More than a route.
A clear permission.

Open, Closed or Frozen.
Choose the boundary.

Open permits new pairings and existing approved workstations. Closed removes the listener while retaining pairing records and original expiry dates. Frozen prevents enrolment of new WireGuard identities while keeping existing pairings available. New installations default to Closed; an upgrade with valid pairings migrates to Open.

Optional Locked pairing uses a dedicated UDP listener and peer interface, with approved IPv4/IPv6 addresses, CIDRs or DNS names. The PBX enforces authenticated session leases separately from WireGuard handshakes; the default capacity is one workstation. Locked/Unlocked transitions use an identity-preserving, acknowledged migration. Windows can request source-list changes and unlocks, which remain pending FreePBX administrator approval. Portable tests pass; live PBX and native Windows acceptance remain outstanding.

A workstation the PBX recognises.

My PBXs starts with a request from the native Windows application. The request names a workstation public key and carries a random nonce. A full FreePBX administrator approves it over HTTPS, chooses a period and returns a response bound to that request.

The client checks the response before saving it: the key, nonce, addressing, endpoint and expiry must agree. Merely knowing the PBX address is not enough to enrol yourself.

FreePBX, in your browser.
Over your private connection.

Connect an approved profile and open FreePBX in your preferred browser. The client routes only the PBX tunnel address, not your general Internet traffic or the rest of the customer's network.

FreePBX 0.5.0 manages the public WireGuard listener through a persistent FreePBX Firewall Custom Service. The intended result is connection from any public IP without individual IP whitelisting. A reachable UDP port trusts nobody: WireGuard still cryptographically authenticates paired devices. Real-PBX roaming remains an acceptance test.

Normal FreePBX authentication still applies. Configure the actual HTTP/HTTPS management services, such as http:8080, https:8443. Updated Windows builds retain the approved scheme, port and /admin/ URL; the server still controls listeners, redirects and TLS.

• Both enforcement layers restrict approved management ports to authorised tunnel peers; standard TCP 80/443 remains supported.
• Managed SSH adds only the approved peer's WireGuard-bound certificate API and dedicated listener.
• Forwarding and unrelated services are denied on the workstation interface.
• Ordinary public SIP/RTP requirements remain separate.

TELIPHONES does not configure Apache or close existing public GUI or SSH exposure for you. Confirm that the web service listens on the tunnel or wildcard address, then test the private route deliberately.

A fresh SSH credential.
For this launch.

The administrator selects an existing Linux account; there is no implicit root account or newly created login. On each launch, the workstation requests a short certificate for a fresh in-memory session key through the tunnel.

Certificate signature and host identity are verified against keys pinned by the approved pairing. The private process-bound agent provides one authentication signature to its owned OpenSSH child, then destroys the disposable signing capability. It does not write a reusable session private-key file.

The unreleased Windows source now includes an experimental libvterm-based VT console and ConPTY resize path on this managed SSH session. Portable emulator tests pass; native Windows/ConPTY integration, full-screen applications and real SSH validation remain outstanding. PuTTY is not supported for managed My PBXs certificates.

The original deadline matters.

Complete real-PBX revocation, authorisation expiry and cgroup termination remain validation gates. A certificate expiring prevents new authentication; it does not itself terminate an established shell.

Know what the connection
is actually telling you.

Connection Health separates connected duration, authorisation remaining and continuously healthy time. Graphs show TCP latency and jitter, upload/download counter deltas, and application probe failures.

A TCP check is not an ICMP ping. A failed application probe is not a measurement of network packet loss. Unavailable data is shown as unknown, not invented as zero. WireGuard handshake age is a freshness signal, not proof that an idle peer disconnected.

A compact pop-out shares the same recent samples. A selected-profile session timeline records client observations; PBX diagnostics are a separate administrator-only record. Matching non-secret pairing identifiers help correlate them without pretending either side sees everything.

Implementation is not
the same as assurance.