How to Run Asterisk on a Linux VPS

The safest first deployment is a current, supported Debian or Ubuntu x86 VPS with a public address (or a documented NAT path), Asterisk installed from the distribution package, and res_pjsip used for SIP. Build a small internal test extension before opening service to the Internet. Then set NAT and RTP addresses deliberately, restrict both cloud and host firewalls, and add TLS/SRTP and Fail2ban where your phones and provider support them.

Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.

Choose the Linux distribution and installation method

Asterisk officially supports non-end-of-life releases of Debian, Ubuntu, CentOS, RHEL and Fedora on 32-bit and 64-bit x86. Use a supported release rather than an image that is already out of maintenance; an old operating system can leave you without security fixes or with build dependencies that no longer match current Asterisk versions. Check the support matrix again when you provision the VPS because distribution and Asterisk support windows change.

#	Preview	Product	Price
1		Grandstream GXP1620 IP Phone | 2 Lines, 2 SIP Accounts | 2.9-Inch LCD Display | Dual-Port 10/100...	$38.25	Buy on Amazon
2		Grandstream Cordless WiFi IP Phone WP826 SIP Phone	$79.66	Buy on Amazon
3		Yealink T54W IP Phone - Power Adapters Included	$139.00	Buy on Amazon
4		Grandstream GRP2612W IP Phone | 4 Lines, 4 SIP Accounts | 2.4-Inch Color Display | Wi-Fi 5 |...	$58.53	Buy on Amazon
5		Yealink, Landline Phone, Classic Gray | Bluetooth Connectivity, Ergonomic Design	$199.00	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

For a new Internet-facing installation, use res_pjsip (also called chan_pjsip). The Asterisk project describes PJSIP as its standard SIP driver. The older chan_sip driver is legacy and was removed in Asterisk 21, so tutorials written for sip.conf are not a sound starting point for a current system.

There is no universal minimum VPS size or guaranteed concurrent-call figure. Codec choice, transcoding, recording, encryption, dial-plan applications, simultaneous calls and network quality all change the load. Start with a small instance for a lab, measure CPU, memory, disk and packet loss under your expected workload, and load-test the exact codec and call flows you will operate.

#1 Best Overall

Grandstream GXP1620 IP Phone | 2 Lines, 2 SIP Accounts | 2.9-Inch LCD Display | Dual-Port 10/100 Ethernet

• The phone only works with VoIP
• 2 dual-color line keys (with 2 SIP accounts and up to 2 call appearances), 3 XML programmable context-sensitive soft keys, 3-way conference
• HD wideband audio, superb full-duplex hands-free speakerphone with advanced acoustic echo cancellation and excellent double-talk performance.
• Large phonebook (up to 500 contacts) and call history - up to 200 records
• Automated provisioning using TR-069 or encrypted XML configuration file, SRTP and TLS for advanced security protection, 802.1x for media access control

$38.25

Buy on Amazon

Prepare the VPS before installing Asterisk

Confirm the network design

• Give the VPS a stable public address, or document the private-to-public NAT mapping that will be used for SIP signaling and RTP.
• Record the cloud provider’s security-group rules and the operating system’s firewall rules separately; both layers must allow the same traffic.
• Decide whether phones will connect directly, through a VPN, or through a SIP trunk provider. A VPN or source restriction is preferable to exposing every SIP source on the public Internet.

Update the operating system

On a Debian or Ubuntu image, update the base system before installing telephony software:

sudo apt update
sudo apt full-upgrade

Reboot if the kernel or other core services were upgraded, then verify the hostname, time synchronization, storage space and public address. Accurate time is important for log correlation and certificate validation.

Install the distribution package

The package-based outline below uses the Debian/Ubuntu package name. Package names and service behavior vary by distribution, so confirm the selected release’s package metadata instead of copying a repository from an unrelated tutorial.

sudo apt install asterisk
sudo systemctl enable --now asterisk
sudo systemctl status asterisk
asterisk --version

The final command should print the installed version. Keep that output with your deployment notes; it tells you which configuration syntax and module set you are actually running.

Build Asterisk from source when you need control

Source installation is useful when the distribution package lacks a module or when you need a particular supported release, but it creates a maintenance obligation. The current source-download documentation describes an Asterisk 22 archive named asterisk-22-current.tar.gz; verify the release and security advisories at the time you deploy because the current version can change.

