry Pi 2 up to current specs.

6. Configure Trunks with Incredible PBX for Asterisk-GUI

Now for the fun part. If this is your first VoIP adventure, be advised that this ain’t your grandma’s phone system. You need not and should not put all your eggs in one basket when it comes to telephone providers. In order to connect to Plain Old Telephones, you still need at least one provider. But there is nothing wrong with having several. And a provider that handles an outbound call (termination) need not be the same one that handles an incoming call (origination) and provides your phone number (DID). We cannot recommend Vitelity highly enough, and it’s not just because they have financially supported our projects for almost a decade. They’re as good as VoIP providers get, and we use lots of them. If you’re lucky enough to live in the U.S., you’d be crazy not to set up a Google Voice account. It’s free as are all phone calls to anywhere in the U.S. and Canada. The remaining preconfigured providers included in Incredible PBX for Asterisk-GUI are equally good, and we’ve used and continue to use almost all of them. So pick a few and sign up. You only pay for the calls you make with each provider so you have little to lose by choosing several. The PIAF Forum includes dozens of recommendations on VoIP providers if you want additional information.

With the preconfigured trunks in Incredible PBX for Asterisk-GUI, all you need are your credentials for each provider and the FQDN of their server. Log into Asterisk-GUI Administration as admin using a browser. From the System Status screen, click Incredible PBX Apps. Click on each provider you have chosen and fill in the blanks with your credentials. When you’ve saved all of your settings, log into your server as root via SSH and type: service asterisk restart or asterisk-restart. You can also issue the command in the Asterisk-GUI by choosing the Asterisk CLI tab2 in the left column. Doesn’t get any simpler!

Update: It should be noted that Incredible PBX for Asterisk-GUI also supports Anveo Direct trunks; however, they are configured differently because of the way Anveo handles the calls. You’ll need the PIN provided by Anveo to set up your trunk, and Anveo supports CallerID spoofing so you can enter any CallerID number for the trunk that you are authorized to use. You’ll find the Anveo Direct setup link in the Incredible PBX Apps tab. To route an outgoing call through Anveo trunk, dial 2 + any desired 10-digit number.

Here is the complete list of dialing prefixes and the trunks to which they are associated:

  • 1 – Google Voice
  • 2 – Anveo Direct
  • 3 – Future Nine
  • 4 – CallCentric
  • 5 – DIDlogic
  • 6 – IPcomms
  • 7 – Les.net
  • 8 – Vitelity
  • 9 – VoIP.ms

For free iNUM calling worldwide, the following dialing prefixes are supported in conjunction with the last seven digits of any destination iNUM DID. Free iNUM DIDs for your own PBX are available from both of these providers as well.

  • 0XXXXXXX – CallCentric
  • 90XXXXXXX – VoIP.ms

7. Configure a Softphone with Incredible PBX for Asterisk-GUI

We’re in the home stretch now. You can connect virtually any kind of telephone to your new Gotcha-Free PBX. Plain Old Phones require an analog telephone adapter (ATA) which can be a separate board in your computer from a company such as Digium. Or it can be a standalone SIP device such as ObiHai’s OBi100 or OBi110 (if you have a phone line from Ma Bell to hook up as well). SIP phones can be connected directly so long as they have an IP address. These could be hardware devices or software devices such as the YateClient softphone. We’ll start with a free one today so you can begin making calls. You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum when you’re ready to get serious about VoIP telephony.

We recommend YateClient which is free. Download it from here. Run YateClient once you’ve installed it and enter the credentials for the 6002 extension on Incredible PBX. You’ll need the IP address of your server plus your extension 6002 password. Choose Users -> 6002 and write down your SIP/IAX Password. You can also find it in /root/passwords.FAQ. Fill in the blanks using the IP address of your server, 6002 for your account name, and whatever password is assigned to the extension. Click OK to save your entries.

Once you are registered to extension 6002, close the Account window. Then click on YATE’s Telephony Tab and place some test calls to the numerous apps that are preconfigured on Incredible PBX. Dial a few of these to get started:

7001 - IVR Demo
123 - Reminders
947 - Weather by ZIP Code
951 - Yahoo News
*61 - Time of Day
TODAY - Today in History

If you are a Mac user, another great no-frills softphone is Telephone. Just download and install it from the Mac App Store.

