On this page
Your phone system lives in the cloud. Your desk phones live in your office. Something has to carry the calls between the two, through your internet connection and your router, without dropping registrations or leaving you with one-way audio.
3CX is clear about what that something is. If your 3CX is hosted, every office with desk phones needs a Session Border Controller (SBC) on its network. 3CX gives you two ways to have one: a small dedicated box, or a Router Phone, which is a normal desk phone that runs the SBC software itself. This post explains what each one is, when we use which across Northern Ontario, and what the box actually does all day.
What a 3CX session border controller does
A 3CX SBC is a piece of software that sits on your office network and opens one secure tunnel to your hosted 3CX system. Every desk phone in that office talks to the SBC locally. The SBC bundles all of their signalling and audio into that single tunnel to the cloud and back.
It encrypts the voice traffic, picks calls back up if the connection drops, and bundles signalling and audio together so your firewall and router stop interfering with call setup. Three things follow from that.
- Your router stays out of the conversation. The SBC makes one outbound connection. Nothing to forward, no SIP settings to tune, and the “SIP ALG” feature that ships on most business routers, and quietly breaks VoIP, no longer matters for the phones behind it.
- New phones find the system by themselves. Plug a supported phone into the office network and it discovers the SBC and provisions itself from the hosted 3CX.
- One connection to watch. We monitor the SBC. If the tunnel drops, we know, and we know which site.
The two ways to get one
A dedicated SBC box
The SBC software runs on Windows, Debian Linux, or a Raspberry Pi. We build ours on a Raspberry Pi 5, which 3CX added support for in August 2024 alongside the Debian 12 base it now uses. The Pi is wired into the office switch with a fixed address, draws a few watts, has no moving parts, and fits on a shelf in the network closet. For larger sites the same software runs on a small Linux server.
A dedicated box serves any number of phones the site is likely to have, any mix of brands, plus DECT cordless bases and door intercoms. 3CX positions it as the choice once a site outgrows a single phone acting as the gateway.
A Router Phone
A Router Phone is an ordinary desk phone that also runs the SBC software inside itself. 3CX gave its SBC code to Fanvil, Snom and Yealink, who built it into their more capable models. The phone does its own job as a desk phone and, at the same time, acts as the SBC for the other phones in the office.
Two limits come with it. 3CX supports up to 10 handsets behind one Router Phone and recommends a stand-alone SBC beyond that, because the phone’s hardware runs out of headroom. And it has to be a supported model. Only certain Fanvil, Snom and Yealink handsets can do it, and the list changes as new models ship. We check the current list against the exact model before we quote one, so ask us and we will confirm yours.
There is a bonus worth knowing about. Calls between two phones behind the same Router Phone stay on the local network instead of travelling to the cloud and back, which saves bandwidth on a thin connection.
What about no SBC at all?
There is a third path, direct connection using STUN, and 3CX treats it as an advanced option that needs a custom phone template. We do not deploy it for hosted customers. It depends on your router behaving perfectly, and on connections where the provider does the address translation upstream, which includes Starlink, it does not work at all. 3CX’s own community has tested that. An SBC or Router Phone only ever calls out, so it does not care.
When to use which
| Your situation | Our usual call |
|---|---|
| Up to ten phones, and at least one is a supported Fanvil, Snom or Yealink model | Router Phone |
| More than ten phones, or the count is likely to grow past it | Dedicated SBC |
| Mixed phone brands, or models not on the Router Phone list | Dedicated SBC |
| Overhead paging groups, door intercoms, or cordless DECT bases | Dedicated SBC |
| Starlink, fixed wireless, or any connection where the provider does the address translation | Either, never a direct STUN phone |
| Site is hours away and nobody on site is technical | Dedicated SBC, with remote access for us |
| Staff working from home on the 3CX app | Neither, the app needs no SBC |
The pattern is simple. A small office with the right phones can carry its own SBC. Once the phone count, the device mix, or the distance from Thunder Bay goes up, a dedicated box earns its shelf space.
Starlink deserves its own line. Many Northern Ontario businesses run on it, from Nipigon to Manitouwadge to camps north of Geraldton. Starlink puts your office behind the provider’s address translation, not your own router’s. Phones that try to be reached directly from the cloud fail there; phones behind an SBC or Router Phone work. One practical note from the field: keep the phones on wired Ethernet rather than Wi-Fi on a Starlink site.
