3CX V20 deployment guide for Pakistan

How to Set Up 3CX On Premise: Complete PBX and Call Center Guide

Plan, install, secure, and operate a production ready 3CX phone system, connect IP phones and approved voice services, and build a Pakistan based call center that can lawfully call customers in the USA, UK, and UAE.

On premise PBX SIP trunks and DIDs Call queues Grandstream phones

Updated 25 August 2026 By TekkPak Technologies Approx. 16 minute read

Quick answer: what is required to set up 3CX?

To set up 3CX on premise, prepare a supported dedicated server or virtual machine, a static public IP address, a manageable DNS service with split DNS, and a firewall that supports correct port forwarding. Install the current 3CX release on a supported Windows or Debian platform, create users and departments, connect a supported SIP trunk or VoIP gateway, configure inbound and outbound rules, provision phones or apps, then run the 3CX Firewall Checker and complete security, backup, failover, and call quality tests before going live.

Start with architecture

On premise, private cloud, or managed cloud?

The correct 3CX design depends on control, connectivity, internal skills, and business continuity. An on premise PBX is not automatically cheaper or safer. It transfers infrastructure responsibility to your own team.

3CX on premise

Best when you need local control, have reliable IT support, can manage DNS and firewall rules, and want local survivability for extensions and gateways.

Maximum local control

Private cloud 3CX

Best for distributed teams that want a dedicated cloud instance, direct control of backups, and simpler access for branches and remote users.

Flexible multi site access

Managed cloud PBX

Best when the business wants one accountable partner for hosting, monitoring, upgrades, SIP routing, endpoint deployment, and support.

Lower administration burden

Pre installation checklist

3CX on premise requirements

Size the platform for simultaneous calls, recordings, voicemail, reporting, transcription, and future growth, not only the current number of extensions. Confirm the latest supported operating systems and sizing before purchase.

Requirement	Recommended planning decision	Why it matters
Server or VM	Dedicated supported Windows or Debian host, correctly sized from the current 3CX hardware guide	Prevents resource contention and unsupported platform problems
Storage	Allow at least 40 GB for the base system, plus separate capacity for recordings, voicemail, logs, and backups	3CX notes that recorded audio is approximately 1 MB per minute
LAN addressing	Use a fixed RFC 1918 private IP address for the PBX	Stable provisioning, routing, DNS, and firewall rules
Internet edge	Dedicated static public IP, compatible firewall, SIP ALG disabled, and correct NAT	Reliable trunk, remote app, SBC, and WebRTC connectivity
DNS	Manageable DNS with split DNS for the selected 3CX FQDN	The FQDN must resolve internally to the LAN address and externally to the public address
Voice service	Approved SIP trunk, PSTN gateway, or lawful carrier service with enough channels	Determines reach, CLI, DID coverage, call quality, and compliance
Network quality	Business internet, QoS, managed switching, PoE budget, UPS, and an alternate link where uptime is critical	Voice quality depends on latency, jitter, loss, and power continuity
Governance	Recording notice, access controls, retention policy, dial permissions, and fraud limits	Protects customers, agents, data, and the business

Current network baseline: 3CX requires split DNS for on premise deployment and documents SIP ports, the 3CX tunnel, HTTPS, and RTP ports separately. Do not copy a generic port list into your firewall. Use the current 3CX firewall guide, restrict source networks where supported, and verify the result with the built in Firewall Checker.

Implementation sequence

How to set up 3CX in 12 steps

Menu names can change between 3CX updates. The sequence below follows the current Version 20 design and keeps configuration decisions in the order that reduces rework.

Scope and compliance

Document users, sites, numbers, and call flows

Count users, concurrent calls, queues, DIDs, analog devices, branches, remote workers, and recording needs.
Draw normal hours, after hours, holiday, overflow, emergency, and failover routes.
Confirm that the selected carrier and calling method are lawful for the intended traffic and countries.
Assign a System Owner and name the people allowed to administer trunks, recordings, and reports.

Licence and identity

Create the 3CX system and choose the FQDN carefully

Create or access the customer account and add the PBX as an on premise system.
Select the appropriate 3CX edition and simultaneous call capacity for the required PBX and contact center features.
Choose the FQDN and extension length with future growth in mind because changing core identity settings later can be disruptive.
Retain licence ownership, recovery details, and administrative credentials in the customer's controlled records.

Compute platform

Prepare a supported dedicated server or virtual machine

Use the latest 3CX recommended hardware table to size CPU, RAM, and storage.
Reserve additional storage for call recordings, voicemail, logs, backups, and growth.
Use a supported hypervisor configuration if virtualising and avoid unrelated workloads on the PBX host.
Connect the server, firewall, switches, and voice gateways to suitable UPS protection.

