¶ Cloud PBX — Multi-Tenant VoIP Platform
¶ Powered by Sangoma FreePBX 17 / Asterisk 21
¶ Architecture
PSTN / SIP Trunks Internet (SIP clients, softphones)
│ │
▼ ▼
┌─────────────────────────────────────────────────┐
│ SESSION BORDER CONTROLLERS │
│ │
│ pbx-sbc-01 (196.200.0.50) sip.peon.tech │
│ pbx-sbc-02 (196.200.0.51) sip2.peon.tech │
│ │
│ Kamailio 5.8 │
│ • SIP-UDP :5060 / SIP-TLS :5061 │
│ • Anti-flood & DDoS protection │
│ • TLS/SRTP termination │
│ • DID routing per tenant VRF │
│ • Load balancing to FreePBX cores │
└────────────────┬────────────────────────────────┘
│ internal SIP — 10.10.3.x/24
┌────────┴────────┐
▼ ▼
┌────────────┐ ┌────────────┐
│ pbx-core-01│ ◄─► pbx-core-02│ FreePBX 17 / Asterisk 21
│ (active) │ │ (standby) │ Heartbeat HA
└─────┬──────┘ └────────────┘
│
├─ pbx-db-01/02 MariaDB Galera (CDRs, config)
├─ pbx-media-01/02 RTPEngine — G.711/G.722/G.729/Opus
│ UDP 10000–10200
├─ pbx-monitor-01 Homer 7 SIP capture + MOS/jitter dashboard
├─ pbx-fax-01 FusionPBX T.38 fax-to-email
└─ pbx-portal-01 Customer self-service portal (HTTPS/8080)
┌──────────────────────────────────────────────┐
│ NORTHERN VOIP EDGE — Oshakati (OSH) │
│ │
│ pbx-osh-sbc-01 (196.201.0.50) │
│ sip-north.peon.tech │
│ → Keeps northern traffic local │
│ → Saves 700km backhaul per call │
│ │
│ pbx-osh-core-01 FreePBX northern edge │
│ pbx-osh-media-01 RTPEngine north relay │
└──────────────────────────────────────────────┘
¶ Tenant Summary
| Tenant | VRF | DID Range | Status | Note |
|---|---|---|---|---|
| MTC Namibia | TENANT-MTC (64512:200) | +264-61-xxx | ✅ Active | DID block +264-61-400/499 expansion in progress |
| Namib Desert Minerals | TENANT-NDM (64512:201) | +264-64-xxx | ✅ Active | Mining enterprise, Walvis Bay |
| Coastal Shipping Co | TENANT-CSC (64512:202) | +264-64-300/399 | ✅ Onboarded Mar 2026 | Port logistics, accepted Mar 17 |
| Namibia Tourism Board | TENANT-NTB (64512:203) | +264-61-xxx | 🔄 In progress | T.38 fax configuration pending |
Each tenant gets:
- Isolated MPLS VRF (no cross-tenant traffic)
- Dedicated IP pool (172.16.1xx.0/24)
- Self-service portal (pbx-portal-01)
- CDR download and IVR configuration
- Call recording (optional)
¶ VoIP Quality & Codecs
| Codec | Type | Use Case |
|---|---|---|
| G.711 (a/u-law) | Narrowband | PSTN-facing trunks |
| G.722 | Wideband HD | Enterprise endpoints (policy: HD for all enterprise clients) |
| G.729 | Compressed | Bandwidth-constrained branch sites |
| Opus | VoIP/WebRTC | Softphone clients |
QoS: All VoIP traffic marked DSCP EF (Expedited Forwarding) on VLAN 400 across all 12 sites.
Monitoring: Homer 7 SIP capture — MOS alerting triggers at < 3.5.
¶ Recent Incidents
¶ ✅ FreePBX SA-2026-001 (Resolved — March 14, 2026)
CVSSv3 9.8 CRITICAL — Unauthenticated AMI command injection on port 5038.
- Fix: FreePBX 17.0.12
- 22:45 SAST: pbx-core-02 (standby) patched. SIP trunks failed over.
- 00:30 SAST: pbx-core-01 patched. Zero dropped calls.
- AMI port 5038 now requires TLS client certificate. Blocked at FortiGate fw-01.
¶ ✅ MariaDB Galera Replication Lag (Mitigated — March 11, 2026)
NVMe upgrade quote pending. Interim: reduced replica count, monitoring lag threshold.
¶ Service Port Reference
| VM | Service | Protocol | Port |
|---|---|---|---|
| pbx-sbc-01/02 | SIP-UDP | UDP | 5060 |
| pbx-sbc-01/02 | SIP-TLS | TCP | 5061 |
| pbx-core-01/02 | AMI | TCP | 5038 (TLS cert required) |
| pbx-core-01/02 | ARI | TCP | 8088 |
| pbx-media-01/02 | RTP | UDP | 10000–10200 |
| pbx-monitor-01 | HEP capture | UDP | 9060 |
| pbx-monitor-01 | Homer Web | TCP | 9080 |
| pbx-portal-01 | HTTPS | TCP | 443 |