Setting Up Asterisk PBX: Install and Configure Asterisk

Setting up an Asterisk PBX is a chain of linked checks, not a single install command: the server must load a SIP driver, recognize each phone, route its extension through a dialplan, and pass call audio across the network. This walkthrough uses Ubuntu Server 24.04 and Asterisk 22 LTS to register two PJSIP softphones and place an internal call. It stops at a private test LAN. SIP trunks, public access, IVR, voicemail, and production sizing need separate provider, network, and operating decisions, so the steps below make those boundaries clear instead of promising a complete business phone system from a lab setup.

What This Asterisk PBX Setup Will Build

Asterisk is an open-source communications framework that can act as the call-control core of a private branch exchange (PBX). In this lab, two softphones register with Asterisk over Session Initiation Protocol (SIP), while VoIP carries their call audio across the IP network. PJSIP maps each phone to a configuration endpoint, while the dialplan decides which internal numbers the phones may call.

The result is deliberately small: extensions 6001 and 6002 can call each other on the same trusted network. No telephone carrier, public phone number, or outbound route is included. That keeps the first test easy to diagnose and avoids opening an Internet calling path before authentication and network controls are ready.

Think of the components as separate jobs: Asterisk runs the PBX service, PJSIP handles SIP devices, and extensions.conf controls call routing. A SIP proxy such as Kamailio can sit in a larger signaling design, but it does not replace this tutorial’s Asterisk dialplan.

For a deeper dive:

• What is a VoIP Number? All You Need to Know
• VoIP vs Traditional Phone Services: 5 Key Differences
• Setting Up Basic SIP Servers with Kamailio: Beginner’s Guide

Prepare Ubuntu 24.04 and a Test LAN

Use a clean Ubuntu Server 24.04 LTS virtual machine or a dedicated lab host. This guide builds Asterisk from the upstream source archive so the example can follow the supported 22 LTS release line rather than assuming that every Linux repository packages the same version.

Choose a Supported Release and Build Route

As checked on October 13, 2026, Asterisk 22.x is listed as a fully supported LTS series. Its patch release can change, so check the official Asterisk version matrix when you repeat the install. The upstream download guide provides the current 22-series archive used below.

This is a source-build path, not a mix of package and source instructions. If you maintain an existing PBX, do not run the sample-file step on it: Asterisk documents that make samples installs sample configurations and may replace existing files. Test this sequence on a fresh VM first, and keep an independent backup before changing any live system.

Gather the Phones and Network Details

• A supported Ubuntu host with a sudo account and enough resources for a lab compile. A fixed CPU or RAM minimum is not given here because actual needs depend on concurrent calls, codecs, transcoding, recording, and enabled modules.
• Two SIP softphone apps that can register to a user name and server address. For the client-side pairing, see the steps for integrating a SIP softphone with Asterisk.
• The PBX’s private LAN address and the subnet used by both test clients. Keep these values to hand when you configure the PJSIP transport and firewall.
• Internet access for package dependencies and the official source archive. Analog or digital telephony cards are outside this softphone example; install DAHDI or libpri only when the required hardware or ISDN use case calls for them.

Before installing, confirm that your Linux host is a supported platform for the selected Asterisk release. Asterisk’s supported-platforms guidance distinguishes project-supported environments from community best-effort platforms.

Install Asterisk 22 from Source

The install has four checkpoints: download the official archive, install its listed prerequisites, compile the selected modules, and verify the service. The source tree includes an install_prereq script so the dependency list can follow the release rather than an old, copied package list.

Download the Current 22-Series Archive

Run the first commands on the clean Ubuntu host. The archive URL tracks the current patch release in the 22 series; check its version matrix and record the exact version reported after installation.

sudo apt update
sudo apt install -y wget
mkdir -p ~/src/asterisk-lab
cd ~/src/asterisk-lab
wget -O source.tar.gz https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-22-current.tar.gz
tar -xzf source.tar.gz
cd asterisk-22.*
sudo ./contrib/scripts/install_prereq install

The Asterisk documentation explains how the prerequisite script and configure checks work. If ./configure reports a missing library, resolve that dependency and run it again before compiling.

Compile and Install the Selected Modules

Check the module menu before building. Confirm that the PJSIP channel driver and its resource modules are selected, then compile and install Asterisk. Use the sample files only on the clean lab machine described above.

./configure
make menuselect
make -j2
sudo make install
sudo make samples
sudo make config

The Asterisk build guide describes these targets. The sample configurations are examples, not a recommended secure PBX configuration; replace the relevant lab settings below before starting the service.

