Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To run Asterisk reliably on a Linux VPS, use a supported Debian, Ubuntu, CentOS, RHEL or Fedora release on x86, install Asterisk from a distribution package, FreePBX, or source, and configure the modern PJSIP driver. A working deployment needs more than a successful SIP registration: you must define PJSIP endpoints, authentication and address-of-record objects, create a restricted dial plan, advertise the correct NAT addresses, allow the selected RTP range through both firewalls, and harden the Internet-facing service.
The procedure below starts with a small internal test extension, then moves through phone registration, bidirectional audio, external calling and security. No universal CPU, memory or concurrent-call figure is published for Asterisk; codec choice, transcoding, recording, concurrency and network quality determine the required VPS size, so load-test the exact workload you intend to operate.
Choose the Linux distribution and installation method
Start with a non-end-of-life operating system. Asterisk officially supports non-EOL Debian, Ubuntu, CentOS, RHEL and Fedora on 32-bit and 64-bit x86. Other distributions may work, but support is community or best-effort. Record the exact distribution and release before deployment because distribution upgrades can break older Asterisk builds.
Use a VPS with a public address, or document every translation rule when the VPS is behind another NAT device. Select a current supported release rather than an image that has already reached end of life. Asterisk 22 is the version family described by the current source-download instructions at the time of writing; verify the release status, package version and platform matrix immediately before installing.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Method | Best fit | Advantages | Costs and cautions |
|---|---|---|---|
| Distribution package | A first deployment whose required modules are available in the repository | Fast installation, signed distribution updates and a service definition supplied by the operating system | Repository version and compile-time modules may not match a project requirement; package names and service behavior vary by distribution |
| FreePBX | New administrators who want a web interface for trunks, extensions and call flows | Guided configuration and less manual editing for common PBX tasks | Introduces a larger management stack; understand which files and services it controls before making manual changes |
| Source build | Operators who need precise version, module and compile-time control | Choose modules with make menuselect and align the build with a specific release |
You maintain compilers, development libraries, upgrades and the system service; missing libraries make configuration fail |
For a new installation, use res_pjsip/chan_pjsip. The Asterisk project describes PJSIP as its standard SIP driver. The older chan_sip driver is legacy and was removed in Asterisk 21, so tutorials built around it are not a sound basis for a new server.
Prepare the VPS before installing Asterisk
Update the operating system and establish administration access
- Create a non-root administrative account and use SSH keys where your VPS provider supports them. Keep a separate recovery path such as the provider console.
- Apply operating-system updates before installing telephony software. On Debian or Ubuntu, the basic sequence is:
sudo apt update
sudo apt full-upgrade- Set the correct time zone and keep network time synchronization enabled. Accurate time makes SIP logs, certificate checks and call records much easier to correlate.
- Decide whether the VPS will terminate TLS, store voicemail, record calls or connect directly to an ITSP. Those choices affect disk, memory, CPU and firewall design.
Plan addresses and ports
Write down the VPS public address, the private subnet (if any), the address ranges used by phones, and the ITSP signaling addresses. Choose one RTP range and document it; the often-seen UDP 10000–20000 range is an example, not a requirement. A narrow, deliberate range is easier to secure and monitor than an undocumented broad range.
Apply policy in both layers: the cloud security group or provider firewall and the Linux host firewall. Permit SIP and RTP only from the networks that need them. Do not expose the Asterisk HTTP or ARI interface unless an application explicitly requires it, and then restrict its source addresses and authentication separately.
Install Asterisk from a distribution package
On Debian or Ubuntu, a package-based outline is:
sudo apt update
sudo apt full-upgrade
sudo apt install asterisk
sudo systemctl enable --now asterisk
sudo systemctl status asterisk
asterisk --versionUse the selected distribution’s package metadata and Asterisk packaging documentation for other systems. Do not paste an unverified third-party repository or version into a production runbook. Confirm that the package contains the PJSIP modules you need and that the service starts under the intended account.
Check the running service
systemctl status should show an active service. Enter the Asterisk console with the distribution’s documented command, then check the loaded modules and version. If the service fails, inspect the operating-system journal before changing configuration; a missing library, permission problem or port conflict is more likely than a SIP syntax issue at this stage.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Build Asterisk from source when you need control
A source build is appropriate when the distribution package lacks a required module or when you must pin a particular release. It is not a way to avoid maintenance: every compiler, library and security update becomes your responsibility.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Update the operating system and install a C compiler, linker, headers and the development libraries required by the modules you intend to use.
- Download the release from the Asterisk project and unpack it. The source-download documentation currently describes the Asterisk 22 archive as
asterisk-22-current.tar.gz; confirm the exact filename and release notes when you deploy. - From the unpacked source directory, run the prerequisite helper:
./contrib/scripts/install_prereq test
./contrib/scripts/install_prereq installThe script also supports install-unpackaged and minimal. Use the mode that matches your distribution policy. The test mode helps identify missing packages before changing the system.
