Restrict incoming and internal calls to certain extensions

Asterisk 1.8.15

I am giving a non-profit public-service organization free space on our PBX and I need a way to isolate their traffic from ours.

I have assigned a block of extensions to them and I need to prevent their extensions from calling our extensions and vice versa.

They are also getting their own dedicated phone lines and I need to insure that incoming calls on their phone lines can only go to their extensions and incoming calls on our phone lines can only go to our extensions. It would be embarrassing, at best, if one of our callers dial an incorrect extension and ended up talking to one of their people.

The POTS interfaces are Grandstream GXW4108 for our incoming lines and GXW4104 for their incoming lines.

I don’t need to restrict outgoing calling. All of our lines are unlimited toll free so it doesn’t matter.

So what is the best way to isolate our activity from theirs?

use 2 asterisk servers?

Seriously? With all that Asterisk can do, it can’t do this??

you could add new contexts for each group of extensions. for example if you had extension ranges 100-199 and 200-299.

exten => _2XX,1,Goto(app-blackhole,congestion,1)
exten => _[*0-9]!,1,Goto(from-internal,${EXTEN},1)
exten => h,1,Hangup()

exten => _1XX,1,Goto(app-blackhole,congestion,1)
exten => _[*0-9]!,1,Goto(from-internal,${EXTEN},1)
exten => h,1,Hangup()

the above would prevent group a from calling group b. However it does not stop a host of other issues that could arise such as call transfer.

unless i am mistaken, FreePBX is not really designed to be a multi-tenant system

Good afternoon, oxon88. Thanks for the info. I don’t know anything about contexts so I guess it’s time to break out my RTFM glasses again. :slight_smile:

When you say “a host of other issues”, what does that mean? I really don’t anticipate that anybody from organization A is going to stay up all night figuring cool new ways to call somebody from organization B, so my main objective is preventing that from happening by accident because somebody dialed the wrong extension.

Note also that the two organizations are going to have separate groups of phone numbers, running on separate Grandstream GXW410x SIP FXO gateways, and I also want to prevent somebody calling in on organization A’s phones from reaching an extension belonging to organization B.


Do you have the different inbound DID’s going to an IVR? If so, the easiest way to setup so that incoming callers are unable to call the wrong company, would be to setup a directory of all of Company A’s users, then a directory of all of Company B’s users, then within the IVR, you can setup “Direct Dial Options” and just select “company A” or “company B”.

As for preventing internal calls from “Company A” to “Company B” or vice versa, just do a simple dial plan setup that… short, incomplete example would be “Company A” is exts 100-199, “Company B” is 500-599.

“Company A” dial plan 1xx <-- Only allows them to dial extensions that begin with 1
"Company B" dial plan 5xx <-- Only allows them to dial extensions that begin with 5

Hope this helps

Contexts are probably something you should have an understanding of. Basically Asterisk uses a context to deal with calls. Each extension will have a default context. This will be the first context any call made from the extension will go into. The default context in freepbx is from-internal.

you would need to edit extensions_custom.conf file and add the two contexts as stated previously. Then in freepbx, change the context on the extensions depending on which group you wanted to put them in.

The only downside will be that there is nothing to stop an extension in one group from transferring a call to an extension in another. similarly, voicemail could be left on extensions from different groups and they could also set up call forwarding to each other.

in terms of incoming calls; all you would need to do is set up the inbound routes for the numbers you have so they go to the correct extensions internally.