Choosing the Right Host for 3CX: AWS, Azure, DigitalOcean, or On-Premise? A Cost-Benefit Analysis

Jump to Section:

• → Detailed Comparison of Hosting Requirements Per User Count
• → Guide to Setting Up a 3CX Instance on Popular Cloud Providers
• → Pros and Cons: 3CX-Hosted vs. Self-Hosted Cloud
• → Networking and Firewall Considerations for Remote Provisioning
• → Cost-Benefit Analysis and Final Recommendation

Disk:

Do not use standard HDDs. You must use SSDs for optimal performance. The disk space is primarily for the OS, 3CX application, and call recordings. If you plan to record all calls, your disk space requirements will increase significantly.

CPU:

For most of the day, the PBX will be idle. The CPU needs to handle bursts of activity (call setup, transcoding, web client logins). CPU-Optimised or "Burstable" instances (like AWS T-series) are often a good fit.

Call Recording:

This is the single biggest resource driver. If you enable "record all calls," your CPU will work harder for transcoding, and your disk I/O and storage needs will multiply. For high-recording environments (100+ users), you may need to offload recordings to a separate storage bucket (like S3).

Create Instance:

Log in to your AWS Lightsail console.

Click "Create instance."

Select the "Europe (London)" region (to be geographically close to your users).

Select "Linux/Unix" as the platform and "OS Only."

Choose "Debian 10" as the blueprint.

Select your instance plan based on the requirement table above (e.g., the $12/month plan for 2GB RAM, 2 vCPU).

Give your instance a unique name (e.g., 3CX-PBX-Server).

Assign Static IP:

This is critical. By default, your instance has a dynamic IP.

Go to the "Networking" tab for your new instance.

Click "Create static IP" and attach it to your 3CX-PBX-Server instance. This static IP is what you will use for your DNS FQDN.

Configure Firewall:

This is the most important step. In the "Networking" tab, you must open the 3CX ports.

Do not open all ports to the world. Create specific rules:

• SSH (TCP/22): Open this only to your own static office/home IP for management.
• HTTPS (TCP/443): Open for the Web Client/Management Console.
• 3CX Tunnel (TCP/UDP/5090): Open for remote apps and SBCs.
• SIP (UDP/5060): Open (though many prefer to only use the tunnel).
• RTP (UDP/9000-10999): Open for call audio.

Install 3CX:

SSH into your new instance using the IP and the downloaded key.

Follow the official 3CX manual installation guide for Debian 10. This typically involves running apt update, apt install wget, and then using wget to download the 3CX repository and apt to install the 3cx-common package.

The installation will prompt you to run the 3CXConfig tool, a text-based wizard that will ask for your licence key, FQDN, and admin credentials.

DNS (FQDN):

Before you run the installer, you must have a Fully Qualified Domain Name (FQDN) (e.g., pbx.yourcompany.co.uk).

Go to your DNS provider (e.g., Route 53, Cloudflare, Namecheap).

Create an "A" record pointing your FQDN to the Static IP you created in Step 2.

This FQDN is what all your phones, apps, and browsers will use to find the PBX.

Crucial UK Budgeting Note (AWS/DigitalOcean): While major providers like AWS and DigitalOcean have UK-based data centres (e.g., London), they typically bill in US Dollars ($). This means the monthly cost for your UK business will fluctuate with the GBP/USD exchange rate. You must also account for VAT, which will be added to your bill. When comparing costs, a UK-based hosting provider that bills in Pounds (£) may offer a more predictable monthly expense.

Pros:

• Simplicity: Deployment is a 5-minute wizard. No need to manage OS, firewalls, or cloud infrastructure.
• Free (Initially): 3CX often provides the first year of hosting free for Pro and Enterprise licences, making it very attractive.
• Managed Updates: 3CX handles the core system and OS updates, reducing your administrative burden.
• High Availability: Hosted on highly reliable infrastructure.

Cons:

• Less Control: You do not get root/SSH access to the server. You are limited to the 3CX Management Console.
• Licence Restrictions: Only available for 3CX Pro and Enterprise licences. Not available for the 3CX Free/SMB editions.
• No Customisations: You cannot install third-party applications, custom scripts, or advanced Call Flow Designer (CFD) applications that require server-side components.
• Data Sovereignty: You have less control over the exact physical location of your data, which can be an issue for compliance.

