I've been working with bespoke VOIP/asterisk systems for a decade, I have one bit of advice to add - consider toll fraud. Especially for a system accessible fro

I've been working with bespoke VOIP/asterisk systems for a decade, I have one bit of advice to add - consider toll fraud. Especially for a system accessible from the internet. If an attacker can figure out how to make calls through your PBX, they can rack up tens of thousands of dollars in tolls over the course of a night. Most of the integrated FOSS solutions come with fail2ban already configured, it is essential. If you want more peace of mind, a prepaid trunk helps. That means you charge up your sip trunk account, and if someone drains it, it just stops working instead of continuing to drain your bank account. You can also limit international calling on your trunks, which effectively nullifies the financial drain of this kind of attack (though it's still obviously bad if an attacker can access your system in any way)