DNS and firewall

Configure static addressing, split DNS, and NAT

Assign a fixed private LAN address from an RFC 1918 range.
Create internal and public DNS records so the same FQDN resolves correctly inside and outside the office.
Disable SIP ALG and create only the port rules required by the current 3CX firewall documentation.
For reference, current defaults include SIP on 5060 UDP and 5060–5061 TCP, RTP on 9000–10999 UDP, tunnel traffic on 5090 TCP and UDP, and HTTPS on 443 or 5001 TCP. Your selected ports and services may differ.
Run the 3CX Firewall Checker and resolve every failure before adding production trunks.

Platform installation

Install the current 3CX release

For Debian, download the current 3CX ISO and install it on the dedicated host or supported VM.
For Windows, use the current 3CX installer on a supported Windows platform and reserve storage beyond the minimum installation footprint.
Apply the selected FQDN, licence, networking, and owner configuration during setup.
Set the correct time zone, configure secure email delivery, and confirm system health after the first login.
Do not install third party software or manually modify the underlying operating system in ways that make the platform unsupported.

People and schedule

Create departments, users, roles, and office hours

Create departments that match operational ownership, such as Sales, Support, Accounts, and Management.
Add users with unique email addresses, extension numbers, appropriate roles, and strong authentication.
Set department office hours, holidays, caller ID permissions, voicemail, forwarding, and mobile number handling.
Apply least privilege. Agents, supervisors, receptionists, and administrators should not share an overpowered role.

Carrier connectivity

Add the SIP trunk and route inbound DIDs

Prefer a 3CX supported provider template where available and obtain registrar, authentication, DID format, codec, emergency calling, and CLI requirements from the carrier.
Add the trunk in Admin → Voice & Chat, enter the provider details, and confirm registration or IP authentication.
Enter DIDs in the exact format expected by both 3CX and the provider, normally E.164 where supported.
Assign each DID to a user, IVR, ring group, queue, or other call handling destination.
Test inbound presentation, two way audio, failover, and calls from multiple networks.

Dial plan

Create secure outbound rules

Normalise user dialling to E.164 and confirm whether the provider expects the leading plus sign.
Create rules by prefix, number length, department, or extension group. Put the most specific rules above broad rules.
Send Pakistan, USA, UK, and UAE calls through the correct lawful trunk and apply a second route only where commercial and regulatory terms permit.
Block premium, satellite, or unneeded countries by default and grant international access only to authorised users.
Apply spend alerts, provider credit limits, time restrictions, and outbound caller ID rules to reduce toll fraud.

Endpoints

Provision 3CX apps and supported IP phones

Send each user the secure onboarding link or QR code and have them sign in to the current 3CX app.
For a desk phone, open the user, choose the IP Phone tab, select the supported model, and enter its MAC address.
Use Local LAN or VPN for a local on premise phone. Use a 3CX Router Phone or SBC for remote phones and branches.
Use RPS, PnP, the generated provisioning URL, or DHCP Option 66 as appropriate. Factory reset a previously used phone before provisioning.
Keep phones on 3CX tested firmware. 3CX does not recommend or support STUN provisioning for remote phones.

Call handling

Build IVRs, ring groups, queues, and holidays

Create concise IVR prompts, map choices to the correct destinations, and always include a no input and invalid input route.
Use ring groups for simple team ringing and queues when you need agent login, strategies, SLA measurements, callbacks, reporting, or supervision.
Configure maximum waiting time, destination when unanswered, break and wrap up behaviour, queue announcements, and after hours treatment.
Test every key, language, overflow, and closed route from an external number.

Digital channels

Add CRM, live chat, WhatsApp, and optional AI workflows

Connect a supported CRM integration and test contact lookup, click to dial, journaling, and field mapping with nonproduction records.
Add website Live Chat under Admin → Voice & Chat, select the destination, verify the website domain, and install the generated code once.
Connect WhatsApp through a properly configured Meta business application and assign messages to the correct group or queue.
If using WhatsApp SIP Calling, note that the current 3CX implementation supports incoming WhatsApp calls and requires Meta Cloud API configuration.
Test privacy, consent, escalation, transcript retention, and agent handover before enabling AI assisted customer service.

Go live controls

Harden, back up, test, and document

Enable multifactor authentication, strong unique credentials, IP restrictions, and security notifications.
Schedule encrypted backups to a separate destination and perform a test restore in a controlled environment.
Test inbound and outbound calls, CLI, emergency calling where applicable, IVR, queues, transfers, hold, recordings, reports, apps, SBCs, failover, and power recovery.
Measure latency, jitter, packet loss, and audio in both directions during busy periods.
Document the final dial plan, network diagram, licence owner, backup location, provider contacts, and recovery procedure.