Configuring Google Voice

If you want to use Google Voice, you’ll need a dedicated Google Voice account to support Incredible PBX. The more obscure the username (with some embedded numbers), the better off you will be. This will keep folks from bombarding you with unsolicited Gtalk chat messages, and who knows what nefarious scheme will be discovered using Google messaging six months from now. So keep this account a secret!

IMPORTANT: Do NOT under any circumstances take Google’s bait to switch from Google Chat to Hangouts, or you will forever lose the ability to use Google Chat with Incredible PBX. Also be sure to enable the Google Chat option as one of your phone destinations in Settings, Voice Setting, Phones. That’s the destination we need for The Incredible PBX to work its magic! Otherwise, all inbound and outbound calls will fail. Good News! You’re in luck. Google has apparently had a change of heart on discontinuing Google Chat support so it’s enabled by default in all new Google Voice accounts. Once you’ve created a Gmail and Google Voice account, go to Google Voice Settings and click on the Calls tab. Make sure your settings match these:

  • Call ScreeningOFF
  • Call PresentationOFF
  • Caller ID (In)Display Caller’s Number
  • Caller ID (Out)Don’t Change Anything
  • Do Not DisturbOFF
  • Call Options (Enable Recording)OFF
  • Global Spam FilteringON

Click Save Changes once you’ve adjusted your settings. Under the Voicemail tab, plug in your email address so you get notified of new voicemails. Down the road, receipt of a Google Voice voicemail will be a big hint that something has come unglued on your PBX.

One final word of caution is in order regardless of your choice of providers: Do NOT use special characters in any provider passwords, or nothing will work!

Now you’re ready to configure your Google Voice account in Incredible PBX. You can do it from within Asterisk-GUI by choosing Google Voice within the Incredible PBX Apps tab. Once you’ve entered your credentials, don’t forget to restart Asterisk, or Google Voice calls will fail. If you still have trouble placing or receiving calls, try BOTH of these tips.

If you have difficulty finding the Google Chat option after setting up a new Google Voice account, follow this tutorial.

NOTE: There are all sorts of rumors circulating again that the Google Voice free ride may be coming to a close. We’ve heard this song before, but who knows?? Whether true or not, you are well advised to not rely solely on Google Voice for your phone calls. That’s the real beauty of a PBX. So take advantage of it!

OK, Smarty Pants: Show Me the Beef!

We know what some of you are thinking. "What does a fast food worker really know about VoIP and Gotcha-Free PBXs?? Before wasting a bunch of time on this, show me the beef!" Fair enough. Sit by your phone and click the Call Me icon below. Type in a fake name and your real phone number. Click the Connect button, answer your phone when it rings, and press 1. You’ll be connected to the Incredible PBX IVR for Asterisk-GUI. Pick an option from the menu of choices and take the Incredible PBX apps for a spin on our dime… actually it’s Google’s dime. Everything you see and hear is part of what you get with Incredible PBX for Asterisk-GUI including the ability to set up your own click-to-dial web interface exactly like this one. The demo just happens to be running on our Raspberry Pi 2 instead of yours. So… what are you waiting for? Click away and try Incredible PBX for yourself. And, by the way, nobody besides the NSA and Google will be monitoring your call. 😉



Nerd Vittles Demo IVR Options
1 – Call by Name (say “Delta Airlines” or “American Airlines” to try it out)
2 – MeetMe Conference (password is 1234)
3 – Wolfram Alpha (say “What planes are overhead?”)
4 – Lenny (The Telemarketer’s Worst Nightmare)
5 – Today’s News Headlines
6 – Weather Forecast (say the city and state, province, or country)
7 – Today in History
8 – Speak to a Real Person (or maybe just voicemail if we’re out)

Homework Assignment: Mastering the Asterisk-GUI

Now would be a good time to explore the Incredible PBX applications. Continue reading there. After you’ve played with the preconfigured features, it’s time to roll up your sleeves and learn about Asterisk-GUI and its powerful feature set. Here’s one word of warning. We mentioned that Incredible PBX was a hybrid system that combines some customized settings with the standard Asterisk-GUI interface. Before modifying existing settings for the default trunks, extensions, and default routes, take a look at the credentials* files in /etc/asterisk. If you modify any of these trunk entries or the Outgoing or Incoming Call Rules in Asterisk-GUI, you may break the Incredible PBX setup. So steer clear of that minefield until you know what you’re doing. Adding new extensions and additional trunks is perfectly fine and will not break anything.

