Advanced System Features

Introduction

Access the Advanced System features of 3CX from your Admin Console > “Advanced”. The Advanced features offer additional security as well as configuration options that may not be needed for all users.

IP Blacklist

The blacklist/whitelist feature allows you to block or allow connections from certain IPs. When a user enters a wrong password more than 10 times or a phone incorrectly registers for more than 5 times, then the IP will automatically be blocked and listed in this blacklist. So if phones or users can no longer authenticate check this list.

Anti-Hacking

This section allows you to fine tune the built-in Anti-Hacking measures protecting from common SIP and Live attack patterns.

Within this section you can ensure that you are participating in the Automatic Global IP Blacklist, a 3CX service that helps protect the whole ecosystem by distributing known attacker IPs to all participating PBXs. You can find more information here.

Console Restrictions

It is wise to block use of the admin console from unknown IP Addresses. You can then enter IPs from which access is allowed. This stops potential hackers from gaining admin access. To configure this:

  • Go to  “Advanced” > “Console Restrictions”
  • Check “Allow Access from specific IP Addresses”.
  • Specify one or more public IPs if you want to access the system remotely.
  • You can also specify your local subnet, e.g. “192.168.10.0/24” to allow access internally.

Network

The network page allows you to configure the default network interface. This is important in case your machine has multiple network cards.

Another important setting is your static public IP. This has to be set correctly. If you have a dynamic IP, 3CX will check your public IP at a regular interval and update it if it changes. During this time your PBX will not function. Therefore we always recommend a static IP.

Allowed Country Codes

The Allowed Country Codes feature filters out numbers dialed in a valid format as per ITU standards, meaning those starting with a "+" or with the international prefix "00" (which is defined under Advanced / E164 Processing). It then matches any blocked country codes based on the list you configure here. Anything else is interpreted as a local number and sent to the outbound rules without a country check. This is a good basic protection but you must also configure this at VoIP provider level in order to have proper protection! Any VoIP provider worth its salt should allow you to configure this.

CID Rules

Create an Inbound Rule based on the Caller ID:

  • Navigate to “Advanced” > “CID Rules”. Select “Add” and enter a name for the rule, e.g. “VIP Customer”.
  • In the “Caller ID” field enter the Caller ID as it appears on the 3CX app screen when getting a call from this number. The caller ID can be a string (that will be matched exactly) example +971 52 914 89 63 or a sequence using a wildcard match () example +971* which will match all UAE numbers. The wildcard can be positioned also before example *559* means all numbers that have a sequence of anything + 5-5-9 + anything.
  • Select a SIP trunk to link to this CID rule and choose where you want to route calls to.
  • You may also use the Import CSV to mass import Caller IDs by simply specifying the Name, Caller ID, Trunk Number and Destination. See an example here of how to import.
  • Click “OK” to create the CID inbound rule.

CID Blacklist

In this section you can blacklist specific phone numbers based on the Caller ID. If you want to block anonymous callers, see this guide. Any numbers in the caller blacklist are not answered/do not ring. If it is a tele-marketer (or someone else you don't want to hear from), a "no answer" scenario is more likely to cause them to "move on" to someone else.

Secure SIP

If you wish to configure secure SIP, follow this guide.

Codecs

Here you can change the Codec priority for calls via the 3CX APPS. This codec priority only affects calls made via the 3CX apps. SIP trunk and IP Phone codecs need to be set separately.

You can specify different codecs depending on whether the app is connected via a mobile network or a Wifi network. We recommend leaving the default priority suggestions. Codecs have varying audio quality and it depends on bandwidth as well as processor.

  • G722 - 16 Khz  - 64 Kbits - average transcoding
  • Opus - 16 Khz - 20 Kbits - processor intensive transcoding,i.e. 1 thread required per 50 endpoints
  • PCMU - 8 Khz - 64 Kbits - not processor intensive at all, easily 300 endpoints per thread
  • PCMA - 8 Khz - 64 Kbits - not processor intensive at all, easily 300 endpoints per thread
  • G729 - 8 Khz - 8 Kbits - More processor intensive but not as much as Opus

Parameters

In the parameters page you can switch on and off a number of options that are not frequently used. Some of these parameters are not supported so only turn on or off if you know what you are doing. The full list is published here.

Templates

In the template section you can create custom templates to be used in the system for:

  • Phone templates - How to to create new custom templates. The variables are documented here.
  • DECT/FXS templates - Similar to IP Phone provisioning however the templates are structured differently as each DECT base station has multiple extensions and so this template has more entries for each extension. You can use the same method and variables.
  • Provider templates - You can create your own VoIP provider templates. Custom VoIP provider templates are not supported and may not work correctly. You can read our guide of what is required of a voip provider here.
  • Gateway templates - similar to VoIP provider templates, Gateway templates are tuned for connecting to VoIP Gateways.
  • Emails templates - Customize emails sent to users. See a how-to guide here.

Fax

3CX includes a fax server for receiving faxes. See information about the fax server here.

E164

E164 is a set of rules that defines telephone numbers. With the 3CX E164 processing feature you can change a dialed number (including numbers with a leading +) into something (a "standard") that can be interpreted by your outbound rules (and your provider).

It can be used for numbers dialed with a leading +, that need to be changed to a different number depending on the call type (local, national, or international). Your provider may not accept the + sign so when a user has stored their contact as +123456 and tries to dial out, the provider will reject the call. E164 Processing automatically converts those numbers to say 00123456 before they are sent out via your trunk. It can also convert a local number from say +44 123456789 to simply 0123456789. Options:

  • Select country: Select the country you are in so the system knows your country code.
  • Remove the same country: When this option is selected and you try calling the same country using the E164 format, the country code will be removed from the called number. Example: Number dialed as +12345678910 will be converted to 2345678910.
  • International Dial Code: If you call a different country using the E164 format then the number will be converted and the international dial code will be added. If you are in the US for example this will be 011. This will enable you to make international calls without the "+" Example: Number dialed as +44123456789 will be converted to 01144123456789
  • Area Code: Here you can add your area code so if you are making calls within your area and the area code is not required then you can strip it. Example: Your area code is set to 813. Number dialed as +181345678910 will be converted to 45678910
  • National Code: If you need to add a national code to make calls then you can add a national code here and it will be prepended to the number. Example: National code set to 8. Number dialed as +12345678910 will be converted to 82345678910
  • Add Prefix: Optionally a prefix can be added which allows you to target a particular outbound rule.  Example: Prefix is set to 2. Number dialed as +12345678910 will be converted to 22345678910

CDR

The 3CX Phone System has an inbuilt CDR Service that is able to log phone calls including a record that can be saved to a file, or pushed to another application instantly via TCP. Here you can enable and configure CDRs. See a how-to guide here.

See Also

Last Updated
This document was last updated on 05 June 2026
https://www.3cx.com/docs/manual/advanced-features/