- Configure the tree, select modules, compile and install:
./configure
make menuselect
make
sudo make install- Install sample configuration only if you want a starting reference, then create the service using the distribution or project procedure. Review ownership and permissions so the Asterisk process cannot modify unrelated system files.
- If
./configurereports a missing library, install the matching development package and rerun./configure. Do not assume that a successful package installation automatically reruns configuration.
Keep a record of the source version, enabled modules and build dependencies. That record is essential when rebuilding after a distribution upgrade.
Configure PJSIP objects and a safe test dial plan
PJSIP separates transport, authentication, endpoint and address-of-record (AoR) objects. An endpoint describes how a device is handled; it is not itself a dialable destination. The endpoint is associated with an AoR, which tracks one or more contacts, and an authentication object, which verifies credentials.
Create a UDP transport and one lab endpoint
The following is a conceptual laboratory configuration. Replace the password, extension number and context for your environment, and do not reuse tutorial credentials.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060
[6001]
type=auth
auth_type=userpass
username=6001
password=replace-with-a-long-random-secret
[6001]
type=aor
max_contacts=1
[6001]
type=endpoint
aors=6001
auth=6001
context=from-internal
disallow=all
allow=ulawUse a unique, long random secret for every endpoint. Keep the endpoint in a restricted context such as from-internal; never put an Internet-facing device in a permissive context that can place arbitrary outbound calls. If you change transport settings, perform a complete Asterisk restart. A module reload is not sufficient for transport changes.
Add a harmless extension for the first test
Before configuring trunks, emergency routes, recording or voicemail, prove that the PBX can answer an internal call. A minimal test extension is:
[from-internal]
exten => 100,1,Answer()
same => n,Wait(1)
same => n,Playback(hello-world)
same => n,Hangup()The hello-world prompt confirms that channel setup, the dial plan and audio playback work locally. Keep production outbound routes, emergency calling, recording, voicemail and tenant separation in separately reviewed sections rather than adding them to this initial test context.
Register a SIP desk phone or softphone
A SIP desk phone is a direct endpoint choice. A softphone is simply a computer program that emulates a real phone and is useful for an inexpensive initial test. The basic PBX approach assumes two or more SIP phones, but two softphone instances can perform the same internal audio test.
Recommended Free Tools
Enter the account details
On the device, create an account with these fields (labels differ by manufacturer):
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Registrar or SIP server: the VPS address or hostname that resolves to it.
- SIP username and authentication username: the values represented by the PJSIP identity, such as
6001. - Password: the long random value in the matching authentication object.
- Outbound proxy: the VPS address when the device or network requires an explicit proxy.
- Transport: UDP for the initial lab transport; select TLS only after a TLS transport and certificate are configured.
When the device registers, use the Asterisk CLI at increased verbosity while rebooting or registering it. Then run:
pjsip show endpointsConfirm that the endpoint is present and has the expected contact. A successful registration proves signaling and credentials, not that RTP can reach the device.
Free tools Windows power users keep installed
One-click scans. No signup required.
Run the internal call test
- Verify that the Asterisk service is active and the expected PJSIP modules are loaded.
- Register endpoint
6001and confirm it appears inpjsip show endpoints. - Dial
100and listen for thehello-worldprompt. - Register a second endpoint with a different AoR, authentication object and secret.
- Call between the two endpoints and speak in both directions before attempting an ITSP call.
Handle NAT, RTP and firewall rules deliberately
NAT problems are the most common reason a phone appears registered but has one-way or no audio. SIP signaling may reach the VPS while the RTP media address in the SDP is private, stale or blocked. Configure NAT in the PJSIP transport when phones or the VPS sit behind translation.
Set the external and local addresses
Use the transport’s local_net, external_signaling_address and external_media_address settings to describe your topology. The local network tells Asterisk which destinations are internal; the external signaling and media addresses tell it what a remote phone or provider can reach. Use the actual public address or a stable name resolved to it, and ensure that the advertised media address is reachable from both the phone and the ITSP.
The official examples forward SIP on TCP/UDP 5060 and RTP on UDP 10000–20000. Treat those as example values: select the range used by your installation, configure the same range in Asterisk, and open exactly that range in both the cloud and host firewalls.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Open only required traffic
A typical design permits signaling from known phone or provider networks and permits the chosen RTP range only from the corresponding media peers. If phones roam across arbitrary networks, source restriction may be less precise, but you should still limit ports and monitor abuse. Do not expose unrelated management services on the public interface.
Disable or bypass SIP ALG features on routers that rewrite SIP packets unexpectedly. Compare the SDP addresses and ports in a call trace with the packets observed at the VPS. A mismatch identifies whether the problem is endpoint NAT, Asterisk advertisement or a firewall rule.