Rather than reinvent the wheel, we’ll point you to some excellent tutorials that already exist. Start with Chapter 3 of Digium’s Asterisk Appliance™ Administrator Manual. Next, review Chapter 11 of The Asterisk Book (Second Edition). Finally, take a look at a couple of the tutorials that have been written by other companies that incorporated Asterisk-GUI into their hardware products, e.g. Yeastar’s MyPBX SOHO User Manual and Grandstream’s UCM6100 User Manual.

In the meantime, if you have questions, join the PBX in a Flash Forums and take advantage of our awesome collection of gurus. There’s an expert available on virtually any topic, and the price is right. As with Incredible PBX, it’s absolutely free.

We also are quickly building a collection of tutorials tailored specifically for Incredible PBX for Asterisk-GUI:

Just Released: The Gotcha-Free Incredible PBX Application User’s Guide

Originally published: Monday, February 9, 2015


Support Issues. With any application as sophisticated as this one, you’re bound to have questions. Blog comments are a terrible place to handle support issues although we welcome general comments about our articles and software. If you have particular support issues, we encourage you to get actively involved in the PBX in a Flash Forums. It’s the best Asterisk tech support site in the business, and it’s all free! Please have a look and post your support questions there. Unlike some forums, ours is extremely friendly and is supported by literally hundreds of Asterisk gurus and thousands of users just like you. You won’t have to wait long for an answer to your question.



Need help with Asterisk? Visit the PBX in a Flash Forum.

Some Recent Nerd Vittles Articles of Interest…

  1. Vitelity and Google provide financial support to Nerd Vittles and the Incredible PBX project. []
  2. If, for some reason, the Asterisk CLI tab does not appear on your server, click Options -> Advanced Options -> Show Advanced Options. []

The Gotcha-Free PBX: Introducing Incredible PBX for Asterisk-GUI (Ubuntu)

WARNING: This version is no longer secure and use of it is strongly discouraged.

Remember the old adage that Rome wasn’t built in a day? Well, thanks to Mark Spencer and his team of incredibly talented programmers coupled with the modular design of Asterisk® and Asterisk-GUI, times have changed. It took about a month to put the CentOS version of Incredible PBX™ for Asterisk-GUI together. Today’s Ubuntu® version was created in one day! That should tell you all you need to know about the design. Better yet, with a cloud platform such as Digital Ocean,1 you can deploy Incredible PBX for Asterisk-GUI in about 15 minutes. Add another 5 minutes to configure some trunks and plug in a couple phones, and you’ll have a Gotcha-Free PBX in less time than it takes to wolf down a Waffle House breakfast.

We try to make new product tutorials stand on their own so you don’t have to jump around to figure everything out. But, if you’re generally familiar with the process of installing Incredible PBX, then this will be a walk in the park for you. Last week we released a tutorial covering all of the new Gotcha Free PBX applications, and that guide applies to today’s Ubuntu release as well. The names of a few components are different (such as the Incredible Fax installer), but functionally everything works in exactly the same way as the CentOS platform release. After all, that’s the beauty of the modular design.

Target Audience: Home or SOHO/SBO in need of a turnkey, Gotcha-Free PBX

Default Configuration: Asterisk 11 with enhanced Asterisk-GUI, Kennonsoft GUI, and NANPA dialplan

Platform: Ubuntu 14.04 (32/64-bit) running on Dedicated Server, Cloud-Based Server, or Virtual Machine

Minimum Memory: 512MB

Recommended Disk: 20GB+

Default Trunks: Google Voice, CallCentric, DIDlogic, Future-Nine, IPcomms, Les.net, Vitelity, VoIP.ms2

