3CX Installation Options: Hosted, Self-Hosted or On-Premise?
In short: 3CX can be deployed three ways: hosted by 3CX (3CX Hosted), self-hosted in your own cloud account (Google, AWS, Azure, DigitalOcean) or on-premise on a Windows or Debian server. With 3CX Hosted, 3CX manages the operating system and updates, but a SIP trunk is mandatory and analog/ISDN gateways and failover are not supported.
What are the 3CX installation options?
3CX is a software-based IP PBX (phone system) that runs on a standard server or in the cloud rather than on dedicated hardware. It offers three installation options: 3CX Hosted, self-hosted (private cloud) and on-premise. The choice decides who manages the operating system and which lines and phones you can use.
- 3CX Hosted: 3CX deploys the instance, sets firewall rules and applies patches and upgrades; technical support is not included.
- Self-hosted: runs in your Google Cloud, Amazon EC2/Lightsail, Azure or DigitalOcean account; you manage the instance.
- On-premise: Windows or Debian Linux on bare metal or a VMware, Hyper-V or KVM virtual machine.
| Criterion | 3CX Hosted | Self-hosted (private cloud) | On-premise |
|---|---|---|---|
| OS and 3CX updates | 3CX | You | You |
| SSH access to the server | No | Yes | Yes |
| Backups | You (3CX takes no backups) | You | You |
| Gateways for analog/ISDN lines (FXO, ISDN) | Not supported; move to a SIP trunk first | SIP trunk recommended | Possible with PSTN gateways tested by 3CX |
| Desk IP phones | Only behind a 3CX SBC or router phone | Remote phones behind an SBC or router phone | Directly on the LAN; remote phones behind an SBC |
| Built-in failover | Not available | With AI Edition | With AI Edition |
| Suits | Offices without server staff, ready for a SIP trunk | IT teams with cloud experience | Sites with local infrastructure, analog lines or strict control needs |
Caution: on the 3CX price list, hosting stops at the 256SC tier; larger systems are self-managed.
Which 3CX edition runs on which deployment model?
The two free options are tied to one deployment model each, while commercial editions run on all three. Commercial licenses are priced per system by simultaneous calls (SC), counting internal and external calls, and start at 8SC.
| Edition | Deployment model | Scope | Limits to note |
|---|---|---|---|
| 3CX SMB Free | Hosted by 3CX only (shared instance) | Up to 10 users | Not installable on your server; no CRM integration |
| 4SC Free Basic | Self-hosted or on-premise only | Up to 10 users | No IP phones (web and mobile apps); no CRM or API; own SMTP server required |
| Basic | Hosted (16SC+), self-hosted, on-premise | From 8SC | No queues, recording, CRM or site bridges; Microsoft 365 user sync only |
| PRO | All three | From 8SC | Call center, CRM and bridges included; no built-in failover |
| AI Edition | All three | From 8SC | AI features, built-in failover and standby license; failover unavailable on Hosted |
The free options reflect the vendor's terms as of 19 October 2026 and may change; Free Basic can later be upgraded to Basic, PRO or AI. See our 3CX phone system overview, the small-office plan hosted by 3CX and the PRO license on your own server.
Which model fits your company profile?
The right model depends on your IT capacity, current lines and how much a phone outage hurts. The matrix maps 3CX conditions to typical office situations; if a row rules a model out, drop it.
| Your situation | Preferred model | Reason (3CX condition) |
|---|---|---|
| No staff to manage servers | 3CX Hosted | OS, patches and upgrades handled by 3CX |
| Up to 10 users, no desk phones | One of the free options | 3CX hosts the SMB option; you host Free Basic, which has no IP phone support |
| Analog or ISDN lines must stay for now | On-premise | Hosted does not support PSTN, FXO or ISDN gateways |
| A phone outage stops the business | On-premise or private cloud with AI Edition | Built-in failover is AI Edition only; not on Hosted |
| You already run VMware, Hyper-V or KVM | On-premise (virtual machine) | 3CX tests and supports these platforms |
| Cloud, but with server access and data location control | Self-hosted (private cloud) | Hosted gives no SSH access; in a private cloud you manage the instance |
| Many desk phones across branches | Hosted or private cloud with an SBC per site | 3CX recommends a dedicated SBC above 10 phones; Basic has no bridges |
Plan telephony together with the network, Wi-Fi, email and endpoint security using our SMB office IT infrastructure guide. If your team works in Microsoft Teams, connecting the PBX to Teams is a separate decision covered in 3CX and Microsoft Teams integration.
What OS and hardware does a self-managed 3CX need?
A self-managed 3CX runs on the Debian 12-based 3CX ISO or a supported Windows version. Debian 10 is no longer supported, and the Debian machine must be dedicated to 3CX, with system updates delivered through 3CX. Supported Windows versions are Windows 10 and 11 (Pro, Enterprise) and Windows Server 2016, 2019, 2022 and 2025 (Standard, Datacenter).