Prefer encrypted transport for public service
For Internet-facing service, prefer TLS signaling on 5061 and SRTP media when every endpoint and provider supports them. The secure-calling procedure uses certificates, a TLS transport and SRTP. Store private keys with least-privilege permissions and rotate certificates under normal operational procedures. Encryption does not replace source restrictions, strong credentials or rate limiting.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot registration and one-way audio
Registration fails
- Check the username, authentication username, password and endpoint name for exact matches.
- Confirm that the cloud security group and host firewall permit the selected signaling protocol and port.
- Watch the Asterisk CLI while registering to distinguish rejected credentials from packets that never arrive.
- Run
pjsip show endpointsand verify that the contact is created for the intended AoR. - Ensure the endpoint’s context exists in the dial plan and that the transport is bound to the address and port you configured.
The phone registers but there is no audio
- Check whether the SDP advertises a private address or an RTP port outside your allowed range.
- Confirm that
external_media_addressandlocal_netdescribe the real topology. - Open the configured RTP range in both firewalls, not just SIP 5060 or 5061.
- Verify that the phone’s NAT device is not timing out or rewriting the media session.
- Test with a second endpoint on a different network to determine whether only one side is affected.
Internal audio works but an ITSP call fails
- Do not troubleshoot the trunk until two internal endpoints can exchange audio.
- Compare the ITSP’s required codecs, transport and authentication with your endpoint and trunk settings.
- Confirm that the provider’s signaling and media source addresses are allowed by the firewalls.
- Capture SIP and RTP diagnostics during one failed call, then inspect the offered codecs, SDP addresses, response codes and packet direction.
Secure an Internet-facing Asterisk VPS
Protect identities and entry points
- Keep the Linux distribution and Asterisk security updates current.
- Use a different long secret for every PJSIP endpoint; remove tutorial accounts before production.
- Restrict SIP access by source network or provider addresses whenever the design permits it.
- Use TLS and SRTP for endpoints that support them, and protect certificate private keys.
- Expose the Asterisk HTTP/ARI interface only when explicitly required, with separate access controls.
- Apply cloud and host firewall policy together, then verify the effective rules from an external network.
Deploy and validate Fail2ban
Install Fail2ban or an equivalent log-based control after confirming which PJSIP log source contains authentication failures on your build. A filter aimed at the wrong log file gives a false sense of protection. Generate a controlled failed-authentication event from a test address, verify that the jail detects it, and confirm that the resulting block does not lock out your administration network or legitimate provider.
Separate privileges and data
Run Asterisk under its intended service account rather than as root after installation. Keep configuration, certificates, voicemail and recordings readable only by the accounts and services that need them. Remove unused modules and sample accounts, and review file permissions after every source rebuild or package migration.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOperate, monitor and upgrade the VPS
Back up what makes the PBX unique
Back up pjsip.conf, extensions.conf, any other reviewed dial-plan files, certificates and private keys, voicemail, recordings and the database used by your management layer. Store backups away from the VPS and test a restoration to a separate instance. A backup that has never been restored is only an assumption.
Monitor service health and call quality
- Track registration failures, authentication bursts and unexpected endpoint creation.
- Watch CPU, memory, disk space and disk latency, especially when recording or transcoding.
- Measure RTP loss, jitter and one-way audio reports rather than relying only on SIP registration counts.
- Keep synchronized timestamps across the VPS, phones and provider so call traces line up.
- Use Asterisk quality-of-service options for signaling and media TOS/DSCP markings when the network supports them, and verify that intermediate routers preserve those markings.
Plan upgrades instead of improvising them
Check the supported platform matrix before upgrading either the operating system or Asterisk. A distribution upgrade can remove development libraries or compiler behavior needed by an older source tree. For a source installation, record the configure options and module selection, stage the new build on a separate VPS, restore a backup and run internal calls before changing production DNS or provider routes. For packages, read the distribution’s upgrade notes and confirm whether configuration files will be replaced, merged or preserved.
Quick Recap
Production readiness checklist
- A supported, non-EOL Linux release and documented public/NAT topology are in place.
- The chosen package, FreePBX or source method is recorded, including Asterisk version and enabled modules.
- PJSIP is used for new endpoints; no obsolete
chan_sipinstructions remain in the runbook. - Every endpoint has a unique secret, a defined AoR and a restricted dial-plan context.
- Transport changes have been followed by a full restart, not only a module reload.
- The selected signaling and RTP ports are allowed by both cloud and host firewalls.
- NAT addresses are correct, SIP ALG is not rewriting traffic, and two endpoints have completed a bidirectional audio test.
- TLS/SRTP is enabled where endpoint and provider support make it practical.
- Fail2ban detection and blocking have been tested against the actual PJSIP logs.
- Backups, restoration tests, monitoring, upgrade staging and a rollback plan exist.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