Feature Set: Fax, SMS messaging, VPN, Reminders, ConfBridge Conferencing, AsteriDex, Voicemail, Email, IVR, News, Weather, Voice Dialer, Wolfram Alpha, Today in History, TM3 Firewall WhiteList, Speed Dialer, iNUM and SIP URI (free) worldwide calling, OpenCNAM CallerID lookups, DISA, Call Forwarding, CSV CDRs

Administrator Utilities: Incredible Backup/Restore, Automatic Updater, Asterisk Upgrader, phpMyAdmin, Timezone Config, Plug-and-Play Trunk Configurator, WebMin, External IP Setup, Firewall WhiteList Tools

Getting Started with Incredible PBX for Asterisk-GUI (Ubuntu Edition)

Here’s a quick overview of the installation and setup process for Incredible PBX for Asterisk-GUI:

  1. Choose a Hardware Platform – Dedicated PC, Virtual Machine, or Cloud Provider
  2. Install a Linux Flavor – Install Ubuntu 14.04 Platform for Incredible PBX
  3. Download and Install Incredible PBX for Asterisk-GUI
  4. Install Incredible Fax for Asterisk-GUI (optional)
  5. Set Up Passwords for Incredible PBX for Asterisk-GUI
  6. Configure Trunks with Incredible PBX for Asterisk-GUI
  7. Connect a Softphone to Incredible PBX for Asterisk-GUI

1. Choose a Platform for Incredible PBX for Asterisk-GUI

Incredible PBX for Asterisk-GUI works equally well on dedicated hardware, a virtual machine, or a cloud-based server. Just be sure you’ve met the minimum requirements outlined above and that you have a sufficiently robust Internet connection to support 100Kb of download and upload bandwidth for each simultaneous call you wish to handle with your new PBX.

For Dedicated Hardware, we recommend an Atom-based PC of recent vintage with at least a 30GB drive and 4GB of RAM. That will take care of an office with 10-20 extensions and a half dozen or more simultaneous calls if you have the Internet bandwidth to support it.

For Virtual Machine Installs, we recommend Oracle’s VirtualBox platform which runs atop almost any operating system including Windows, Macs, Linux, and Solaris. Here’s a link to our original VirtualBox tutorial to get you started. We suggest allocating 1GB of RAM and at least a 20GB disk image to your virtual machine for best performance.

For Cloud-Based Servers, we recommend RentPBX, one of our financial supporters who also happens to size servers properly and restrict usage solely to VoIP. This avoids performance bottlenecks that cause problems with VoIP calls. If you’re just experimenting, then a 512MB Digital Ocean droplet is a cost-effective option at a cost of less than a penny an hour. In addition to a little referral revenue for Nerd Vittles, the nicest features of Digital Ocean are the availability of preconfigured CentOS images and a platform on which you can install Incredible PBX and be ready to start making calls very, very quickly. If you make a serious mistake during the install or setup, it’s a 30-second task to delete your droplet and create a new one. You’re only out a penny! And reloading Incredible PBX from scratch is never more than a 20-minute task. Remember to run the create-swapfile-DO script included in the Incredible PBX tarball before beginning your install to avoid out-of-memory conditions.

2. Install Ubuntu 14.04 Platform for Incredible PBX

For dedicated hardware installs, download the 32-bit or 64-bit Ubuntu 14.04 “Trusty Tahr” Minimal ISO. Burn it to a CD/DVD or thumb drive and boot your dedicated server from the image. Remember, you’ll be reformatting the drive in your server so pick a machine you don’t need for other purposes.

For virtual machine installs, download the same ISO and specify it as the boot drive for your virtual machine. If you’re using the VirtualBox platform, create a new virtual machine specifying either the 32-bit or 64-bit version of Ubuntu. Allocate 1024MB of RAM (512MB also works fine!) and at least 20GB of disk space using the default hard drive setup in all three steps. In Settings, click System and check Enable I/O APIC and uncheck Hardware Clock in UTC Time. Click Audio and Specify then Enable your sound card. Click Network and Enable Network Adapter for Adapter 1 and choose Bridged Adapter. Finally, in Storage, add the Ubuntu 14.04 mini.iso to your VirtualBox Storage Tree as shown below. Then click OK and start up your new virtual machine.