Pros:

• Absolute Control: You have full root access. You can install monitoring agents, custom scripts, and complex CFDs.
• Provider Choice: You can shop around for the best price/performance among AWS, Azure, DigitalOcean, or UK-based providers.
• Data Sovereignty: You can choose your exact data centre region (e.g., "Europe (London)") to comply with data laws.
• Cost-Effective at Scale: For smaller deployments (under 50 users), a $6-$12/month instance is incredibly cheap.
• All Licences: Works with any 3CX licence, including 3CX Free.

Cons:

• Total Responsibility: You are 100% responsible for everything.
• Security: You must configure the firewall correctly. You must manage OS patches (e.g., apt update && apt upgrade).
• Maintenance: You are responsible for snapshots, backups (beyond 3CX's built-in backup), and monitoring the instance's health (CPU, RAM).
• Complexity: Requires a higher level of technical expertise (Linux CLI, network security).

STUN (Session Traversal Utilities for NAT)

What it is: A method where the desk phone queries an external STUN server to discover its own public IP address and port. It then sends this information to the 3CX server in its SIP registration packet.

How it's used: This is the default "remote provisioning" method for 3CX when you don't use an SBC. You configure the phone in the 3CX console as a "Remote STUN" phone.

SBC (Session Border Controller)

What it is: A lightweight piece of software (provided by 3CX) that you install on a device at the remote office location. This can be a Raspberry Pi, a small Windows/Debian VM, or even a regular PC.

How it works:

• The SBC creates a single, secure, encrypted "tunnel" from the remote office back to the 3CX server (using TCP/5090).
• All phones at the remote office are configured to talk to the local IP of the SBC.
• The SBC bundles all SIP and RTP traffic from all phones, encrypts it, and sends it down the single tunnel to the PBX.

Conclusion: SBC is the Professional Choice. If you are connecting a single home user's softphone or mobile app, the 3CX app's built-in tunnel works perfectly. If you are connecting a single desk phone, STUN might work. But if you are connecting a remote office with 2 or more desk phones, an SBC is not optional. It is the required, professional, and only stable solution.

For the SMB with no IT staff (or a non-technical owner):

Winner: 3CX-Hosted. The simplicity and lack of maintenance are worth the (eventual) cost and loss of control.

For the technical IT Admin managing one or more sites (under 100 users):

Winner: Self-Hosted Cloud (e.g., Lightsail/DigitalOcean). The combination of extremely low cost (even with VAT) and total control is unbeatable. The responsibility for OS updates and firewall management is well within the skillset of a typical IT admin. Use SBCs for all remote sites.

For the large enterprise (250+ users) or Call Centre:

Winner: Self-Hosted Cloud (e.g., AWS EC2/Azure). You need the granular control and high-performance, dedicated resources (like CPU-Optimised instances) that the "budget" providers don't offer. You also have the internal IT resources to manage the platform 24/7.

For the organisation with strict data compliance (e.g., Legal, Health):

Winner: On-Premise or Self-Hosted (in a UK data centre). You must have full control over the hardware and data location. An on-premise server (or a VM on your existing VMWare/Hyper-V cluster) gives you a 100% "air-gapped" solution if needed, or you can host in a specific "Europe (London)" region to comply with UK GDPR and Data Protection Act 2018 requirements.

Need Expert Help with Your 3CX Deployment?

Our certified 3CX engineers can guide you through hosting selection, installation, and configuration—ensuring optimal performance for your UK business.

Additional Reading & Resources

• → The Ultimate 3CX Guide for Business: Setup, Pricing, Features, and Best Practices

  A comprehensive overview of 3CX features, licensing tiers, and implementation strategies.

• → 3CX Phone Systems for UK Businesses

  Explore our managed 3CX solutions and professional installation services.

• → Cloud PBX vs. On-Premise vs. Hybrid Phone Systems: Which Type Is Right for Your Business?

  A broader comparison of deployment models beyond just 3CX.