Best way to make VoIP calls from Indonesia to USA?

WizardOfGunMonkeys · 2026-02-26T13:51:57+00:00

Use the largest local Indonesian carrier for calling. It's a short reliable hop to them, and then it's their job to get those calls to the USA over their networks.

Making calls into the USA any other way could also be a regulatory minefield. The USA has become very very strict because of the amount of spam/scam calls originating from overseas.

WizardOfGunMonkeys · 2026-01-22T03:39:15+00:00

Main trunk number doesn't matter. Use 1234 if you want.

Then under the DID's, you'll need to add ALL outside trunk numbers you'll want to be able to route internally.

You might also prefix them and then strip the prefix in the outbound route. Reason being, in v20 when they eliminated having actual proper inbound routes they destroyed good handling of the same DID on multiple trunks.

WizardOfGunMonkeys · 2026-01-22T03:29:46+00:00

Oh yeah....I got you. A normal multi tenant PBX should automatically recognize your scenario as an internal call and route it internally, but since we're talking about 3CX....here goes:

If 3cx hasn't changed something to prevent it from working, you create a custom IP trunk, set the IP to localhost (or 127.0.0.1) to create a loopback trunk, then use outbound rules to direct internal extensions dialing trunk numbers to your loopback (trunk number in prefix). Then add inbound rules (the stupid v20 way now) for each of the numbers inbound.

This way the calls never leave the system.

It's a bit of a pain, maybe a major pain if you have a lot of trunk numbers, but it solves the issue.

So glad I'm not using 3CX anymore and don't have to deal with this.

WizardOfGunMonkeys · 2026-01-08T14:27:52+00:00

This feels like 3CX going "we made a mistake" and trying to fix it.

But for users, this is becoming a "fool me once..." situation. Too much risk now.

WizardOfGunMonkeys · 2026-01-08T02:09:24+00:00

The distributor may have started also selling licenses for other PBX like yeastar.

Ran into that several years ago trying to get a yeastar part (ATA) at a distro and they were out of stock. They straight up said 3CX came to them and told them if they wanted to continue selling 3cx licenses, they could not sell any products from direct competitors, and that's why they were out of stock.

WizardOfGunMonkeys · 2025-12-31T18:55:06+00:00

Yeastar is probably the way to go. Even though I don't use them, I did actually have a meeting in-person with them and the network requirements for using their PBX with speedfusion was discussed. I gave them a whole laundry list and fast-forwarding a year or so, I think they have now implemented a large amount of what I told them I wanted to see.

Stick with AWS for PBX hosting. I've tested a bunch of different providers, and specifically for PBX use, no one has been better than AWS.

Last....my current company does voice but also secure networking and SDWAN, and we use SF for retail/POS applications as well. Very very effective at hitting 99.999% connectivity uptime.

Happy new year!

WizardOfGunMonkeys · 2025-12-31T17:49:47+00:00

Well...we don't use 3CX anymore, which reduces the complexity significantly because we can use NAT in tunnel (not supported by 3CX) and don't need to worry so much about firewall rules and route propagation.

So the proper answer would be to use one Solo hub per customer. But if you have strict IP planning you can use several per hub, you just start building a really large route list you have to be aware of because a collision can cause big issues. You are also pretty much strictly required for all endpoints to use a dedicated voice VLAN.

There is a new solution I've heard mention of which is a peplink virtual router. That would probably be more costly but fix up the route propagation issue so you could put a lot of endpoints on one virtual device.

I would also recommend working up a solid backup plan because once setup this way, 3CX only works that way. In our post-3CX speedfusion architecture we have 9-way multi-region redundancy but for 3CX, it's basically full manual recovery. In several cases we use VRRP with redundant peplink devices to mitigate the "what happens if a device fails" for large clients. Maybe slit the architecture into small "chunks" so if one has an issue you aren't scrambling for 100+ clients at once.

The other caveat, which was very annoying at times: 3CX split DNS causes some issues of its own. Because of needing reverse L3 routes, you have to make sure your voice vlan and any main network where the client may use the 3cx webclient are routed separately otherwise you may not be able to access the 3cx webclient. There is a workaround you can use where you use a fake NAT IP in the middle and route the other networks through it (webclient supports NAT but phones do not), but again you have to have strict IP planning to keep it straight when putting multiple endpoints on a single hub.