A Windows host must not also run DNS, DHCP, Exchange or SQL. ESXi 6.5u1+, Hyper-V (6.2)+, KVM 2.8+ and Citrix XenServer 7.0+ are supported, but physical-to-virtual (P2V) conversions should be avoided. 3CX requires at least a 1 Gb LAN and recommends QoS for voice traffic.
The 3CX sizing document dated 23 April 2026 gives these starting points:
| Tier | Extensions (up to) | Debian: vCPU / RAM | Windows: vCPU / RAM | SSD storage |
|---|---|---|---|---|
| Small | 10 | 2 / 4 GB | 2 / 4 GB | 80 GB |
| Medium | 50 | 4 / 4 GB | 6 / 6 GB | 160 GB |
| Large | 250 | 6 / 8 GB | 8 / 10 GB | 320 GB |
| Enterprise | 1000 | 8 / 16 GB | 10 / 18 GB | 640 GB |
These are minimums; queues, group calls and recording add load. Sizing formulas:
- Recording storage (MB) ≈ recorded minutes per day × retention days × 1 MB; 3CX says a recorded minute uses about 1 MB and the base install needs at least 40 GB.
- RTP ports to open = 2 × simultaneous calls; 3CX says each call uses two RTP ports.
If the PBX is a virtual machine, upkeep of the physical host also determines phone uptime; a server maintenance agreement can cover that layer.
What network and security preparation is needed?
In on-premise and self-hosted deployments, the firewall is part of the PBX security boundary. The 3CX V20 security hardening checklist assigns the OS, firewall, DNS and segmentation to the administrator in these models; on Hosted, identity, roles and endpoints remain yours.
Pre-installation checklist
- Final FQDN and extension length.
- A static internal IP for the PBX and a dedicated public IP.
- Split DNS: the FQDN resolves to the local IP inside and the public IP outside.
- Only required ports: 5060 UDP and 5060–5061 TCP for SIP, 9000–10999 UDP for RTP audio, 5090 for the app tunnel.
- SIP ALG disabled; 3CX Firewall Checker run after setup and every network change.
- PBX host separated from sensitive subnets with access control lists (ACLs).
- TLS and SRTP where the full call path supports them; Admin Console limited to trusted IPs.
- A protected backup destination and regular restore tests with a named owner.
3CX publishes sample configurations for common firewalls, FortiGate included. For rule hygiene see our firewall maintenance and management service; for devices, the SMB firewall selection guide.
To settle the deployment model, SC tier and firewall preparation in one plan, the Sora Yazılım Teknolojileri team helps with 3CX selection, procurement, installation and support; the scope is defined in the contract. Get a Quote
What is a SIP trunk and how does it connect to 3CX?
A SIP trunk connects your PBX over the internet to a voice provider and gives access to the public telephone network (PSTN). SIP is the signaling protocol defined by the IETF in RFC 3261 for creating, modifying and terminating sessions. 3CX needs a SIP trunk account for external calls and direct inward dialing (DID) numbers.
- Choose a supported provider: the 3CX provider directory has a page for Turkey, and listed providers come with ready-made templates; 3CX does not help configure unsupported providers.
- Check authentication: trunks authenticate by registration (username and password) or by IP. With IP-based trunks you must tell the provider when the PBX host changes; since a Hosted system's public IP can change, 3CX prefers registration-based trunks there.
- Plan number porting: 3CX notes that porting time depends on the provider. In Turkey, the regulator BTK refers to nts.gov.tr for the porting process and legislation; confirm terms with your provider.
How do you migrate from analog lines and a legacy PBX to 3CX?
A safe migration moves the lines to a SIP trunk first, tests the new PBX in parallel, then hands over phones and numbers in a controlled way. The 3CX Hosted migration guide likewise tells systems with PSTN gateways to move to a SIP trunk and test it on the existing installation first.
- Take inventory: lines, numbers and DIDs, extension plan, auto attendant (IVR), phone models and analog devices such as fax machines and door phones.
- Choose the model and SC tier: count internal and external calls running at the same time at peak.
- Fix the FQDN and extension number length.
- Obtain and test the SIP trunk with a supported provider before the final switch.
- Decide the phone strategy: web and mobile clients, router phones or a 3CX SBC. 3CX recommends a dedicated SBC above 10 phones; it needs a static IP and must run continuously.
- Run a pilot with one team or branch: routing, queues and mobile apps.
- Port the numbers and keep the old PBX briefly as a fallback.
- Set up backups and monitoring: document the backup destination, alert recipients and restore tests.
Caution: list analog devices (fax, door phones, elevator lines) separately; 3CX lists tested PSTN gateways and analog telephone adapters (ATAs), but Hosted supports neither FXO nor ISDN gateways.
FAQ
Is there a free version of 3CX?
As of 19 October 2026 the vendor lists two. 3CX SMB Free runs on a shared instance hosted by 3CX for up to 10 users. 4SC Free Basic runs only on your own server or cloud account, also for up to 10 users, without IP phone or CRM support. Check the current terms on 3cx.com before installing.
Can I use desk IP phones with a cloud-hosted 3CX?
