FreePBX outbound restrictions and emergency routes

Start with allowed destinations

Define which roles need internal, local, national, international or premium destinations. Apply least privilege to shared and remote endpoints. A strong extension password does not limit the bill when a valid credential is misused.

Document emergency-service routing with the provider through its approved validation process. Ordinary calling restrictions must not accidentally shadow the intended emergency route; location and callback identity remain separate requirements.

Review the complete route choice

For a test number, follow the dialed digits, any prefix removal or prepending, route ordering and selected trunk. Then check caller identity and the carrier’s allowed destination policy. More than one layer can reject the same call.

Do not fix a single failed destination with an unrestricted catch-all route. Use the installed FreePBX permission mechanism and record any commercial-module dependencies instead of implying every edition offers identical role controls.

Test allowed and denied examples

Use approved test destinations representing each permission class. Confirm an allowed call reaches the expected trunk and a denied call fails at the intended boundary. Include a forwarded external call: forwarding may create another outbound leg with a different identity and policy path.

For failures, preserve the normalized number and responding system. A carrier 403 is not proof that the extension’s password is wrong. Compare outbound route troubleshooting.

Monitor exceptions

Review unusual destination, duration and concurrency patterns with spending limits where the carrier supports them. Assign an owner for temporary permissions and revoke them when the job ends. Keep the provider’s emergency arrangements documented with emergency calling considerations.