Pakistan to international destinations

Setting up 3CX calls to the USA, UK, and UAE

3CX controls the dial plan, routing, users, queues, and call handling. The SIP carrier controls destination reach, CLI rules, rates, number ownership, and permitted use. Use a lawful provider whose service agreement covers calls originating from your Pakistan based operation.

Agents in Pakistan

3CX apps or supported IP phones connect over a managed LAN or secure remote architecture.

3CX PBX or cloud call center

Outbound rules normalise numbers, apply permissions, choose the carrier, and present an authorised CLI.

Approved SIP carrier

The provider terminates calls and supplies DIDs where available for customer callbacks.

Destination	E.164 dial format	Typical 3CX rule match	Planning points
USA and Canada	`+1` followed by the ten digit national number	Prefix `+1`, with the required total length	Confirm North American CLI, local DID, campaign restrictions, time zones, and any consent or recording obligations.
United Kingdom	`+44` followed by the national number without its leading zero	Prefix `+44`	Confirm geographic or national DID rights, CLI validation, permitted traffic, recording notice, and calling hours.
United Arab Emirates	`+971` followed by the national number without its leading zero	Prefix `+971`	Confirm that the provider lawfully supports the route, caller identity, business use case, and UAE telecom requirements.

Important compliance note: Do not use GSM gateways or SIM banks to disguise or illegally terminate international traffic as local mobile calls. PTA has taken enforcement action against illegal VoIP gateway operations that bypass legitimate international gateways. Use approved telecom services, verify the carrier contract, preserve accurate caller identity, and obtain professional regulatory advice for high volume outbound campaigns.

Use destination DIDs carefully

A USA, UK, or UAE number can improve callbacks and local presence, but it does not remove carrier rules, number ownership requirements, marketing laws, or call recording obligations.

Design for voice quality

Keep packet loss low, prioritise RTP, use wired headsets where practical, and test the complete Pakistan to carrier to destination path during peak hours.

Control cost and fraud

Restrict country access, cap spend, protect credentials, alert on unusual patterns, and block unauthorised forwarding to international numbers.

Customer service and sales

How to configure a 3CX call center in Pakistan

Start with the customer journey, not the queue menu. Define why people call, who can solve each issue, how long they should wait, and what happens when the team is unavailable.

Queues and skills

Create separate Sales, Support, and Accounts journeys. Use suitable polling strategies, agent groups, priorities, and overflow destinations.

SLA and callbacks

Set realistic answer targets, maximum waiting time, wrap up time, announcements, and callbacks so customers are not trapped on hold.

Recording governance

Choose which calls require recording, play any required notice, limit access, define retention, protect exports, and audit playback.

Wallboards and reports

Track calls waiting, abandonment, answer time, talk time, agent status, SLA, and outcomes. Use metrics for coaching, not surveillance alone.

CRM context

Provide verified customer details, contact lookup, click to dial, dispositions, and call journaling while preventing duplicate or excessive data collection.

Business continuity

Prepare alternate internet, power backup, carrier failover, emergency routing, remote agent procedures, and a tested restoration plan.

Practical KPI set: service level, average speed of answer, abandonment rate, first contact resolution, transfer rate, after call work, callback success, quality score, and customer satisfaction. Report the business outcome alongside raw call volume.

Endpoints and legacy connectivity

IP phones, VoIP gateways, and GSM gateways

The gateway category matters. An FXO gateway connects telephone company analog lines to 3CX. An FXS adapter connects analog phones or fax devices to the IP network. These are not interchangeable.

Grandstream IP phones

Choose a currently supported model and 3CX tested firmware. Provision through the user record, use PnP or RPS as appropriate, and place remote phones behind a Router Phone or SBC.

FXO

Grandstream GXW4104 or GXW4108

These 4 port and 8 port FXO gateways connect analog PSTN or PTCL lines to 3CX. Use the correct gateway template and test disconnect detection, tones, caller ID, and inbound routing.

FXS

Grandstream HT adapters

HT series ATAs provide FXS ports for analog telephones and similar endpoints. They are not FXO gateways and do not accept incoming telephone company lines.

SIP

SIP trunks and DIDs

Usually the cleanest option for scalable calling. Confirm 3CX compatibility, channel capacity, codecs, number format, CLI, failover, fraud controls, and local support.

GSM

GSM gateways

Use only for lawful, carrier permitted domestic use cases. A GSM gateway must never be used for illegal international call termination or caller identity manipulation.

PBX

Grandstream UCM6300

A hardware IP PBX is an alternative architecture, not a 3CX server or gateway. Compare support model, applications, integrations, licensing, and continuity before choosing.