Yes, but not directly. On 3CX Hosted, IP phones must sit behind a 3CX SBC or an SBC-capable router phone; phones connected via STUN are not supported. 3CX recommends a router phone for networks with fewer than 10 phones and a dedicated SBC for larger ones. For a few remote users, the apps need less maintenance.
Can I keep my analog lines with 3CX Hosted?
No. According to the 3CX migration guide, PSTN, FXO and ISDN gateways are not supported on Hosted, and a SIP trunk is mandatory. To keep analog lines, choose an on-premise installation, or first move the lines to a supported SIP trunk provider. 3CX recommends testing the trunk on your existing system before switching.
Is 3CX licensed per user?
No. Basic, PRO and AI are licensed per system on an annual basis, and the tier is chosen by the number of internal and external calls running at once (SC); commercial licenses start at 8SC. If you choose 3CX Hosted, hosting is charged separately. Ask for a quote for current amounts.
Should I install 3CX on Windows or Linux?
Both are supported; pick the platform your team knows. The Debian 12-based 3CX ISO installs a dedicated system whose updates come through 3CX. On Windows, Windows 10 and 11 and Windows Server 2016–2025 are supported. In the 3CX sizing table, Windows needs more vCPUs and memory than Debian from the medium tier upward.
Does 3CX Hosted back up my system?
No. 3CX states that it does not back up the configuration, call history, voicemails or recordings of Hosted instances, and its occasional internal backups should not be relied upon. Backups are the administrator's responsibility, and 3CX recommends configuring remote storage. The same applies to self-managed installations.
Can I get help with 3CX installation and migration?
3CX Hosted does not include technical support; for general configuration, 3CX refers customers to their installer or a support ticket. Sora Yazılım provides 3CX model selection, license procurement, installation, SIP trunk migration and ongoing support, with the scope defined in the contract. Share your requirements via our Contact us form.
Conclusion
- For offices without server staff and ready for a SIP trunk, 3CX Hosted needs the least upkeep; backups and identity stay with you.
- Analog or ISDN lines, built-in failover or more than 256SC point to a self-managed installation.
- The FQDN, extension length, SC tier and SIP trunk type are day-one decisions.
Sora Yazılım helps you shape the deployment model and migration plan around your lines, devices and IT team; start with a free discovery call.
Get a Quote · WhatsApp: WhatsApp Support · Phone: +90 544 785 21 87 · Email: talep@sorayazilim.com
Sources
- Installing 3CX — 3CX, 16 January 2026. 3cx.com (accessed: 19 October 2026)
- Hosted with 3CX – Explained; How to Migrate to 3CX Hosted — 3CX, 1 September / 3 August 2026. hosting terms, migration (accessed: 19 October 2026)
- Full Feature List and price list (SC tiers) — 3CX, 28 August 2026. 3cx.com, 3cx.com/ordering/pricing (accessed: 19 October 2026)
- Edition pages: 4SC Free Basic, SMB, Basic — 3CX, 2026. Free Basic, SMB, Basic (accessed: 19 October 2026)
- Installing 3CX on Debian / on Windows — 3CX, 8 July 2025 / 9 September 2026. Debian, Windows (accessed: 19 October 2026)
- Recommended Hardware Specifications; Firewall & Router Configuration — 3CX, 23 April / 25 September 2026. hardware, firewall (accessed: 19 October 2026)
- Installing a 3CX SBC; Supported IP Phones, PSTN Gateways & ATAs — 3CX, 10 September 2026 / 28 June 2026. SBC, devices (accessed: 19 October 2026)
- Configuring a SIP Trunk; SIP Trunk Providers – Turkey — 3CX, 10 September 2026. SIP trunk, Turkey (accessed: 19 October 2026)
- 3CX V20 Security Hardening Checklist — 3CX, 12 October 2026. 3cx.com (accessed: 19 October 2026)
- RFC 3261: SIP: Session Initiation Protocol — IETF, June 2002. rfc-editor.org (accessed: 19 October 2026)
- Number Portability — BTK (Turkey's ICT regulator). btk.gov.tr (accessed: 19 October 2026)
How this article was prepared
Prepared by: Sora Yazılım Team. This article was prepared with AI assistance; technical details were checked against the vendor and official sources linked in the text as of 19 October 2026.
Related articles
- SMB Office IT Infrastructure Setup Guide — Network, phones, email and security in one plan.
- 3CX and Microsoft Teams Integration — Calling via the PBX from Teams.
- Microsoft 365 Business Basic vs Standard vs Premium — A plan decision matrix.
- Exchange Server 2016/2019 End of Support — Exchange Online or Exchange SE.
- Microsoft 365 Security Settings Checklist — Identity, device and email steps.
- Bitdefender GravityZone Plans Compared — Choosing an endpoint security plan.
- Reducing the Endpoint Attack Surface — Hardening with GravityZone.
- Ruijie Reyee or RG Enterprise Series? — The network layer that carries voice.
- When Does Wi-Fi 7 Make Sense for Businesses? — Criteria for a wireless upgrade.