Paging and intercoms are the other clear case. Multicast paging across Yealink or Fanvil phones needs all the phones on one local network with a consistent path to the phone system. A dedicated SBC gives you that.
What the SBC does not do
It is worth being honest about the limits.
- It is not a firewall. It secures the phone traffic through its tunnel. It does not replace your router’s job of protecting the rest of the office.
- It does not fix a bad connection. Your internet still needs to be sound. An SBC fixes routing and NAT problems, not bandwidth problems.
- It is one point of failure per site. If a dedicated box loses power or its SD card fails, or a Router Phone is unplugged, every phone behind it loses service until it is back. That is why we run boxes on a fixed address, keep a spare image of every build, and watch each one. It is also why we still put the 3CX app on staff phones. The app connects on its own and keeps working when the office does not.
- It is not needed for apps. The 3CX app on a mobile, a laptop, or in the browser connects directly to the hosted system. Only physical desk phones, DECT bases, and adapters go through the SBC.
How a site goes live
- We look at the site first. Phone count, phone models, router, internet type, whether paging or door stations are involved. That decides Router Phone or dedicated box, and it takes minutes.
- We build the box in Thunder Bay. The Pi is imaged, wired, given its fixed address, and registered against your hosted 3CX before it ships or drives out. A Router Phone is set up the same way, from the 3CX admin console.
- It gets a name. Every SBC we deploy carries a name that says which customer, which building, and what it is. When something needs attention, nobody has to guess which box in which town.
- Plug it in, plug the phones in. The SBC connects out to the cloud. Phones on the same network discover it and provision themselves. Extensions, names, and voicemail settings arrive from the hosted system.
- We keep a hand on it. Secure remote access lets us update or check the box without a site visit, which matters when the site is a six-hour drive from the office. 3CX’s newest SBC release also applies Linux security updates on its own.
If you want the technical steps rather than the overview, our 3CX SBC setup guide walks through the install.
What it costs
Less than a service call. A Router Phone costs nothing beyond a phone you may already be buying. A dedicated SBC is a small piece of hardware plus our time to build and provision it. Every office is different, so we quote it as part of the site design rather than from a price list. Start with a free assessment and we will tell you which setup fits before anything is ordered.
Have a specific site in mind? Call (807) 700-7111 or book a free assessment and we will map out the right setup for each location.
FAQ
Do I need an SBC for hosted 3CX?
Yes, for desk phones. 3CX’s admin guide says a hosted system needs “at least one so-called router phone or an SBC in the network on which the IP phones are located”. The 3CX app does not need one.
Can one of my phones be the SBC?
If it is a supported Fanvil, Snom or Yealink model and the office has ten phones or fewer, yes. That is exactly what a Router Phone is. It still works as a normal phone at the same time.
Can the SBC run on my existing router?
No. It runs on a supported phone or on its own small computer. Tuning a router to let phones connect directly is the STUN path, which we do not use for hosted customers.
Does the SBC slow calls down?
No. It carries the audio through its tunnel without changing it. What you hear is limited by your internet connection.
What happens if the internet goes out?
Desk phones behind the SBC lose service until the connection returns. Calls to your numbers can be set to ring the 3CX app on mobile phones, or forward to a cell, so the business keeps answering.
We have three offices across Ontario. Do we need three SBCs?
Yes, one per office with desk phones, whether that is a Router Phone or a box. Each connects to the same hosted 3CX system, so the offices dial each other by extension as if they were in one building.
Can I move an SBC to another office?
Yes. It is re-registered against the hosted system for the new site and renamed. We handle that remotely where the site has a working connection.
Sources: 3CX Admin Guide, Configuring IP Phones with 3CX (Why Router Phones); 3CX, How does the 3CX SBC Router Phone simplify your deployment? (January 13, 2023); 3CX, SBC Update Adds Raspberry Pi 5 & Debian 12 Bookworm Support (August 7, 2024); 3CX, SBC Update BETA: Debian 13 Support & Automatic OS Updates (July 16, 2026); 3CX community threads on Router Phone vs SBC and on Starlink. Not a contract. Supported phone models and limits are 3CX’s at time of writing and change with releases.