VoIP Without a PBX Server: Direct IP Calling for 20 Phones
VoIP without a PBX server is possible: many SIP phones can call each other by dialing an IP address, if the model supports it. At 20 phones, though, a small PBX with auto-provisioning is less work and more reliable.
- SIP phones can call each other with no server by dialing the target phone's IP address, but only if the model has direct IP dialing and it is enabled.
- Direct dialing has no extension numbers, so all 20 phones need DHCP reservations or static IPs or the numbers staff dial will break.
- Without a PBX you lose ring groups, voicemail, paging, BLF, call parking, an auto-attendant and central call logs, and every change must be repeated on each phone.
- A FreePBX/Asterisk box handling extensions 101 to 120 needs very little CPU and can auto-provision all 20 phones through DHCP option 66.
- Keep the system LAN-only: voice VLAN, DSCP 46 for RTP, SIP ALG off, no port forwarding of 5060, and no default admin passwords.
Can SIP phones do VoIP without PBX server hardware?
Yes. A SIP phone is a user agent that can send an INVITE straight to another phone's IP address on UDP or TCP port 5060. No registrar, proxy or login is involved, which is why VoIP without a PBX server works on a trusted LAN.
Two conditions apply. The model must support direct IP dialing, and the option must be switched on. Some phones refuse to place any call until a line is registered to a server, and those cannot do serverless calling at all.
The practical question is not whether it works but whether it stays manageable. Dialing 192.168.10.57 to reach reception is fine for a lab and painful for an office.
How does direct IP dialing work under the hood?
The caller sends a SIP INVITE addressed to sip:anything@IP. The INVITE carries an SDP body listing the codecs offered, the caller's address in the c= line (192.168.10.56 below), and the UDP port where the caller wants to receive audio. The called phone replies 180 Ringing, then 200 OK with its own SDP, and the caller sends an ACK.
Audio then flows phone to phone as RTP to the address and port in the SDP. The port range is set per phone (Cisco SPA models commonly start at 16384), unlike the fixed 5060 for signaling. On a flat LAN nothing blocks this, and no authentication is needed because nobody challenges the INVITE.
The example below is a complete message. RFC 3261 requires Max-Forwards in an INVITE, and Content-Length must equal the SDP body size in bytes (199 here, counting CRLF line endings).
That missing challenge is also the risk: any device that can reach port 5060 can ring your phones.
INVITE sip:100@192.168.10.57:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.10.56:5060;branch=z9hG4bK776asdhds
Max-Forwards: 70
From: <sip:192.168.10.56>;tag=1928301774
To: <sip:100@192.168.10.57>
Call-ID: a84b4c76e66710@192.168.10.56
CSeq: 314159 INVITE
Contact: <sip:192.168.10.56:5060>
Content-Type: application/sdp
Content-Length: 199
v=0
o=- 2890844526 2890842807 IN IP4 192.168.10.56
s=-
c=IN IP4 192.168.10.56
t=0 0
m=audio 16384 RTP/AVP 0 8 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000How do I try direct IP calling on two phones?
Test on two phones before committing. The setting names differ by vendor, but the sequence is the same.
- Check the exact model number and firmware. Cisco SPA-series and 6800/7800/8800 multiplatform phones run SIP. Older 7900-series phones (7940, 7960 and similar) ship with SCCP firmware and need a conversion to SIP firmware, and these are end of life, so do not buy or plan around them.
- Give both phones fixed addresses, for example 192.168.10.56 and 192.168.10.57, as static IPs or DHCP reservations.
- Log in to each phone's web UI, change the default admin password, and enable direct IP dialing. On Cisco SPA phones look for Enable IP Dialing under the Voice settings; on other brands the option is often called Allow IP Call.
- Confirm the dial plan permits IP dialing. On SPA phones you can dial an address using * for each dot, such as 192*168*10*57.
- Dial from one phone to the other and confirm ringing and two-way audio.