Here are the steps to get Ubuntu 14.04 set up on dedicated hardware or a virtual machine:
UBUNTU mini.iso install:
Choose language
Choose timezone
Detect keyboard
Hostname: incrediblepbx < continue >
Choose mirror for downloads
Confirm archive mirror
Leave proxy blank unless you need it < continue >
** couple minutes of whirring as initial components are loaded **
New user name: incredible < continue >
Account username: incredible < continue >
Account password: makeitsecure < continue >
Encrypt home directory < no >
Confirm time zone < yes >
Partition disks: Guided - use entire disk and set up LVM
Confirm disk to partition
Write changes to disks and configure LVM
Whole volume? < continue>
Write changes to disks < yes> < -- last chance to preserve your disk drive! ** about 15 minutes of whirring during base system install ** < no touchy anything>
** another 5 minutes of whirring during base software install ** < no touchy anything>
Upgrades? Install security updates automatically
** another 5 minutes of whirring during more software installs ** < no touchy anything>
Software selection: *Basic Ubuntu server (only!)
** another couple minutes of whirring during software installs ** < no touchy anything>
Grub boot loader: < yes>
UTC for system clock: < no>
Installation complete: < continue> after removing installation media
** on VirtualBox, PowerOff after reboot and remove [-] mini.iso from Storage Tree & restart VM
login as user: incredible
** enter user incredible's password **
sudo passwd
** enter incredible password again and then create secure root user password **
su root
** enter root password **
apt-get update
apt-get install ssh -y
sed -i 's|without-password|yes|' /etc/ssh/sshd_config
sed -i 's|yes"|without-password"|' /etc/ssh/sshd_config
sed -i 's|"quiet"|"quiet text"|' /etc/default/grub
update-grub
ifconfig
** write down the IP address of your server from ifconfig results
reboot
** login via SSH to continue **

For Cloud-based servers or virtual machines, typically the provider has done the hard work for you. Just choose either a 32-bit or 64-bit Ubuntu 14.04 platform with at least 512MB of RAM and 20GB of disk storage. If you have to roll your own from an ISO, just follow the steps above.

3. Install Incredible PBX on Your Ubuntu 14.04 Server

Adding Incredible PBX to a running Ubuntu 14.04 server is simple. To restate the obvious, your server needs a reliable Internet connection to proceed. Using SSH (or Putty on a Windows machine), log into your new server as root at the IP address you deciphered in the ifconfig step at the end of the Ubuntu install procedure above.

First, run the update and upgrade procedure for Ubuntu before you begin the install. This is especially important if using a cloud-based Ubuntu 14 server.

apt-get update && apt-get upgrade -y && reboot

WARNING: If you’re using a 512MB droplet at Digital Ocean, be advised that their Ubuntu setup does NOT include a swap file. This may cause serious problems when you run out of RAM. Uncomment ./create-swapfile-DO line below to create a 1GB swap file which will be activated whenever you exceed 90% RAM usage on Digital Ocean.

IMPORTANT: Before you begin the Incredible PBX install, expand your console window to at least 80×27, or the Asterisk compilation step may fail. If you’re in doubt about the window dimensions, just maximize the window to full-screen during the install process.

Now let’s begin the Incredible PBX install. Log back in as root and issue the following commands:

cd /root
wget http://incrediblepbx.com/incrediblepbx11guiU.tar.gz
tar zxvf incrediblepbx11guiU.tar.gz
#./create-swapfile-DO  #add this step for Digital Ocean droplets
rm -f incrediblepbx11guiU.tar.gz
sed -i 's|pbxinaflash.com|incrediblepbx.com|' IncrediblePBX11U-GUI.sh
./IncrediblePBX11U-GUI.sh

4. Install Incredible Fax for Asterisk-GUI (optional)

Administrators have been trying to stomp out faxing for at least two decades. Here’s a hint. It ain’t gonna happen. So go with the flow and add Gotcha-Free Faxing to your server. It’ll be there when you need it. And sooner or later, you’ll need it. This install script is simple enough for any monkey to complete. Run the script and enter the email address for delivery of your faxes. Then, if you’re in the U.S. or Canada, press the Enter key to accept every default entry during the HylaFax and AvantFax installation steps. For other countries, read the prompts and answer accordingly. When the installation finishes, reboot your server to bring faxing on line. Be sure to change your AvantFax admin password. By default, it is password. You can use the script included in the /root folder: avantfax-pw-change. REMINDER: Don’t forget to reboot your server!

