TUTORIAL Gotcha-Free PBX: Outbound Call Routing


Nerd Uno
Oct 12, 2007
Reaction score
Nothing is quite as important on your PBX as Outbound Call Routing because these are the calls that can potentially cost you money. We want to document the Incredible PBX for Asterisk-GUI way of doing things so there are no gotchas. Three categories of users are especially important to consider: anonymous users that should not be able to access your PBX in order to make an outbound call on your nickel, registered users that should not be authorized to make certain types of outbound calls, and legitimate users that should have a simple way to make authorized calls.

Managing Anonymous Users and Callers

By default, incoming calls and connections from anonymous users are blocked, period. This is done with a couple layers of protection.

The IPtables Firewall WhiteList blocks anonymous connections to your server from everybody except IP addresses that have been whitelisted using /root/add-ip and /root/add-fqdn and certain "preferred providers." For this to work, your IPtables Firewall obviously needs to be functioning properly. You can check it in a couple of ways: status and iptables -nL. Always start, restart, and reload your firewall settings using the command: iptables-restart. Using IPtables built-in functions may cause problems if you rely upon fully-qualified domain names (FQDNs) and one of them happens to be out of service. In this case, IPtables will fail to start unless you use the iptables-restart command which automatically excludes failed FQDNs in restarting IPtables.

Callers can also connect to your PBX by dialing a phone number (DID) that is registered to your PBX. All calls from anonymous callers are automatically blocked by this default Blacklist entry in the Asterisk database: /blacklist/blocked 1. To allow anonymous calls, change the setting from asterisk-cli: database put blacklist blocked 0.

Restricting Outbound Calls by Registered Users

In creating or modifying Asterisk-GUI users (aka extensions), there is a DialPlan option that controls the types of calls that can be made from the specified extension. Incredible PBX comes preconfigured with two dial plans: DialPlanMain and DialPlanLocal. As the names suggest, DialPlanMain allows all call types from an extension while DialPlanLocal only allows local calls to other extensions.

CAUTION: Be extremely careful in setting insecure=yes for an extension. This setting will allow anyone, registered or not, to make anonymous SIP calls through the PBX from the IP address registered to that extension. For additional details, see this message thread and billsimon's excellent summary of the issue.

Outbound Calling by Legitimate Users

Incredible PBX provides several ways for legitimate users to make outbound calls using the default NANPA dialplan. Calls dialed using 10-digits or 1 + 10-digits are processed through the [outbound-allroutes] context in extensions_custom.conf. Calls dialed using a prefix + 10-digits are processed through the matching [CallingRule_trunkname] context in extensions.conf.

IMPORTANT: Unlike traditional Asterisk-GUI trunk dialing, Incredible PBX adds an extra layer of protection to outbound calls by first processing the calls through the [outgoing-sub] context in extensions_custom.conf. This is critically important (to your phone bill) because it is the context that assures that attempts from outsiders to make anonymous SIP calls are blocked in the event your firewall was disabled. This context also can be used to add your own call processing logic as part of outgoing call processing. Just be careful not to remove the anonymous call logic already included in the context.

10-digit or 1 + 10-digit calls via [outbound-allroutes] are processed using the dialing sequence defined in this context for processing outbound calls. The order of the trunks determines which providers will be used (and in what order) to complete the outbound call. You can adjust the sequence individually for 10-digit and 11-digit calls to meet your own requirements. As configured, all of these calls go out through Google Voice if you have a registered Google Voice trunk. Google and most SIP providers return a Congestion condition when a call cannot be completed. This typically happens if you don't have credentials with that provider. In this case, Asterisk will attempt to place the outbound call using the next trunk in the [outbound-allroutes] dialing sequence.

One interesting discovery we made in setting up Incredible PBX for Asterisk-GUI is that many SIP providers allow free calls to anyone that has one of their DIDs whether you do or not. In other words, you can place many free calls to users who happen to have DIDs registered with providers that Incredible PBX for Asterisk-GUI supports. Before registering any trunks with Incredible PBX, try calling someone that you know has a registered DID with one of these providers or simply dial a toll-free number. This doesn't work with Google Voice DIDs unfortunately.

Prefix + 10-digit calls via [CallingRule_trunkname] are processed using the dialing sequence defined in the context with a matching prefix calling rule in extensions.conf. With the exception noted in the previous paragraph, you must have a trunk registered with the provider to make calls using that provider's trunk.

The following prefixes are configured as part of the default install:
  • 1 – Google Voice
  • 2 – Anveo Direct
  • 3 – Future Nine
  • 4 – CallCentric
  • 5 – DIDlogic
  • 6 – IPcomms
  • 7 – Les.net
  • 8 – Vitelity
  • 9 – VoIP.ms
For all of the reasons documented above, extreme care needs to be exercised in adding additional trunks to Incredible PBX for Asterisk-GUI so that you don't inadvertently create a security hole in your PBX. This separate tutorial documents the proper way to do it.

Free iNUM Calling Worldwide is supported using either a CallCentric or VoIP.ms trunk. Both of these providers will also provide you with a free iNUM DID of your own. The following prefixes are configured as part of the default install. Just dial the prefix and last 7 numbers of the iNUM DID you wish to call:

  • 0XXXXXXX – CallCentric
  • 90XXXXXXX – VoIP.ms
Free SIP URI calling is supported through the creation of Speed Dials in the [CallingRule_SIP_URI] context in extensions_custom.conf. Add as many as you like and simply reload your dialplan: asterisk-reload.
exten = 53669,1,Dial(SIP/[email protected])
exten = lenny,1,Dial(SIP/[email protected])
Speed Dialing is supported through the [CallingRule_SIP_URI] context in extensions_custom.conf. Just add as many entries as you need. Speed dial number goes on the left and number to call goes on the right. NOTE: All entries are treated as internal calls for purposes of the Asterisk-GUI Dialplan assigned to extensions.
exten = 555,1,Dial(local/[email protected])
exten = 800411,1,Goto(outbound-allroutes,8005551212,1)
See also:

Members online

PIAF 5 - Powered by 3CX

Forum statistics

Latest member