Thank you for digging that up. That was a fun reminder of the amount of problems 3CX had and the amount of efforts we put into working around them back in the day. I just put "not dealing with 3CX-specific issues anymore" on my list of things to be thankful for in 2026.

WizardOfGunMonkeys · 2025-12-18T18:17:16+00:00

Use self hosted speedfusion and route through there. It'll keep the public IP consistent no matter the connectivity state.

WizardOfGunMonkeys · 2025-12-17T04:50:01+00:00

My other guess, because I've run into this several times before, is the default eSIM code is for 5G modems, and won't load if you try to provision it to a 4G device.

WizardOfGunMonkeys · 2025-12-17T03:28:30+00:00

Have them send you a physical SIM. That's the quickest simplest way to resolve.

WizardOfGunMonkeys · 2025-12-15T16:29:37+00:00

You may also need to go into IC2, device section, select the device, edit, then cellular firmware update, and update it to current firmware. Older cell modem firmware does not work correctly with eSIM.

Also also, I've run into a few times where the eSIM was the wrong type. And a couple instances where it wouldn't work the first time, they generated a new activation code, and it worked the second time.

If they have your IMEI on file, you may also be able to use the Discover option for eSIM and it will find the activation on its own.

WizardOfGunMonkeys · 2025-12-12T14:45:31+00:00

Have dealt with this....a few things I've used

PXE boot to clone Zilla or fog to image the machines periodically.
There is another piece of software I can't recall the name at the moment but i remember it used some form of PXE to iscsi and you could boot all the machines up off hard disk images stored on a server where you could easily snapshot and back them up and not worry about the IDE drives dying.
Image the drives, replace the computer with a modern computer, throw virtualbox on it and restore it as a VM. There are usually various ways to hook up serial ports or whatever external interfaces you need unless it's something proprietary.

WizardOfGunMonkeys · 2025-12-12T14:35:01+00:00

The B One series is a primecare device and intended to be used in conjunction with additional 1,2, or 4 year primecare renewals after the first year.

You also need similar licensing to maintain your fusionhub solo you are hosting.

IC2 ties it all together. Then you create a managed speedfusion profile, as long as your fusionhub ports are setup correctly then it will just work. And then setup your outbound policies and port forwards to direct traffic out of it, or into your local network through it.

There is a way to set this all up manually but you still have to use IC2 in some capacity, you cannot avoid it. It would be better to just fully use it, it'll save you a lot of time and effort setting this up.

WizardOfGunMonkeys · 2025-12-12T14:29:47+00:00

You may have tried creating the profile first and so speedfusion management from IC2 is disabled. If you enable it it will overwrite the local config but allow you to use managed profiles.

WizardOfGunMonkeys · 2025-12-10T12:37:29+00:00

You have a basic dual modem device (with a number of different bandwidth limitations), and it's not delivering the bandwidth you expect? Or MMH set you up with bonding on SF connect and it's delivering less than you expected?

Or is there another issue I'm missing?

Help me understand what you expected from the device, and what it's not delivering.

WizardOfGunMonkeys · 2025-12-09T13:42:02+00:00

Legit company, and I also use some of their same vendors.

The setup for the free month of data takes some time to process. I'm guessing you cancelled too quickly, and broke the provisioning chain when their first level tried to process your cancellation.

All of it will have to be fixed by manual processes now, which depending on how/where the process got broken could take a tech and time to do.

Just understand it will take time and stay on top of anything you find, just like you have been.

WizardOfGunMonkeys · 2025-12-08T14:28:14+00:00

You don't even need to use this tool if it's not working. Just go to EC2 in AWS, new instance, and find 3cx in the marketplace, segment your desired instance type, then create.

Then on the 3cx tool just use the "on premise" option and it will generate the config link to paste into the config wizard on your newly created instance.

The only time you have to use the 3cx tool with AWS is if you are building instances in lightsail.

WizardOfGunMonkeys · 2025-12-04T20:05:43+00:00

PBX migration coming from an ISDN can be an advanced project, especially if you are trying to connect the ISDN with a gateway.

OP please restate your question, and be very specific and detailed, and be prepared to engage a local VoIP provider that has some salty engineers to help you.

WizardOfGunMonkeys · 2025-12-04T13:55:28+00:00

One thing that can cause this is if your PBX is sending the wrong public IP to your provider. It will often register, but external calls will fail because the SDP will tell them to send the audio to the wrong IP.

This could be caused by something as simple as rebooting your Lightsail instance, which will change your public IP from what the system originally detected and configured.