cd /root
./incrediblefax11_ubuntu14.sh
./avantfax-pw-change
reboot

5. Initial Configuration of Incredible PBX for Asterisk-GUI

Incredible PBX is installed with the preconfigured IPtables Linux firewall already in place. It implements WhiteList Security to limit server access to connected LANs, your server’s IP address, your desktop computer’s IP address, and a few of our favorite SIP providers. You can add additional entries to this WhiteList whenever you like using the add-ip and add-fqdn tools in /root. There’s also an Apache security layer for our web applications. And, of course, Asterisk-GUI has its own security methodology using Asterisk’s manager.conf. Finally, we randomize extension and DISA passwords as part of the initial install process. Out of the starting gate, you won’t find a more secure VoIP server implementation anywhere. After all, it’s your phone bill.

Even with all of these layers of security, here are 10 Quick Steps to better safeguard your server. You only do this once, but failing to do it may lead to security issues you don’t want to have to deal with down the road. So DO IT NOW!

First, log into your server as root with your root password and do the following:

Make your root password very secure: passwd
Set your correct time zone: ./timezone-setup
Create admin password for web apps: htpasswd -b /etc/pbx/wwwpasswd admin newpassword
Make a copy of your other passwords: cat passwords.FAQ
Make a copy of your Knock codes: cat knock.FAQ
Decipher IP address and other info about your server: status

Second, log into your server as admin using a web browser pointed to your server’s IP address:

Click USERS tab in Incredible PBX GUI
Click Asterisk-GUI Administration
Log in as user: admin with password: password
Immediately change your admin password and login again

Log in to Asterisk-GUI again with your new password. Expand the options available in the GUI:

Options -> Advanced Options -> Show Advanced Options

Last but not least, Incredible PBX includes an automatic update utility which downloads important updates whenever you log into your server as root. We recommend you log in once a week to keep your server current. Now would be a good time to log out and back into your server at the Linux command line to bring your server up to current specs.

6. Configure Trunks with Incredible PBX for Asterisk-GUI

Now for the fun part. If this is your first VoIP adventure, be advised that this ain’t your grandma’s phone system. You need not and should not put all your eggs in one basket when it comes to telephone providers. In order to connect to Plain Old Telephones, you still need at least one provider. But there is nothing wrong with having several. And a provider that handles an outbound call (termination) need not be the same one that handles an incoming call (origination) and provides your phone number (DID). We cannot recommend Vitelity highly enough, and it’s not just because they have financially supported our projects for almost a decade. They’re as good as VoIP providers get, and we use lots of them. If you’re lucky enough to live in the U.S., you’d be crazy not to set up a Google Voice account. It’s free as are all phone calls to anywhere in the U.S. and Canada. The remaining preconfigured providers included in Incredible PBX for Asterisk-GUI are equally good, and we’ve used and continue to use almost all of them. So pick a few and sign up. You only pay for the calls you make with each provider so you have little to lose by choosing several. The PIAF Forum includes dozens of recommendations on VoIP providers if you want additional information.

With the preconfigured trunks in Incredible PBX for Asterisk-GUI, all you need are your credentials for each provider and the FQDN of their server. Log into Asterisk-GUI Administration as admin using a browser. From the System Status screen, click Incredible PBX Apps. Click on each provider you have chosen and fill in the blanks with your credentials. When you’ve saved all of your settings, log into your server as root via SSH and type: service asterisk restart or asterisk-restart. You can also issue the command in the Asterisk-GUI by choosing the Asterisk CLI tab3 in the left column. Doesn’t get any simpler!

Update: It should be noted that Incredible PBX for Asterisk-GUI also supports Anveo Direct trunks; however, they are configured differently because of the way Anveo handles the calls. You’ll need the PIN provided by Anveo to set up your trunk, and Anveo supports CallerID spoofing so you can enter any CallerID number for the trunk that you are authorized to use. You’ll find the Anveo Direct setup link in the Incredible PBX Apps tab. To route an outgoing call through Anveo trunk, dial 2 + any desired 10-digit number.

