Restricting extensions to internal calls only

Overview

There is a requirement to prevent certain extensions from having the ability to make external calls from the phone system; SIPtrix as supplied does not have any settings to allow or disallow external calls, but the underlying configuration can be modified such that this ability can be controlled from within the GUI.

To complete this process, some modification of the underlying configuration files is needed; hence, it would be good practice to take a backup of the system first.

Log into the GUI, and select Tools and Config Edit

Locate the file “extensions.conf” down the left hand side

Scroll down through the file to locate the section titled [from-internal] – (locate this within the complete file rather than using the link on the left)

Highlight the entire section, then move the cursor to the white space below it and paste a copy into the file – ensure that there are blank lines at the top and bottom of this pasted section

Modify the title of this pasted section so that it now reads [from-internal-restricted]

Scroll down through the [from-internal-restricted] section until you reach the line which reads:

            include => from-internal-additional

..and place a semicolon at the beginning of this line (i.e. to comment it out)

Immediately below this line, enter these two lines:

            include => ext-local

include => ext-group

..then scroll down the page to the very bottom and click the “Submit” button to save your changes, close the Config Edit window – no need to click the “Re-Read Configs” link at this stage.

Finally, select the extension, through the GUI, which you want to restrict to internal calls; locate the “context” line under the Device Options heading, and modify it to read

            from-internal-restricted

Submit the changes, then click on the red bar which appears at the top of the browser window to apply the changes onto the server.

You’ll now find that the modified extension can only call internal extensions and groups and not make external calls.

Caveat

What we’ve done here is remove the particular extensions ability to dial out across a trunk, which by definition prevents it making an external call. However this setting affects ALL trunks within the system – if there was a trunk (to another office, for example), it would also be blocked with this method.

Appendix

[from-internal-restricted] as defined within the file /etc/asterisk/extensions.conf – edited and additional lines shown here in bold:

[from-internal-restricted]

;allow phones to use applications

include => app-userlogonoff

include => app-directory

include => app-dnd

include => app-callforward

include => app-callwaiting

include => app-messagecenter

include => app-calltrace

include => parkedcalls

include => from-internal-custom

;allow phones to dial other extensions

include => ext-fax

include => ext-zapbarge

include => ext-record

include => ext-test

;allow phones to access generated contexts

;include => from-internal-additional

include => ext-local

include => ext-group

exten => s,1,Macro(hangupcall)

exten => h,1,Macro(hangupcall)

Modification to an extension to restrict external access