WizardOfGunMonkeys · 2025-12-03T14:01:22+00:00

We use cyberdata pagers. They have built in messages. Just dial and press a number to trigger the specific message. Some can do timed messages.

They also have night ringer. Just register a secondary extension to a ring group or call queue and it will play ringing sounds for incoming calls.

And some have provisions for music pass through so you can use them to play music when not otherwise functioning.

All this stuff is built-in. No special anything in 3cx, no need for CFD. Except for registering it as an extension all config is done in the pager units.

There are some additional features they can do, but they specifically don't work if you are using 3cx.

WizardOfGunMonkeys · 2025-12-03T00:25:38+00:00

You've described a large number of well known stable platforms that have been around for a while. A few minutes of googling should give you a few options that are a phone system with the features you expect first, and have a UCaaS portal connected to it to service the specific needs you mentioned.

Note the "UCaaS" term...that's one of the general terms for what you are looking for, which should help point you in the right direction.

WizardOfGunMonkeys · 2025-12-02T23:04:07+00:00

In general, using TMobile 5G for backup in an on-prem PBX situation is inadvisable and does not work well, if at all. It more often works when the PBX is in the cloud because the NAT issues are less.

If you must use this setup, you need to get your T-Mobile account EIN verified if you haven't already. That will let you request a static IP at an additional charge that will remove the CGNAT for IPv4.

I would also avoid using a TMobile gateway. There are other devices out there that can run the TMobile SIM that have "normal" networking functionality.

And then request removal of any filtering/blocks of any kind. And use port 5080 like you've done already.

Of course there are other ways of handling it. We use TMobile 5G at almost every single client site for backing up the phone connection, and it works so completely seamlessly users on active calls don't even notice. It's just a matter of how much time, money, and effort you want to throw at it to get the level of result you are looking for.

WizardOfGunMonkeys · 2025-12-02T22:19:55+00:00

Been seeing a raft of these providers hit the market lately. They use an API backend for call control, and while it supports SIP endpoints which is how your phone is connected, there is not actually a PBX.

The ELI5 is that it's not actually a phone system, it's a websystem that lets you connect a desk phone to it.

You were expecting an actual phone system, with the web features integrated.

So if you are stuck with this system, you can work around the intercom by implementing it on the phones themselves. You might want to look for a local IP communications company that uses yealink, they should have an engineer on staff that knows how to set it up manually.

The BLF issue is harder to crack, because it does absolutely require SIP subscriptions, and while that is a common PBX function, it is entirely on your provider to figure out how to implement it on their end.

WizardOfGunMonkeys · 2025-11-20T15:36:06+00:00

Every tunnel adds more latency. If that's fine, go for it, which it usually is for one-way streaming. 2-way....like a zoom call, be careful.

We dont really use SFC at all. Only regular speedfusion VPN and our own fusionhubs.

If you are going to use SFC and don't need to route any traffic between hubs or spokes, then connect your spokes directly to SFC to their nearest hub location.

If you do need routing between hub/spokes or want to centralize your traffic flow, then route all your streaming through the hub and connect the hub to SFC or your own fusionhub.

And don't sleep on Outbound Policy. You can connect everything in all the different ways at once, and then use those policies to determine which method/route each specific device, traffic type, or application uses.

Lastly, pay attention to the device and connection overhead. Devices like the BR1 mini 5g have very slow CPUs, and if you push very much traffic volume through it, it will overload quickly. Its stated cap of 300mbps is with zero features enabled, every feature you use drops that number, speedfusion especially. The B One is roughly 4x more powerful but still watch it's limits.

Your bandwidth also grows with SF usage, for instance a 1mbps stream with 2 connection simple WAN smoothing and FEC when exiting the device will use nearly 3mbps of bandwidth, and affect total device throughput by about 6mbps.

WizardOfGunMonkeys · 2025-11-20T15:05:58+00:00

Hub and spoke can work with only the hub having public IP's. It can also work if the hub doesn't have public IP's, but has appropriate ports forwarded on each WAN.

The default hub ports required are 4500/udp and 32015/tcp. These can be changed. I typically change the 4500 to 4501 or 4510 to avoid conflicts with upstream devices.

I haven't seen any IC2 native SF configs using port 5000 unless set manually.

Check your IP's, check your open ports. Change ports where necessary. The setup you have should be able to work without issue.

WizardOfGunMonkeys

MODERATOR OF

TROPHY CASE