The CloudSOE FreePBX 17 image gives you a complete phone system — FreePBX 17 with Asterisk, installed by Sangoma’s official installer — on a Debian 12 base. The image contains no baked-in passwords: the FreePBX admin account is created by you, on your first visit to the web UI.
What you’ll need
- An Azure subscription
- An SSH public key (password login is disabled in the image)
- About ten minutes
Step 1 — Create the VM
- Find the CloudSOE FreePBX 17 offer in the Azure Marketplace and click Create.
- Choose a resource group, region and VM name.
- Pick a size — 2 vCPU / 4 GB (for example
Standard_B2sorStandard_D2as_v4) suits a small office PBX. - Under Administrator account, select SSH public key, pick a username (e.g.
azureuser) and paste your key. This is the account you’ll SSH in with. - Attach a public IP, and set it to Static — a PBX whose address changes on every stop/start will break your trunk registrations and phone configs.
Step 2 — Open the firewall ports (carefully)
A PBX exposed to the whole internet attracts constant scanning within minutes. Wardialers probe SIP ports around the clock looking for weak extensions to route toll fraud through. Wherever possible, restrict the SIP and RTP rules below to the IP ranges of your trunk provider and your phones — not
Any.
In the VM’s network security group, allow inbound:
| Port | Protocol | Purpose |
|---|---|---|
| 22 | TCP | SSH administration (restrict to your admin IPs) |
| 80 | TCP | FreePBX admin UI (HTTP; restrict to your admin IPs) |
| 5060 | UDP + TCP | SIP signalling (restrict to trunk provider / phones) |
| 5061 | TCP | SIP over TLS, if you enable it |
| 10000–20000 | UDP | RTP media (audio) |
Two Azure-specific notes:
- NSG rules default to TCP in some portal flows — SIP over UDP needs an explicit UDP rule, and the RTP range is UDP only. Double-check the protocol column after saving.
- The RTP range is Asterisk’s default,
10000–20000; view or change it under Settings → Asterisk SIP Settings → RTP Port Ranges in the FreePBX UI.
Step 3 — Let first boot finish
On the very first boot a one-time service (freepbx-firstboot) fills your VM’s public IP into the login banner. Asterisk and the FreePBX web UI start automatically:
ssh <admin-user>@<public-ip>
systemctl status freepbx-firstbootStep 4 — Create your FreePBX admin account
From your own machine (an Azure VM often cannot reach its own public IP from inside), browse to http://<public-ip>/. On your first visit, FreePBX asks you to create the admin username and password — this account does not exist until you create it, and it is never stored in the image.
Do this immediately after deployment. Until the admin account exists, anyone who can reach port 80 can claim it — another good reason to restrict port 80 to your own IP in the NSG.
After creating the account, log in and let FreePBX activate its modules. You can optionally activate the system from the web UI to install commercial modules.
Step 5 — Basic PBX sanity check
SSH in with the admin username you chose at deployment and confirm Asterisk is up:
sudo asterisk -rvvvYou should get the Asterisk CLI prompt (type exit to leave). From here, everything else — extensions, trunks, inbound routes — happens in the FreePBX web UI.
Next steps
- Configure FreePBX — file locations, NAT settings, RTP ports and services
- Tips & tricks — the deferred ffmpeg install, backups, one-way audio and troubleshooting