Rank #2

Grandstream Cordless WiFi IP Phone WP826 SIP Phone

• Dual-Band Wi-Fi 6: Enjoy seamless wireless connectivity with the latest Wi-Fi 6 technology, providing faster speeds and improved coverage.
• Cordless Convenience: This cordless phone offers the freedom to move around while on a call, without being tethered to a base station.
• Large Color Display: The
• 4-inch color LCD screen provides a clear and vibrant interface for easy navigation and call management.
• Intuitive Controls: The phone features a user-friendly keypad and navigation buttons for effortless operation.

$79.66

Buy on Amazon

1. Update the operating system and install a C compiler, linker, development headers and other build libraries required by your chosen modules.
2. Download and unpack the verified Asterisk source archive.
3. From the unpacked directory, run the prerequisite helper: ./contrib/scripts/install_prereq test to check requirements, or use its install, install-unpackaged or minimal modes according to your policy.
4. Run ./configure. If it reports a missing library, install that library and rerun ./configure; the check is expected to fail when required dependencies are absent.
5. Run make menuselect and enable only the channels, codecs, applications and resource modules you need. Record the selection so a later rebuild is reproducible.
6. Compile and install using the project’s documented procedure, install sample configuration only if you want a reference copy, and create a system service using your distribution or the Asterisk procedure.
7. Start the service, verify its version and inspect the loaded PJSIP modules before exposing any port.

Do not mix files from a package installation and a source installation on the same VPS. Choose one ownership and upgrade path, and make sure the service account, configuration directory and log locations are protected consistently.

Understand the PJSIP objects you must configure

PJSIP separates transport, authentication, an address-of-record (AoR) and endpoint behavior. An endpoint is not itself a dialable destination; it is associated with an AoR and the contacts registered to that AoR. This separation is why a phone can authenticate yet still fail to route a call if the endpoint, AoR or dial plan is mismatched.

• Transport: the UDP, TCP or TLS listener and its bind address.
• Authentication: the username and password used by a phone or provider.
• AoR: contact limits and the location to which calls are sent.
• Endpoint: codecs, context, authentication reference and AoR reference.

A minimal laboratory endpoint can be represented as follows. Replace the sample identifier and password; never deploy a tutorial password.

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060

[6001]
type=auth
auth_type=userpass
username=6001
password=replace-with-a-long-random-secret

[6001]
type=aor
max_contacts=1

[6001]
type=endpoint
aors=6001
auth=6001
context=from-internal
disallow=all
allow=ulaw

The repeated section name is intentional here: the object type distinguishes the authentication, AoR and endpoint records. In a production configuration, use unique long secrets, limit the number of contacts deliberately, and keep the endpoint in a restricted context. Do not place an Internet-facing endpoint in a permissive default context that can reach paid routes or administrative applications.

Transport changes require a complete Asterisk restart rather than only a module reload. Plan a maintenance window whenever you change bind addresses, protocols or NAT-related transport settings.

Rank #3

Yealink T54W IP Phone - Power Adapters Included

• 5V/2A Power Supply Included - PoE support
• 4.3″ 480 x 272-pixel color display with backlight - Adjustable LCD screen
• Built-in Bluetooth 4.2
• Built-in dual-band 2.4G/5G Wi-Fi (802.11a/b/g/n/ac)
• USB 2.0 port for USB recording, wired/wireless USB headsets, and EXP50

$139.00

Buy on Amazon

Create a safe internal dial-plan test

Before adding an ITSP trunk, emergency route or voicemail, prove that Asterisk can answer an internal extension. The following test extension answers, waits, plays the built-in hello-world prompt and hangs up:

[from-internal]
exten => 100,1,Answer()
 same => n,Wait(1)
 same => n,Playback(hello-world)
 same => n,Hangup()

Keep production outbound routes, emergency calling, recording, voicemail and tenant separation in separately reviewed contexts. A test context should not accidentally inherit an outbound route. After editing configuration, use the appropriate PJSIP and dial-plan reload commands for your installation; restart when a transport change is involved, then inspect the console for syntax errors.

Register a desk phone or softphone

A SIP desk phone is a direct endpoint choice. A softphone is simply a computer program that emulates a real phone and is a convenient, low-cost way to test before purchasing handsets. The basic-PBX workflow assumes two or more SIP phones, but free softphones can provide the same initial call test.

1. In the phone or softphone, set the registrar or server to the VPS address. Use the VPS address as the outbound proxy when the client asks for one and your network design requires it.
2. Enter the SIP username and authentication username that match the PJSIP auth object, along with the long random password.
3. Use the correct transport (UDP, TCP or TLS) and port. Do not select TLS on the client until a TLS transport and certificate are configured on Asterisk.
4. Save the account, restart or re-register the client, and watch the Asterisk CLI at increased verbosity while it sends a REGISTER request.
5. From the CLI, run pjsip show endpoints. Confirm that the endpoint appears with the expected contact and that its transport and codec list are what you intended.
6. Dial extension 100. The hello-world prompt proves signaling, dial-plan matching and server-to-phone media in that direction.
7. Register a second endpoint and call between the two devices. Confirm that both parties can speak and hear before testing an external trunk.

