Since it seems like you still might be lost, let me give you a bit more detail.
Every SIP device (phone and FXS Gateways (aka Analog Terminal Adaptor)) has a dial plan. The “dial plan” tells the device which phone numbers the device is allowed to dial, which phone numbers the device is not allowed to dial, and how quickly to send the call out and how long to wait for the user to dial another number before deciding that he’s done dialing. These settings are made at the level of the hardware, and have nothing to do with FreePBX or Asterisk. When a call doesn’t match the dial plan, the call is never sent from the device to the FreePBX/Asterisk server.
So, for example, all dial plans in North American (or places using NANPA) should allow the dialer to call 911, and should immediately send the call out without waiting for additional digits after the final “1” has been dialed. The Dial Plan allowed would generally be written “911,” but can sometimes also be written as “911S0” or “911T” depending upon the syntax used by the company that makes the device.
For trusted users in a corporate environment, you might also allow calling 411, 611, 811, etc. Sometimes, you’ll just write the plan as “X11” or “N11” to allow all of those calls with a single rule. X usually refers to 0-9, while N usually refers to 2-9, but that depends upon the device. So, N11 would allow the device to call 211, 311, 411, 511 . . . 911, etc. Sometimes, devices use lower case “x” instead of upper case “X.”
You’ll also want to allow and send calls out immediately if the user dials 1 + an area code + a phone number. Often, that would be written as “1NXXNXXXXXX,” but again, it depends upon your manufacturer. You could also write it as “1XXXXXXXXXX.” That would work as well, but would allow people to call nonsense numbers like “10550551234.”
Often dial plans use the period (.) for repeated entries. And some manufacturers allow you to add a timeout designator to the end of the dial plan, i.e. “011X.S3” might allow the user to to dial 011 + any digit + to repeat any digit as many times as they want until 3 seconds go by without any dialing whatsoever. This is how you generally allow international calls. You have to use the repeating character (.) because international numbers do not have a uniform length. The number of digits required to call London is different than the number of digits required to call Norway.
To make matters more confusing, some manufacturers have a separate setting as to what to do with calls that don’t match the dial plan. Polycom, for example, allows you to set your devices to allow any call to go through after a timeout even if the they don’t match the dial plan. That settings would ruin your plan, so you’ll want to watch for it. Aatra/Mitel has the ability to allow a non matching number, but does so by adding “xx.” to the end of the dial plan.
But, generally speaking, you could accomplish what you want using the dial plan on the ATA/FXS Gateway, For example, you could make all the room to room extensions start with 2, and all the allowed extensions start with 4, and then set the dial plan to something like:
“4XXX|911”
The above (or something like it), on most devices, will allow the device to only call extensions starting with 4 and that are four digits long, and also to dial 911. Also, make sure that the device won’t send calls that don’t match the dial plan.
And again, you could also just use the method I proposed earlier. That method addresses your issue on FreePBX/Asterisk server side. The custom context method also addresses your issue on the FreePBX/Asterisk server side, and is the more “proper” way of doing so, but requires you to do outside of the GUI.