Here is the complete list of dialing prefixes and the trunks to which they are associated:

  • 1 – Google Voice
  • 2 – Anveo Direct
  • 3 – Future Nine
  • 4 – CallCentric
  • 5 – DIDlogic
  • 6 – IPcomms
  • 7 – Les.net
  • 8 – Vitelity
  • 9 – VoIP.ms

For free iNUM calling worldwide, the following dialing prefixes are supported in conjunction with the last seven digits of any destination iNUM DID. Free iNUM DIDs for your own PBX are available from both of these providers as well.

  • 0XXXXXXX – CallCentric
  • 90XXXXXXX – VoIP.ms

7. Configure a Softphone with Incredible PBX for Asterisk-GUI

We’re in the home stretch now. You can connect virtually any kind of telephone to your new Gotcha-Free PBX. Plain Old Phones require an analog telephone adapter (ATA) which can be a separate board in your computer from a company such as Digium. Or it can be a standalone SIP device such as ObiHai’s OBi100 or OBi110 (if you have a phone line from Ma Bell to hook up as well). SIP phones can be connected directly so long as they have an IP address. These could be hardware devices or software devices such as the YateClient softphone. We’ll start with a free one today so you can begin making calls. You can find dozens of recommendations for hardware-based SIP phones both on Nerd Vittles and the PIAF Forum when you’re ready to get serious about VoIP telephony.

We recommend YateClient which is free. Download it from here. Run YateClient once you’ve installed it and enter the credentials for the 6002 extension on Incredible PBX. You’ll need the IP address of your server plus your extension 6002 password. Choose Users -> 6002 and write down your SIP/IAX Password. You can also find it in /root/passwords.FAQ. Fill in the blanks using the IP address of your server, 6002 for your account name, and whatever password is assigned to the extension. Click OK to save your entries.

Once you are registered to extension 6002, close the Account window. Then click on YATE’s Telephony Tab and place some test calls to the numerous apps that are preconfigured on Incredible PBX. Dial a few of these to get started:

7001 - IVR Demo
123 - Reminders
947 - Weather by ZIP Code
951 - Yahoo News
*61 - Time of Day
TODAY - Today in History

If you are a Mac user, another great no-frills softphone is Telephone. Just download and install it from the Mac App Store.

Configuring Google Voice

If you want to use Google Voice, you’ll need a dedicated Google Voice account to support Incredible PBX. The more obscure the username (with some embedded numbers), the better off you will be. This will keep folks from bombarding you with unsolicited Gtalk chat messages, and who knows what nefarious scheme will be discovered using Google messaging six months from now. So keep this account a secret!

IMPORTANT: Be sure to enable the Google Chat option as one of your phone destinations in Settings, Voice Setting, Phones. That’s the destination we need for The Incredible PBX to work its magic! Otherwise, all inbound and outbound calls will fail. Good News! You’re in luck. Google has apparently had a change of heart on discontinuing Google Chat support so it’s enabled by default in all new Google Voice accounts. Once you’ve created a Gmail and Google Voice account, go to Google Voice Settings and click on the Calls tab. Make sure your settings match these:

  • Call ScreeningOFF
  • Call PresentationOFF
  • Caller ID (In)Display Caller’s Number
  • Caller ID (Out)Don’t Change Anything
  • Do Not DisturbOFF
  • Call Options (Enable Recording)OFF
  • Global Spam FilteringON

Click Save Changes once you’ve adjusted your settings. Under the Voicemail tab, plug in your email address so you get notified of new voicemails. Down the road, receipt of a Google Voice voicemail will be a big hint that something has come unglued on your PBX.

One final word of caution is in order regardless of your choice of providers: Do NOT use special characters in any provider passwords, or nothing will work!

Now you’re ready to configure your Google Voice account in Incredible PBX. You can do it from within Asterisk-GUI by choosing Google Voice within the Incredible PBX Apps tab. Once you entered your credentials, don’t forget to restart Asterisk, or Google Voice calls will fail. If you still have trouble placing or receiving calls, try these tips.

OK, Smarty Pants: Show Me the Beef!

