FreeSBC sits at the edge of your phone system so your FreeSWITCH or Asterisk never has to face the public internet. It is the only element with a public address: phones register through it over SIP on UDP, TCP, or TLS, browsers call through WebSocket with WebRTC terminated at the edge (ICE-Lite, DTLS-SRTP, and RTCP-mux, relayed onward as plain RTP), and carriers reach your switch through it as an outbound proxy, with the switch's private addresses hidden from every SDP body, Contact, and Request-URI it constructs. The switch stays on a private LAN as the registrar and call brain, holding credentials and carrier accounts, while FreeSBC anchors all media on its own ports with hardened first-packet latching and a silence watchdog, and never transcodes. Against the background radiation of SIP scanning, it applies per-IP rate limits with separate limits for carrier sources, scanner fingerprinting with in-memory bans, and admission control for public INVITEs and REGISTER enumeration, and every denial is a silent drop. A multi-switch pool hashes users across switches, and one fixed private socket keeps the trusted side simple. The embedded WebUI, REST API, and Prometheus metrics sit behind a bcrypt-checked admin login, showing live calls and media ports. One static binary, one YAML file, no database, no Redis, and no separate media process to babysit. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.