Registration alone is not proof that media works. A REGISTER request can reach the VPS while RTP is blocked, misaddressed or rewritten by a NAT device.

Set NAT addresses and RTP deliberately

When a phone or the VPS is behind NAT, Asterisk must advertise addresses that the remote phone and ITSP can actually reach. In the transport configuration, set local_net for internal networks and set external_signaling_address and external_media_address to the public address used by your design. Use the address that is reachable from the client, not merely the VPS’s private interface address.

Rank #4

Sale

Grandstream GRP2612W IP Phone | 4 Lines, 4 SIP Accounts | 2.4-Inch Color Display | Wi-Fi 5 | Dual-Port 10/100 Ethernet with Integrated PoE

• Supports 4 SIP accounts and 4 multi-purpose line keys
• Swappable faceplate to allow for easy logo customization
• GRP2612W includes built-in dual-band Wi-Fi support. Ethernet cord must be disconnected to enable Wi-Fi capability
• HD audio supporting all major codecs, including wideband codecs G.722 and Opus Up to 16 digital BLF Keys
• Enterprise-level protection including secure boot, dual firmware images, and encrypted data storage

$58.53

Buy on Amazon

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060
local_net=YOUR_PRIVATE_NETWORK/CIDR
external_signaling_address=YOUR_PUBLIC_ADDRESS
external_media_address=YOUR_PUBLIC_ADDRESS

Choose and document the RTP range used by your installation. The official example forwards UDP ports 10000-20000; that is an example range, not a universal requirement. The range in rtp.conf, the cloud security group and the host firewall must match.

Open only the ports and source addresses required by your design. If all phones use a known office address or VPN, restrict SIP and RTP sources to those networks where practical. Apply the same policy in the VPS provider’s cloud firewall and on the Linux host.

Avoid SIP ALG features on routers and firewalls unless you have verified their behavior. An ALG that rewrites SIP headers or SDP can replace the address Asterisk advertised and create one-way audio even when the firewall appears open.

Diagnose registration, one-way audio and no-audio failures

The phone never registers

• Confirm that Asterisk is running with systemctl status asterisk and that the expected PJSIP modules loaded.
• Check the username, authentication username, password, transport and port in the client.
• Verify that cloud and host firewalls permit the selected signaling protocol from the phone’s source address.
• Increase Asterisk CLI verbosity while rebooting the phone. Look for the REGISTER request, authentication challenge and the response code.
• Run pjsip show endpoints and check that the endpoint name, AoR and contact match the account you configured.

The phone registers but there is one-way or no audio

• Check the NAT settings: local_net, external_signaling_address and external_media_address must describe the reachable path.
• Confirm that the RTP range configured in Asterisk is open as UDP in both firewalls. Registration uses signaling; it does not test RTP.
• Inspect the SDP addresses in the call and verify that the remote phone or ITSP can route to the advertised media address.
• Disable or bypass SIP ALG and retest.
• Test an internal call between two registered endpoints before involving a provider. If internal media works, compare the provider’s codec, NAT and media expectations.
• Capture SIP and RTP diagnostics only after the basic checks; use them to identify whether packets leave the VPS, arrive from the peer and return on the expected ports.

The test extension does not play audio

• Confirm that the endpoint’s allow codec is installed and that both devices have a common codec.
• Check the dial-plan context and extension number exactly; a registered endpoint in the wrong context will not reach 100.
• Review the Asterisk console for missing sound files, syntax errors or a failed channel application.

Use TLS and SRTP for public service

For a public service, prefer TLS signaling on port 5061 and SRTP media whenever every endpoint and provider in the call path supports them. The secure-calling procedure uses certificates, a TLS transport and SRTP. Protect private keys with least-privilege file permissions, renew certificates before expiry and test a complete call after each certificate or transport change.

Do not advertise TLS to clients while leaving only a UDP transport configured. Create the TLS transport, install a certificate chain trusted by the clients, configure the endpoint’s media-encryption policy, and then select TLS/SRTP in the phone. Keep a controlled fallback only if your threat model permits it; otherwise remove unused transports and close their firewall ports.