We know what some of you are thinking. "What does a fast food worker really know about VoIP and Gotcha-Free PBXs?? Before I waste a bunch of time on this, show me the beef!" Fair enough. Sit by your phone and click the Call Me icon below. Type in a fake name and your real phone number. Click the Connect button, answer your phone when it rings, and press 1. You’ll be connected to the Incredible PBX IVR for Asterisk-GUI. Pick an option from the menu of choices and take the Incredible PBX apps for a spin on our dime… actually it’s Google’s dime. Everything you see and hear is part of what you get with Incredible PBX for Asterisk-GUI including the ability to set up your own click-to-dial web interface exactly like this one. The demo just happens to be running on our Mac desktop instead of yours. So… what are you waiting for? Click away and try Incredible PBX for yourself. And, by the way, nobody besides the NSA and Google will be monitoring your call. 😉



Nerd Vittles Demo IVR Options
1 – Call by Name (say “Delta Airlines” or “American Airlines” to try it out)
2 – MeetMe Conference (password is 1234)
3 – Wolfram Alpha (say “What planes are overhead?”)
4 – Lenny (The Telemarketer’s Worst Nightmare)
5 – Today’s News Headlines
6 – Weather Forecast (say the city and state, province, or country)
7 – Today in History
8 – Speak to a Real Person (or maybe just voicemail if we’re out)

Homework Assignment: Mastering the Asterisk-GUI

Now would be a good time to explore the Incredible PBX applications. Continue reading there. After you’ve played with the preconfigured features, it’s time to roll up your sleeves and learn about Asterisk-GUI and its powerful feature set. Here’s one word of warning. We mentioned that Incredible PBX was a hybrid system that combines some customized settings with the standard Asterisk-GUI interface. Before modifying existing settings for the default trunks, extensions, and default routes, take a look at the credentials* files in /etc/asterisk. If you modify any of these trunk entries or the Outgoing or Incoming Call Rules in Asterisk-GUI, you may break the Incredible PBX setup. So steer clear of that minefield until you know what you’re doing. Adding new extensions and additional trunks is perfectly fine and will not break anything.

Rather than reinvent the wheel, we’ll point you to some excellent tutorials that already exist. Start with Chapter 3 of Digium’s Asterisk Appliance™ Administrator Manual. Next, review Chapter 11 of The Asterisk Book (Second Edition). Finally, take a look at a couple of the tutorials that have been written by other companies that incorporated Asterisk-GUI into their hardware products, e.g. Yeastar’s MyPBX SOHO User Manual and Grandstream’s UCM6100 User Manual.

In the meantime, if you have questions, join the PBX in a Flash Forums and take advantage of our awesome collection of gurus. There’s an expert available on virtually any topic, and the price is right. As with Incredible PBX, it’s absolutely free.

We also are quickly building a collection of tutorials tailored specifically for Incredible PBX for Asterisk-GUI:

Enjoy your new Gotcha-Free PBX!

Just Released: The Gotcha-Free Incredible PBX Application User’s Guide

Originally published: Thursday, February 5, 2015


Support Issues. With any application as sophisticated as this one, you’re bound to have questions. Blog comments are a terrible place to handle support issues although we welcome general comments about our articles and software. If you have particular support issues, we encourage you to get actively involved in the PBX in a Flash Forums. It’s the best Asterisk tech support site in the business, and it’s all free! Please have a look and post your support questions there. Unlike some forums, ours is extremely friendly and is supported by literally hundreds of Asterisk gurus and thousands of users just like you. You won’t have to wait long for an answer to your question.



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

  1. Nerd Vittles relies upon modest referral fees from some providers such as Digital Ocean to keep the lights on. But you get a free ride, too! Create an Ubuntu 14.04 (not 14.10!) 512MB droplet of the cheapest flavor ($5/mo.). A $10 credit will be added to your account when you sign up, and you can play with Incredible PBX on Digital Ocean’s nickel for a couple months risk-free. Add and delete droplets to your heart’s content and enjoy! []
  2. Vitelity and Google provide financial support to Nerd Vittles and the Incredible PBX project. []
  3. If, for some reason, the Asterisk CLI tab does not appear on your server, click Options -> Advanced Options -> Show Advanced Options. []