Production readiness

3CX security, quality, and performance checklist

Security and resilience

Named System Owner and least privilege roles
Multifactor authentication for privileged users
Unique strong passwords and protected provisioning links
SIP ALG disabled and current firewall rules verified
International dial permissions limited by role
Spend limits and fraud alerts at the carrier
Encrypted off system backups with restore tests
Supported 3CX and phone firmware kept current

Voice and operational quality

Wired network and managed PoE where possible
QoS applied consistently across the voice path
Peak hour latency, jitter, and packet loss measured
Inbound, outbound, hold, transfer, and DTMF tested
Caller ID and E.164 formatting verified per carrier
IVR, holiday, overflow, and closed routes tested
UPS and alternate connectivity tested under load
Dial plan and recovery procedure documented

Performance note: The redesigned page itself is intentionally lightweight. It uses no JavaScript, no remote font import, no scroll reveal observer, no animated blur, and no infinite motion. All desktop card groups contain complete rows, while CSS changes them to two columns on tablets and one column on phones.

Direct answers

Frequently asked questions about 3CX setup

Can I install 3CX on premise in Pakistan?

Yes. A supported on premise deployment requires a suitable dedicated Windows or Debian platform, fixed private addressing, a dedicated public IP for required external services, manageable DNS with split DNS, and a correctly configured firewall. Confirm current 3CX requirements before procurement.

Should I install 3CX on Windows or Debian?

Both supported paths can work. Debian is attractive for a dedicated appliance style installation, while Windows may fit an organisation with established Windows administration. Choose the current supported platform your team can patch, monitor, back up, and recover reliably.

Can a Pakistan based call center use 3CX to call the USA or UK?

Yes, if it uses a lawful SIP carrier or telecom service whose contract supports the origin, destinations, traffic type, DIDs, and caller identity. 3CX provides the PBX and routing. It does not itself grant telecom permission or replace carrier and destination country compliance.

How do I call UAE numbers through 3CX?

Add an authorised provider that supports the UAE route, normalise numbers to the format required by that carrier, commonly E.164 beginning with +971, create a restricted outbound rule, and test caller ID and audio. Confirm UAE and provider rules for the specific business use case.

Does 3CX include call center features?

3CX supports queues, ring strategies, agent login, callbacks, wallboards, reports, recordings, and supervisor functions, with availability depending on the current edition and configuration. Confirm the required feature set before selecting a licence.

Can Grandstream IP phones work with 3CX?

Many Grandstream models can register with 3CX, but automatic provisioning and support depend on the current model and template status. Check the current 3CX supported phone list, use tested firmware, and use a Router Phone or SBC architecture for remote phones.

What is the difference between an FXO and FXS gateway?

An FXO gateway accepts analog telephone company lines and converts them to SIP for the PBX. An FXS gateway or ATA provides an analog extension port for a telephone or similar device. Grandstream GXW4104 and GXW4108 are FXO gateways, while Grandstream HT models are FXS adapters.

Can I connect PTCL landlines to 3CX?

Yes, an appropriate FXO gateway can bridge compatible analog PTCL lines to 3CX. Test local tones, caller ID, polarity or disconnect detection, inbound mapping, and failover because analog line behaviour can vary.

Can I use a GSM gateway with 3CX?

Technically, compatible GSM gateways can connect through SIP, but their use must comply with PTA rules, mobile operator terms, SIM registration requirements, and the lawful purpose of the traffic. Do not use them to bypass legitimate international gateways or disguise traffic.

Is on premise 3CX better than Cloud PBX?

Neither is universally better. On premise offers more local control but requires server, firewall, DNS, backup, security, and continuity skills. Cloud PBX simplifies infrastructure and remote access but depends on hosting design and connectivity. Compare total operating responsibility, not only licence price.

How long does a professional 3CX deployment take?

A small, prepared system can be configured quickly, but production readiness also requires carrier provisioning, DNS and firewall changes, endpoint deployment, call flow approval, security hardening, testing, documentation, and training. Complexity and external provider lead times determine the schedule.

Why does a 3CX call have one way audio?

Common causes include incorrect NAT or port forwarding, SIP ALG, blocked RTP, multiple NAT layers, wrong public IP detection, or an incompatible carrier setting. Run the 3CX Firewall Checker and inspect a test call with the network and provider configuration in view.

Primary references

Sources and further reading

Reviewed by TekkPak Technologies

TekkPak Technologies designs and supports 3CX, IP telephony, Cloud PBX, VoIP gateways, Grandstream endpoints, and managed call center solutions for businesses in Pakistan. This guide is educational. Product menus, licensing, carrier requirements, and regulations can change, so verify the current requirements before implementation.

Discover more from TekkPak Technologies

Subscribe to get the latest posts sent to your email.