Best Value

Yealink, Landline Phone, Classic Gray | Bluetooth Connectivity, Ergonomic Design

• Mid-level phone, ideal for professionals and managers with moderate call load
• Ergonomic design with adjustable display
• Built-in Bluetooth, Wi-Fi

$199.00

Buy on Amazon

Harden an Internet-facing Asterisk VPS

• Patch continuously: keep the Linux distribution and Asterisk security updates current, and subscribe to release or security notices for the versions you operate.
• Use strong endpoint credentials: generate a unique, long secret for every endpoint and provider account. Never retain values copied from a tutorial.
• Restrict sources: allow SIP only from office, VPN or provider addresses where possible. If remote users must connect from changing addresses, compensate with strong authentication, TLS and aggressive monitoring.
• Minimize exposed services: expose the Asterisk HTTP or ARI interface only when an application explicitly needs it. Keep SSH restricted to an administration network and use key-based access.
• Layer firewalls: enforce the same narrow policy in the cloud security group and host firewall, including the selected RTP range.
• Install and validate Fail2ban: use a log-based control for VoIP exposed to untrusted networks, but first confirm which PJSIP log source contains failed authentication events. Test that a deliberate failed login creates a ban and that an authorized administrator can remove it.
• Separate privileges: protect configuration files, certificates and private keys so only the service and authorized administrators can read them.
• Limit the dial plan: keep internal testing, outbound routes, emergency services, recording and tenant contexts separate. Review every path that can place a billable call.

Back up, monitor and upgrade the system

Back up pjsip.conf, extensions.conf, other reviewed dial-plan files, certificates, voicemail and any database used by your deployment. Store backups away from the VPS and test restoration on a separate instance; a backup that has never been restored is not a verified recovery plan.

Monitor registration failures, authentication spikes, CPU, memory, disk usage, RTP loss and call quality. If the network supports it, configure appropriate TOS/DSCP values for signaling and media, then verify that intermediate networks preserve those markings rather than assuming they provide priority.

Plan Asterisk upgrades around the supported platform matrix. A distribution upgrade can change compilers or libraries and cause an older Asterisk release to stop building. For source installations, preserve the module selection and prerequisite notes; for package installations, test repository transitions in a staging VPS before changing production.

A practical first-deployment sequence

1. Provision a supported, non-end-of-life Debian or Ubuntu x86 VPS with a documented public or NAT address.
2. Update the operating system and choose package, FreePBX or source installation based on the control and maintenance trade-off.
3. Install Asterisk and verify the service and version.
4. Configure a PJSIP transport, one authenticated endpoint, its AoR and a restricted internal context.
5. Create extension 100 with the hello-world test and verify configuration syntax.
6. Open only the selected signaling and RTP ports in both firewall layers.
7. Register one phone, inspect pjsip show endpoints, and call 100.
8. Register a second phone and confirm two-way audio on an internal call.
9. Correct NAT, RTP and SIP ALG issues before adding an ITSP trunk.
10. Add TLS/SRTP, source restrictions, Fail2ban, backups and monitoring before inviting untrusted users to connect.

This order isolates failures: registration problems are handled before dial-plan problems, and internal media is proven before a provider’s network is introduced. It also prevents an open Internet port from becoming the first test of an unfinished configuration.

Quick Recap

Bestseller No. 1

Grandstream GXP1620 IP Phone | 2 Lines, 2 SIP Accounts | 2.9-Inch LCD Display | Dual-Port 10/100 Ethernet

The phone only works with VoIP; Large phonebook (up to 500 contacts) and call history - up to 200 records

$38.25

Bestseller No. 2

Grandstream Cordless WiFi IP Phone WP826 SIP Phone

Large Color Display: The

$79.66

Bestseller No. 3

Yealink T54W IP Phone - Power Adapters Included

5V/2A Power Supply Included - PoE support; 4.3″ 480 x 272-pixel color display with backlight - Adjustable LCD screen

$139.00

SaleBestseller No. 4

Grandstream GRP2612W IP Phone | 4 Lines, 4 SIP Accounts | 2.4-Inch Color Display | Wi-Fi 5 | Dual-Port 10/100 Ethernet with Integrated PoE

Supports 4 SIP accounts and 4 multi-purpose line keys; Swappable faceplate to allow for easy logo customization

$58.53

Bestseller No. 5

Yealink, Landline Phone, Classic Gray | Bluetooth Connectivity, Ergonomic Design

Mid-level phone, ideal for professionals and managers with moderate call load; Ergonomic design with adjustable display

$199.00

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

AsteriskLinux VPSPJSIPRTPSIPVoIPVPS security