Tips & Tricks

FreePBX 17 Tips & Tricks on CloudSOE Images

2026-07-30 · freepbx-17 docs

A collection of practical advice for running the CloudSOE FreePBX 17 image in production, on either cloud.

ffmpeg arrives about an hour after first boot — by design

For codec licensing reasons, ffmpeg is intentionally not shipped in the image. Instead, a systemd timer on your instance installs it from the distribution repositories roughly one hour after first boot. Until then, features that transcode media through ffmpeg may not work.

Check on it:

systemctl status freepbx-ffmpeg-install.timer
systemctl status freepbx-ffmpeg-install.service

Don’t want to wait? Trigger it manually:

sudo systemctl start freepbx-ffmpeg-install.service

The install is run-once — a marker file (/var/lib/freepbx-ffmpeg-installed) prevents repeats. If the timer fires while the OS is busy with unattended upgrades, the service waits for the apt lock rather than failing.

Claim the admin account before someone else does

The FreePBX admin account is created on the first visit to the web UI. Do it immediately after launch, and keep port 80 restricted to your admin IPs in the security group / NSG. SIP scanners find fresh PBX instances remarkably fast.

Toll fraud is the real threat

Compromised PBXes are monetised by pumping calls to premium-rate numbers, often overnight or on weekends:

  • Restrict 5060/5061 to your trunk provider’s and phones’ IP ranges wherever possible.
  • Use long random SIP secrets on every extension.
  • In your outbound routes, don’t enable international destinations you don’t need; many trunk providers also let you cap spend or block premium prefixes — turn that on.
  • Review Reports → CDR Reports occasionally for calls you don’t recognise.

Backups

Use the built-in Admin → Backup & Restore module to schedule regular backups, and ship them off the instance (S3, Azure Blob, SFTP). From the shell:

sudo fwconsole backup --backup=<backup-id>

Cloud-level disk snapshots are a good complement, but a FreePBX backup restores cleanly onto a fresh instance of a newer image version.

Keep things updated

  • FreePBX modules: Admin → Module Admin, or sudo fwconsole ma upgradeall.
  • OS security updates come from Debian’s repositories: sudo apt update && sudo apt upgrade on your own schedule.
  • For major moves, launch a fresh instance from the latest CloudSOE image and restore your backup rather than upgrading in place.

One-way or no audio on calls

The classic cloud-PBX symptom, almost always one of:

  1. NAT settings — External Address and Local Networks not set under Settings → Asterisk SIP Settings (see the configuration guide).
  2. RTP range closed — the 10000–20000 UDP range missing from your security group / NSG (on Azure, check the rule is actually UDP).
  3. Changed public IP — you attached a new Elastic IP / public IP but the External Address still holds the old one.

Troubleshooting first boot

systemctl status freepbx-firstboot
journalctl -u freepbx-firstboot --no-pager

First boot on this image only fills the public IP into the login banner — the PBX itself is fully installed at image-build time, so a first-boot hiccup never breaks telephony. If the banner shows the wrong IP after you attach a new Elastic IP / public IP, just edit /etc/motd.

Watch what the scanners are doing

Curious what’s knocking? A SIP logger session shows probe traffic in real time:

sudo asterisk -rvvv
pjsip set logger on

Turn it off (pjsip set logger off) when you’re done — it’s noisy. If you see constant probes, tighten your security group / NSG source ranges; see the getting-started guides (AWS, Azure).