Getting Started with FreePBX 17 on AWS

The CloudSOE FreePBX 17 image gives you a complete phone system — FreePBX 17 with Asterisk, installed by Sangoma’s official installer — on a Debian 12 base. The image contains no baked-in passwords: the FreePBX admin account is created by you, on your first visit to the web UI.

What you’ll need

An AWS account subscribed to the CloudSOE FreePBX 17 listing on AWS Marketplace
An EC2 key pair in your target region (SSH is key-based only; password login is disabled)
About ten minutes

Step 1 — Launch the instance

Open the FreePBX 17 listing on AWS Marketplace and click Continue to Subscribe, then Continue to Configuration.
Pick your region and click Continue to Launch → Launch through EC2.
Choose an instance type. t3.medium (2 vCPU, 4 GB RAM) is a good starting point for a small office PBX.
Select your key pair, and give the root volume at least 30 GB for call recordings and voicemail.

Prefer the CLI? Once subscribed:

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type t3.medium \
  --key-name my-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=freepbx-01}]'

Step 2 — Open the firewall ports (carefully)

A PBX exposed to the whole internet attracts constant scanning within minutes. Wardialers probe SIP ports around the clock looking for weak extensions to route toll fraud through. Wherever possible, restrict the SIP and RTP rules below to the IP ranges of your trunk provider and your phones — not 0.0.0.0/0.

Port	Protocol	Purpose
22	TCP	SSH administration (restrict to your admin IPs)
80	TCP	FreePBX admin UI (HTTP; restrict to your admin IPs)
5060	UDP + TCP	SIP signalling (restrict to trunk provider / phones)
5061	TCP	SIP over TLS, if you enable it
10000–20000	UDP	RTP media (audio)

The RTP range is Asterisk’s default, 10000–20000; you can view or change it in the FreePBX UI under Settings → Asterisk SIP Settings → RTP Port Ranges.

Step 3 — Let first boot finish

On the very first boot a one-time service (freepbx-firstboot) fills your instance’s public IP into the login banner. Asterisk and the FreePBX web UI start automatically. You can check it:

ssh debian@<public-ip>
systemctl status freepbx-firstboot

Note the SSH user is debian — this is a Debian 12 image, not Ubuntu.

Step 4 — Create your FreePBX admin account

Browse to http://<public-ip>/. On your first visit, FreePBX asks you to create the admin username and password — this account does not exist until you create it, and it is never stored in the image.

Do this immediately after launch. Until the admin account exists, anyone who can reach port 80 can claim it — another good reason to restrict port 80 to your own IP in the security group.

After creating the account, log in and let FreePBX activate its modules. You can optionally activate the system from the web UI to install commercial modules.

Step 5 — Basic PBX sanity check

SSH in and confirm Asterisk is up:

sudo asterisk -rvvv

You should get the Asterisk CLI prompt (type exit to leave). From here, everything else — extensions, trunks, inbound routes — happens in the FreePBX web UI.

Next steps

Configure FreePBX — file locations, NAT settings, RTP ports and services
Tips & tricks — the deferred ffmpeg install, backups, one-way audio and troubleshooting