- If it fails, run sngrep or Wireshark with the filter sip || rtp from a PC on the same VLAN (port-mirror or hub the switch port to see the traffic).
What do you lose without a PBX?
Direct dialing gives you two-party calls and little else. Everything below is a function of a central server holding state, and a phone alone cannot fake it consistently.
Transfer and hold also behave inconsistently across models, because there is no common server to normalize them. A blind transfer works by sending a REFER, and the receiving phone must accept it and reach the third party by IP.
| Feature | Without PBX | With a small PBX |
|---|---|---|
| Extension numbers (101-120) | None, dial IPs or per-phone speed dials | Dial 3 digits |
| Ring/hunt groups | Not possible | Ring group 600 rings sales together |
| Voicemail | Only if the phone has local storage, which is rare | Per-extension mailbox, email delivery |
| Paging/intercom | Per-phone multicast paging on some models, set by hand | Page group or *80x intercom feature codes |
| Call parking, BLF/presence | Not available or unreliable | Park slots 700-720, lamp fields on every phone |
| Call logs, recording | Local to each phone, small, lost on reset | Central CDR and optional recording |
| Auto-attendant | Not possible | IVR with a time condition |
| Changes (new hire, new name) | Edit up to 20 phones by hand | Edit once, phones re-provision |
Why does direct dialing break down at 20 phones?
The IP address becomes the phone number, so any lease change silently renumbers a person. All 20 phones need DHCP reservations, or static IPs, plus a printed list that someone keeps current.
Speed dials and directories are the usual workaround, but each phone stores its own copy. Adding one new colleague means 20 edits through 20 web UIs. At roughly six to eight settings per phone for the initial setup, that is over a hundred manual entries before anything goes wrong, and each later change repeats the whole round.
A PBX turns this into one config file per phone generated from a template, handed out automatically.
| Situation | Direct IP dialing | Small PBX |
|---|---|---|
| 2 to 5 phones, one room, stable | Reasonable | Optional |
| 6 to 9 phones | Tolerable, painful on changes | Recommended |
| 10+ phones | Poor | Strongly recommended |
| Need voicemail, groups or paging | Cannot do | Required |
| Staff turnover or moves | Every change x N phones | One edit |
What is the simplest PBX for 20 phones?
For internal-only calling, a PBX is a small program. Twenty extensions with no trunks use a trivial amount of CPU and a few hundred MB of RAM. A mini PC, a small VM or even a Raspberry Pi-class board can run it.
Realistic choices are FreePBX on Asterisk (free, web GUI), 3CX (free tiers exist but license terms change, so confirm current limits), or a Yeastar-type appliance if you prefer a boxed product. FreePBX with extensions 101 to 120 is the approach shown here.
On FreePBX, create each extension in the web GUI under Applications > Extensions (chan_pjsip driver) and click Apply Config. FreePBX then writes the PJSIP configuration itself, into generated files such as /etc/asterisk/pjsip.endpoint.conf, pjsip.auth.conf and pjsip.aor.conf, which are included from pjsip.conf. Do not edit those generated files by hand: FreePBX overwrites them on the next Apply Config. Put manual overrides in the matching *_custom.conf files, such as pjsip.endpoint_custom_post.conf.
The first block below shows what one extension looks like in plain Asterisk syntax, so you can read what FreePBX generates. Setting direct_media=no keeps RTP flowing through the PBX, which avoids one-way audio when phones sit on different subnets or VLANs. In FreePBX this is the Direct Media option in the extension's Advanced tab.
Auto-provisioning is the real time saver. Give DHCP option 66 so phones fetch their config from the PBX or a small web server, then each phone reads a per-MAC file. The DHCP example below uses dnsmasq; the same options exist in any router or Windows DHCP server.
FreePBX's Endpoint Manager module is a commercial add-on for generating phone files, so check what your version includes. A hand-written template, one XML file per MAC, also works for 20 phones.
; Plain Asterisk pjsip.conf syntax, for illustration only.
