Installation

VoicerOnePBX ships as a signed, notarized macOS application — install it like any other app and launch it. The work that matters is around it: opening the right firewall ports, and (optionally) setting up DHCP and TFTP so phones provision themselves with zero touch.

Before you start

Give the Mac a static LAN IP (or a DHCP reservation). The PBX advertises this address in SIP/SDP, so it must not change. A wired connection is strongly recommended for a phone system.

Installing the application

  1. Copy VoicerOnePBX.app to /Applications and launch it. Because the build is notarized, Gatekeeper opens it without warnings.
  2. On first launch, grant the microphone and (if you use them) speech-recognition permissions when prompted — these power call audio and on-device transcription.
  3. Complete the setup wizard: company name, default area code, and the network interface to bind.

Firewall requirements

VoicerOnePBX listens on the following ports. On the LAN side these must be reachable from your phones; the trunk/SIP ports must be reachable from your provider (usually outbound registration keeps a NAT pinhole open, so you rarely need inbound port-forwards for a registered trunk).

PortProtoPurposeWho needs it
5060UDP/TCPSIP signalling (extensions & SIP trunks)Phones on the LAN; SIP provider
5061TCP/TLSSIPS — SIP over TLSPhones/trunks using TLS
20000–40000UDPRTP — the voice audio itself (many ports, picked as needed)Phones on the LAN; provider media
4569UDPIAX2 signalling and media (single port)IAX2 provider
8080TCPProvisioning HTTP server (phone config files)Phones on the LAN
8084TCPWeb client HTTP / WebSocket (softphone, supervisor, agent, conference)Browsers on the LAN
8085TCP/TLSWeb client HTTPS / WSS — required for browser mic/cameraBrowsers on the LAN
69UDPTFTP — only for Cisco 79xx provisioningCisco phones on the LAN
8090TCPDigital-signage wallboard protocolWallboard displays (optional)
macOS firewall & RTP

If the built-in macOS firewall is on, allow incoming connections for VoicerOnePBX. The wide RTP range (20000–40000) is normal for a PBX — each call leg uses a pair of ports from this pool.

Locking it down

The provisioning and web ports trust the LAN. For anything beyond a flat trusted network, put your phones on a dedicated voice VLAN and restrict the provisioning port to it. VoicerOnePBX also has a built-in provisioning source-IP allowlist (Administration → Device Provisioning → Security) that refuses config pulls from outside the subnets you list.

DHCP options (zero-touch provisioning)

Most IP phones will fetch their settings automatically if DHCP tells them where the provisioning server is. Set these options on your DHCP server (scope-wide, or per voice VLAN):

OptionNameValueUsed by
66TFTP Server Name / Boot Serverhttp://<pbx-ip>:8080 (Yealink/Grandstream) or the PBX IP (Cisco TFTP)Most vendors
150TFTP Server Address<pbx-ip>Cisco
43Vendor-specificVendor-dependent provisioning URLSome Polycom/others
Vendor differences

Yealink, Grandstream and Polycom pull an HTTP config from :8080 — point Option 66 at the full http://<pbx-ip>:8080 URL. Cisco 79xx phones use TFTP — point Options 66/150 at the PBX IP and run the TFTP server (below).

TFTP server (Cisco phones only)

Cisco 79xx handsets provision over TFTP, which VoicerOnePBX supports through a lightweight TFTP helper that serves the generated SEP<MAC>.cnf.xml files. If you don't use Cisco phones, you can ignore this entirely.

  1. Enable the TFTP helper and confirm UDP 69 is open on the voice VLAN.
  2. Set DHCP Option 150 (and/or 66) to the PBX IP so the phone knows where to fetch SEP<MAC>.cnf.xml.
  3. The phone needs a licensed SIP firmware load; the config file references it. See Adding Endpoint Devices for the Cisco specifics.
TFTP is unauthenticated

TFTP has no password protection — any device on the segment can request a config that contains SIP credentials. Restrict UDP/69 to your handset VLAN at the network layer; do not expose it to untrusted networks.

Next steps

With the network ready, build your provisioning profiles, then add your phones and create a trunk.

On this page