Outbound Call & IVR System

Overview

A US-based property-management company (Colorado, ~250 residential units under management) needed to replace a tired manual callback workflow. Their leasing office was spending hours every month making the same rent-cycle reminder calls to existing tenants and fielding maintenance callbacks — calls to people they already had a signed lease with, on numbers the tenants had provided themselves.

Built them a self-hosted outbound call and IVR system on Asterisk 20 + PJSIP, bridged into their existing 3CX Cloud PBX. Campaigns originate from Asterisk via the Manager Interface, play a short IVR ("Press 1 to speak with the office"), and hot-transfer the tenant to a live leasing agent — all without the office touching a dial pad.

Scope was strictly to their own tenants on their own contact list, under TCPA-compliant terms documented in writing before build. No cold outbound, no third-party lists.

Key Features

• Asterisk 20 on Debian 12 with chan_pjsip endpoints for caller and agent-transfer targets
• 3CX Cloud PBX bridge — SIP trunk registration to the client's existing 3CX tenant, extensions registered as endpoints
• IVR dialplan with press-1 DTMF transfer to a live 3CX extension; hangup cause-code handling for retry decisions
• AMI-driven campaign runner: leads are picked from a CSV, originated with concurrency caps, and logged per-call
• CDR backend (CSV + MySQL) with billsec and disposition, so the office can audit who was reached
• Virtual-caller loopback mode for safe end-to-end testing without touching the real trunk
• Idempotent install.sh / teardown.sh — env-var driven, no hand-editing of configs on the VPS

Technical Details

• PJSIP transport-udp with external_media_address / external_signaling_address set to the VPS public IP — required on NAT'd cloud instances or registration silently half-breaks
• Per-endpoint rewrite_contact=yes + rtp_symmetric=yes to avoid one-way audio behind NAT
• DTMF mode pinned to rfc4733 — matched against the 3CX trunk settings so press-1 actually registers
• AMI bound to loopback only (deny=0.0.0.0/0.0.0.0, permit=127.0.0.1). Public AMI is a remote-execution surface, not a feature
• 3CX authentication uses the 3CX-issued Authentication ID in the PJSIP username= field — the extension number is decorative, not an auth credential
• Phased deployment: lab install → virtual-caller E2E → 3CX endpoint registration → real-trunk live test → campaign runner with concurrency cap
• Fail2ban rule for Asterisk SIP scanning, firewall restricts port 5060 source IPs to known carrier ranges

Tech Stack

Outcome

The leasing office stopped making reminder calls by hand. The same two staff who used to spend half a day on the rent cycle now watch a dashboard, pick up transfers when a tenant presses 1, and handle nothing else. The stack itself is now a reusable FFULB asset — templated configs, install/teardown scripts, phased runbook, and a QA checklist — ready to drop into the next telephony build without reinventing the NAT traversal and 3CX bridge work.