Forward Calls with PIN Entry


First post here - I hope someone can help with something I am trying to achieve.

We operate an IT Helpdesk service here and as part of this there is an out of hours call-out service. Currently, this is selected from the out of hours IVR, however we would like to put a PIN control on this so that callers can only use it if they have a valid PIN number from us. We currently have the out of hours ivr option set so that it rings an extension that has follow-me enabled to the mobile number of the team member on call.

So the logic would be…

  • Customer calls in on the ddi number - 01xxxxx8700
  • IVR plays greeting
  • Customer chooses Option 8 for Out of Hours Support
  • System diverts to the extension with the follow-me enabled (8750)
  • System detects that a PIN is needed so prompts for the PIN to be entered
  • On successful PIN entry, the call is routed to the follow-me number

I have already created a new Outbound Route for the call to prompt for a PIN Set and created PINs accordingly. I have the phone of extension 8750 next to me and if I try to make an outbound call it does indeed prompt for the PIN from it before I am able to connect the call. So it works fine.

HOWEVER, if you link extension 8750 to option 8 on the IVR, when that is pressed, the call goes straight to the follow-me number and does not hit the PIN check first.

I have tried experimenting with different CIDs in the Outbound Route in case that is related but it is not making any difference. Have also enabled COS (we have the module) and set that in place, but again it’s not helping - that just sends the call into a big black hole…

What have I missed in the set-up and what can I do to get the PIN control in before the number is called?

Thanks in advance for any pointers.


Tim Watts

As far as I understand, the FreePBX PIN’s does not work as you want to.

When you are trying to place a call from internal it’ll ask you for a PIN, but it won’t work with FollowMe, Ring Groups or Queues that have an external number to call.

In order for you to achieve this, you will need some custom code.

Create a custom destination that points to pin-check-custom,s,1 set Return to yes, and point it to the IVR.

Then add the following in extensions_custom.conf

exten => s,1,Answer
exten => s,n,Read(pin,enter-password) ;asks for pin
exten => s,n,Playback(you-entered) ;will playback what they entered
exten => s,n,SayDigits(${pin}) 
exten => s,n,Read(digi,if-correct-press&digits/1&otherwise-press&digits/2,,1) ;asks to confirm the entry
exten => s,n,ExecIf($["${digi}"="2"]?goto(pin-check-custom,s,1)) ;if pressed 2 it will start over
exten => s,n,ExecIf($["${pin}"="1234"]?goto(from-did-direct,8750,1)) ;pin 1
exten => s,n,ExecIf($["${pin}"="4321"]?goto(from-did-direct,8750,1)) ;pin 2
exten => s,n,ExecIf($["${pin}"="5678"]?goto(from-did-direct,8750,1)) ;pin 3
exten => s,n,Playback(sorry-youre-having-problems&you-will-be-transfered-menu) ;If pin is invlid it'll return to IVR
exten => s,n,Return ;Back to IVR

Now, point option 8 to this custom destination.

I entered 3 pins, you can enter more. Or you can get this to lookup if the pin matches with a database table.

you can also use your custom recordings if you don’t like the system recordings.


exten => s,n,Playback(custom/your-recording-name)
1 Like


Thanks for the response - most useful.

You mention above using a Database table to look the pins up? That would be better, and we have already created a Pin Set for the Pins we want to use.

How would we link our check into that instead?

Thanks in advance.


Tim Watts

I don’t know where it stores the details.

Perhaps someone else here does know… Or, try to search.

FreePBX uses the Authenticate application to check PINs. Close to what @PitzKey said but it would look a little more like this

exten => s,1,Authenticate(/path/to/pass/file,m)
exten => s,n,GoTo(findmefollow,8750,1)
exten => s,n,Return()

Authenticate will look at the file for the password you want to match. The list would contain a list like


You can store all your passwords there. You could also use the AstDB for this as well.

1 Like

You can use the built-in pin sets with FreePBX to auth the inbound as well.

exten => s,1,Wait(2)
exten => s,n,ExecIf($["${DB(AMPUSER/${AMPUSER}/pinless)}" != “NOPASSWD”]?Authenticate(/etc/asterisk/pinset_7,a))
exten => s,n,Set(__PINNUMBER=${CDR(accountcode)})
exten => s,n,NoOp(Pin number is ${PINNUMBER})
exten => s,n,Goto(ivr-3,s,1)

Where the pinset_# matches the pinset ID in the GUI.

The builtin pin sets are for outbound/user based calls to restrict users. They cannot be called about by a destination or routed to. There is nothing in the Inbound Route or IVR options to force an external caller to use those pin sets.

The best that can be done with that the pin sets can be built in the GUI but the Inbound Route/IVR is still going to have to point to a Custom Destination and custom dialplan to pull that.

Yes, a custom destination and the code I provided in a context in extensions_custom.conf is needed.

Hi all,

We have now implemented this based on the original posting suggestion - it actually works really well.

We do occasionally have to update the PIN codes, but it’s just a line of code now instead of a pin entry.

Thanks to all for their responses and getting us working as we hoped.


Tim Watts

1 Like

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.