Is it possible to set that an extension that cannot make calls outside (set in outbound route dial pattern) also not be able redirect them outside (e.g. via *72, callerid is being passed instead of the extension number on a forwarded call)?
Can this only be done by changing macros (replace caller id on redirection)?
There are multiple ways to do this.
You should start with the commercial module extension routes.
The problem is that freepbx leaves a callerid from the caller when redirecting, and this cannot be changed. For example, I can deny the extension 100 from calling a mobile phone, but if 100 redirect calls to a mobile phone, the call will still be made because the outbound routes will get the callerid of the caller, not 100. By the way, who should pay for an outgoing call - caller or 100? 100 in my opinion and he should be in cdr.
If your concern is because you are billing calls and you are basing it on the caller ID, you need to work on your billing system.
The call path of a forwarded call will have the information in it at some point.
It’s not about billings. The point is, for example, that if I forbid the extension 101 to make external calls and 101 calls the 100 who is redirected outside, the call will not be made even though 101 is making an internal call.
Ok, I did it using accountcode. This is where I enter the permissions to make external calls and check it in the [macro-dialout-trunk-predial-hook] macro. Works also for forwarded calls. I am using extension routes to allow or deny extension from use of the selected trunk.