Categories
VoIP Session border controller SIP proxy Telephony security Asterisk WebRTC gateway FreeSWITCHStars
Forks
Watchers
Developer links
FreeSBC
FreeSBC sits at the edge of your phone system so your FreeSWITCH or Asterisk never has to face the public internet. It is the only element with a public address: phones register through it over SIP on UDP, TCP, or TLS, browsers call through WebSocket with WebRTC terminated at the edge (ICE-Lite, DTLS-SRTP, and RTCP-mux, relayed onward as plain RTP), and carriers reach your switch through it as an outbound proxy, with the switch's private addresses hidden from every SDP body, Contact, and Request-URI it constructs. The switch stays on a private LAN as the registrar and call brain, holding credentials and carrier accounts, while FreeSBC anchors all media on its own ports with hardened first-packet latching and a silence watchdog, and never transcodes. Against the background radiation of SIP scanning, it applies per-IP rate limits with separate limits for carrier sources, scanner fingerprinting with in-memory bans, and admission control for public INVITEs and REGISTER enumeration, and every denial is a silent drop. A multi-switch pool hashes users across switches, and one fixed private socket keeps the trusted side simple. The embedded WebUI, REST API, and Prometheus metrics sit behind a bcrypt-checked admin login, showing live calls and media ports. One static binary, one YAML file, no database, no Redis, and no separate media process to babysit. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.
Benefits
- Your switch stays private
- FreeSWITCH or Asterisk keeps no public IP and no port forward, talking only to FreeSBC over one fixed private socket, while FreeSBC constructs every SDP body so no public party ever sees the switch address.
- One binary, one YAML
- A single pure-Go static binary with zero external dependencies: no database, no Redis, no kernel modules, and no external media process. Configuration is one YAML file and one run command.
- Built-in SIP shield
- Per-IP rate limiting with separate carrier limits, scanner fingerprinting, in-memory bans, and admission control for public INVITEs and REGISTER enumeration, with every denial delivered as a silent drop.
- Browsers call without plugins
- WebRTC from browsers is terminated at the edge with ICE-Lite, DTLS-SRTP, and RTCP-mux, then relayed to the switch as plain RTP, so web softphones join the same system as desk phones and carriers.
Features
- Full SIP transport edge
- SIP over UDP, TCP, TLS, WS, and WSS interworking in front of a private switch, with REGISTER proxying that rewrites Contacts with a routing token while the switch remains registrar.
- Media anchoring relay
- RTP and SRTP are relayed on FreeSBC ports with hardened first-packet latching and a silence watchdog; media is anchored, never transcoded, and no SDP leaks the other leg's address.
- Carrier topology hiding
- Carrier directories resolve by literal IP or DNS SRV, A, and AAAA with caching; inbound calls arrive at the switch carrier port with private addresses hidden.
- Embedded operator WebUI
- A live dashboard with Overview, Config, State, Health, and Audit views, plus a REST API and Prometheus metrics, all behind a bcrypt-checked admin login from the same binary.
- Multi-switch pooling
- Several switches can sit behind one edge with per-user hashing, so calls for a given user consistently land on their switch as capacity grows.