Run the Service as a Dedicated User

Do not run Asterisk as root. Create a restricted service account, give it access only to the directories Asterisk must use, and set the run user and group in /etc/asterisk/asterisk.conf. The commands below assume a fresh Ubuntu source install; review each path before applying them on another distribution.

sudo adduser --system --group --no-create-home --home /var/lib/asterisk --shell /usr/sbin/nologin asterisk
sudo install -d -o asterisk -g asterisk /var/run/asterisk /var/cache/asterisk
sudo chown -R asterisk:asterisk /usr/lib/asterisk /var/lib/asterisk /var/log/asterisk /var/spool/asterisk /var/cache/asterisk
sudo chgrp -R asterisk /etc/asterisk
sudo chmod -R g+rX /etc/asterisk
sudoedit /etc/asterisk/asterisk.conf

Inside the existing [options] section of asterisk.conf, set:

runuser = asterisk
rungroup = asterisk

Asterisk’s service and non-root guidance explains why these permissions matter. Keep configuration files writable only by administrators; the service account needs to read them, not edit them.

Configure Two PJSIP Extensions

Each registered phone needs three linked PJSIP objects: an endpoint for call behavior, an authentication object for its credentials, and an AOR that can hold its registered contact. Both endpoints must use the same dialplan context, and that context should expose only the destinations the lab needs.

Add a LAN Transport and Endpoint Objects

Back up the sample pjsip.conf, then edit it for this lab. Replace 192.168.1.10 with the server’s actual private address. Use a different, long random password for each phone; never leave the example placeholders in a running system. The following minimal configuration keeps media anchored at Asterisk for this test.

[transport-udp]
type=transport
protocol=udp
bind=192.168.1.10:5060

[6001]
type=endpoint
transport=transport-udp
context=internal-lab
disallow=all
allow=ulaw
auth=auth6001
aors=6001
direct_media=no

[auth6001]
type=auth
auth_type=userpass
username=6001
password=REPLACE_WITH_A_UNIQUE_RANDOM_SECRET_FOR_6001

[6001]
type=aor
max_contacts=1

[6002]
type=endpoint
transport=transport-udp
context=internal-lab
disallow=all
allow=ulaw
auth=auth6002
aors=6002
direct_media=no

[auth6002]
type=auth
auth_type=userpass
username=6002
password=REPLACE_WITH_A_DIFFERENT_RANDOM_SECRET_FOR_6002

[6002]
type=aor
max_contacts=1

The object relationships follow Asterisk’s PJSIP configuration model and its registered-phone examples. Keep one active transport definition for this address and port; do not paste a second transport with the same name into an existing configuration.

Create a Restricted Internal Dialplan

In /etc/asterisk/extensions.conf, add one context for the test. If the sample file already defines this context, add the two extensions to that section instead of creating a conflicting duplicate.

[internal-lab]
exten => 6001,1,Dial(PJSIP/6001,20)
 same => n,Hangup()

exten => 6002,1,Dial(PJSIP/6002,20)
 same => n,Hangup()

The context=internal-lab value in both endpoints must match the bracketed context name. This dialplan contains no pattern for outside numbers, so a test phone cannot place carrier calls through this configuration. Asterisk’s dialplan documentation explains how contexts, extensions, and call applications fit together.

Restrict the Test Network

Make network access match the lab, not the whole Internet. Before enabling a firewall, preserve the SSH access path you use to administer the host. The OpenSSH profile covers the standard SSH port; if your host uses a custom port, add a matching allow rule before enabling UFW. Then allow SIP signaling and the RTP media range only from the trusted phone subnet. Check /etc/asterisk/rtp.conf and use the range configured on your server; do not assume that a sample range is universal.

sudo ufw allow OpenSSH
sudo ufw allow from 192.168.1.0/24 to any port 5060 proto udp
sudo ufw allow from 192.168.1.0/24 to any port 10000:20000 proto udp
sudo ufw enable
sudo ufw status verbose

Replace 192.168.1.0/24 with the subnet that actually contains the test phones, and adjust the RTP rule to match rtp.conf. Asterisk’s NAT configuration guide covers the additional signaling and media settings needed when endpoints cross a router.

• Do not create a broad inbound rule for SIP or RTP from every Internet address.
• Use unique credentials for each extension and remove unused sample users or demo routes.
• Keep the endpoint context limited to internal destinations. Review Asterisk’s network and dialplan security guidance before adding a trunk or remote phone.
• For connections beyond the trusted LAN, plan a VPN or a properly configured TLS/SRTP deployment, access controls, monitoring, and a tested NAT design. Those steps are outside this first-call recipe.