; On FreePBX, create the extension in the GUI instead; hand edits to the
; generated /etc/asterisk/pjsip.*.conf files are overwritten on Apply Config.
[101]
type=endpoint
context=from-internal
disallow=all
allow=ulaw,alaw
direct_media=no
auth=101-auth
aors=101
[101-auth]
type=auth
auth_type=userpass
username=101
password=UseALongRandomSecret
[101]
type=aor
max_contacts=1
; dnsmasq DHCP reservation + provisioning URL
dhcp-host=00:11:22:33:44:55,192.168.20.101,phone101
dhcp-option=66,"http://192.168.20.5/provision/"
; Cisco SPA profile rule style
; http://192.168.20.5/provision/$MA.cfgHow do I secure and troubleshoot a LAN-only phone system?
Put phones on a voice VLAN (for example VLAN 20) and let the switch advertise it through LLDP-MED or CDP. Power them with a PoE switch or injectors. Mark RTP as DSCP 46 (EF) and SIP signaling as CS3 or AF31, and turn SIP ALG off on every router, since it rewrites SIP headers and is a classic cause of one-way audio and dropped calls.
Do not port-forward 5060 or the RTP range. Change the admin password on every phone, set firewall rules so only the voice VLAN reaches the PBX on UDP/TCP 5060 and UDP 10000 to 20000, and keep management web UIs off other VLANs.
The table maps common symptoms to fixes. To see what is actually happening on the PBX, use the commands after it.
| Symptom | Likely cause | Fix |
|---|---|---|
| Phone does not answer IP dial | Direct IP dialing disabled, wrong dial plan, or the model needs a registered line | Enable the option, test with *-dotted format, verify firmware is SIP, not SCCP |
| Fast busy or 404/403 | Target not registered (PBX) or call rejected by ACL | Check the extension and IP, then the device's allowed-caller setting |
| 408 Request Timeout or no reply | Firewall, wrong VLAN, or the phone is off | Ping and capture SIP; allow UDP/TCP 5060 between VLANs |
| 480 or 486 | Phone unavailable or busy (DND, call waiting off) | Check DND and the line's busy setting |
| One-way audio | RTP blocked, SIP ALG on, wrong address in SDP, or direct_media=yes across VLANs | Open UDP 10000-20000, disable ALG, set direct_media=no |
| Call connects then drops after about 30 seconds | ACK or 200 OK lost, often NAT or ALG | Check the capture for retransmitted 200 OK |
| Garbled or no audio | Codec mismatch | Use G.711 ulaw/alaw only; no transcoding needed on LAN |
| DTMF not working in menus | Mismatched DTMF method | Use RFC2833 (telephone-event) on phones and PBX |
asterisk -rvvv
pjsip show endpoints
pjsip show contacts
pjsip set logger on
rtp set debug on
core show channels
# from a shell: watch SIP flows live
sngrep -d eth0 port 5060Common questions
Do I need a PBX for internal calls?
Technically no, since SIP phones can dial each other by IP. In practice you need one once you want extension numbers, voicemail, ring groups or central changes, which happens quickly with more than about 5 to 10 phones.
Can IP phones call each other if they are on different subnets?
Yes, as long as routing or firewall rules allow UDP/TCP 5060 and the RTP ports between the VLANs. Many one-way audio problems after splitting a network come from a rule that permits SIP but not the RTP range.
Can I set up an intercom between IP phones with no server?
Some models support auto-answer on a specific call or multicast paging configured on each phone, and this works for simple one-way announcements. It has to be set on every phone by hand and cannot give you page groups or consistent behavior across mixed models.
Will 20 phones overload a small PBX?
No. Internal calls with G.711 and no transcoding need very little processing, so a modest mini PC or VM is plenty. Transcoding and call recording are what raise load, and you can avoid both on a LAN.
What if my phones are old Cisco 7900 models?
Check whether they run SCCP or SIP firmware. SCCP firmware cannot dial by IP in the SIP way, and conversion to SIP firmware is possible but the models are end of life, so replacing them is usually the better investment.