3CX is a popular software-based IP PBX/VoIP system that lets you run a full business phone system on your own server. In this guide, we’ll install 3CX PBX on Debian 12 (Bookworm) using the official 3CX APT repository.
This method is clean, easy to update, and recommended for most production environments.
Prerequisites
Before you start, make sure you have:
A fresh Debian 12 (Bookworm) server (minimal install is fine).
Root access, or a user with sudo.
A static public IP address and working DNS record (FQDN recommended).
Required ports open on your firewall (e.g., 5000/5001, 5060/5090, RTP range).
Step 1: Update System & Install Dependencies
First, update your system and install required packages:
apt update && apt install sudo wget gnupg gnupg2 dphys-swapfile -y
Why these packages?
wget downloads repository keys/scripts.
gnupg/gnupg2 handles repository signing keys.
dphys-swapfile helps with swap on small RAM VPS setups.
Step 2: Add the 3CX Repository Key
Download and install the 3CX public PGP key:
wget -O- https://repo.3cx.com/key.pub | gpg --dearmor | sudo tee /usr/share/keyrings/3cx-archive-keyring.gpg >> /dev/null
This ensures your server only installs 3CX packages signed by the official key.
Step 3: Add the Stable 3CX Repository
Add the official stable repository for Debian 12:
echo "deb [arch=amd64 by-hash=yes signed-by=/usr/share/keyrings/3cx-archive-keyring.gpg] http://repo.3cx.com/3cx bookworm main" | tee /etc/apt/sources.list.d/3cxpbx.list
Step 4: Refresh and Upgrade Packages
Update the package list and upgrade your system:
sudo apt update -y && sudo apt-get upgrade -y --with-new-pkgs && sudo apt dist-upgrade -y && sudo apt autoremove -y
This helps avoid dependency clashes before installing 3CX.
Step 5: Install 3CX PBX
Now install 3CX:
sudo apt install 3cxpbx -y
Step 6: Cleanup Previous Install (If Needed)
If you had a previous 3CX installation and want a clean reinstall:
sudo /usr/sbin/3CXWizard --cleanup
This removes old configuration and leftovers.
Post-Install Tips (Recommended)
Use Stable for production.
Enable backups before major upgrades.
Harden your server:
Firewall rules for SIP/RTP only from trusted sources.
Fail2ban for brute-force protection.
Use a valid FQDN + TLS certificate for WebClient and mobile apps.
That’s it — you now have a fully installed 3CX PBX on Debian 12 using the official repository. From here, complete the wizard, create extensions, add SIP trunks, and configure inbound/outbound rules.