Register Phones and Test the First Call

Configure each softphone with the server’s private address, the matching extension credentials, and UDP on port 5060. The account name and authentication user are the extension number in this example.

Softphone setting	Phone A	Phone B
User / authentication name	6001	6002
Password	The unique secret in auth6001	The different secret in auth6002
SIP server	PBX private LAN address	PBX private LAN address
Transport / port	UDP / 5060	UDP / 5060

Restart Asterisk after changing its PJSIP transport or endpoint file in this initial setup. Then check the service and confirm that both endpoints and contacts appear.

sudo service asterisk start
sudo service asterisk status
sudo asterisk -rx "core show version"
sudo asterisk -rx "pjsip show endpoints"
sudo asterisk -rx "pjsip show contacts"
sudo asterisk -rx "dialplan show internal-lab"

Both softphones should show registered, and the CLI should list endpoints 6001 and 6002 with active contacts. From phone 6001, dial 6002; answer on the second phone and confirm audio in both directions. Repeat the call from 6002 to 6001. A successful registration alone is not a successful PBX test: the dialplan and media path must work too.

After you edit only extensions.conf, reload the dialplan with sudo asterisk -rx "dialplan reload" and inspect it again with dialplan show internal-lab. A dialplan reload does not apply every kind of PJSIP or transport change. For this lab, restart the service after changing PJSIP settings.

Troubleshoot Registration, Routing, and Audio

Use the failed stage to narrow the problem. Asterisk’s PJSIP troubleshooting guide provides more detailed CLI checks.

• The phone will not register: confirm the server address, UDP port, extension user name, authentication name, and unique password. Run pjsip show endpoint 6001 or pjsip show endpoint 6002, then check that the phone’s subnet is allowed through the host firewall.
• The phone registers but the call fails: make sure both endpoints use context=internal-lab, the section exists in extensions.conf, and the called extension is listed by dialplan show internal-lab.
• The call rings but has no or one-way audio: check the RTP port range in rtp.conf, the matching firewall rule, and whether both clients really share the intended LAN. If a router is involved, configure and test NAT rather than opening a wider port range.
• A change does not appear: read the Asterisk CLI or service logs for the specific configuration error, then reload the correct component or restart the service when a transport change requires it. A warning is a diagnostic clue, not evidence of malware.

For recurring call-quality issues outside this isolated lab, use a structured checklist for common VoIP problems instead of treating every dropped call as a PBX configuration error. Do not run a stress test against a paid trunk without a defined call load, test window, cost limit, and stop condition.

Extend the PBX After the Internal Call Works

Add one capability at a time and give each change its own test. Asterisk’s basic internal dialplan does not automatically provide carrier calling, customer support flows, or production operations.

• For calls to public phone numbers: get SIP trunk details from a carrier, create the provider’s PJSIP authentication and registration objects, and add explicit inbound and outbound routes. Restrict destinations and credentials to control toll-fraud risk; carrier settings vary, so do not copy a generic trunk block into production.
• For voicemail, queues, or an IVR: configure the relevant files and modules, then test prompts, timeouts, transfers, and failure paths separately. A feature name in Asterisk does not mean it is enabled or ready for callers.
• For remote extensions: design for NAT, trusted identity, encryption, firewall policy, and monitoring before exposing signaling or media outside the LAN. Remote calling has different failure modes from a same-network test.
• For higher call volumes or recording: measure concurrency, codec conversion, disk use, and network quality on the intended workload before selecting server capacity. A small extension count alone does not prove that a host can handle the call pattern; review how to scale a VoIP system before production planning.

Further reading:

• How to Build a Home VoIP System: 5 Detailed Steps
• WebRTC and VoIP for Real-Time Communication Apps
• Integrating VOIP with CRM Systems: 5 Key Steps & Practices

Use the First Call as Your Acceptance Check

The lab is ready for its next step when Asterisk runs as a restricted service account, both PJSIP phones register, the internal context loads, and calls between 6001 and 6002 have two-way audio. Keep the result scoped to internal calling. A carrier trunk, public access, emergency calling, call recording, and production capacity each need their own requirements, controls, and verification.

If the project is moving from a lab PBX to a customer-facing calling product, define the client, call-routing, carrier, CRM, and security requirements before selecting an architecture. Designveloper’s VoIP application development services are a relevant next step when that work includes custom software rather than only configuring this test server.