How to correctly update ip PBX?

Question

Asterisk

Good day everyone.
there was a desire to slightly expand the capabilities of the existing automatic telephone exchange, and a number of questions arose.
what is:
old trixbox CE 2011
hardware:
ProLiant ML110 G6
CentOS release 5.5 (Final)
Intel(R) Pentium(R) CPU G6950 @ 2.80GHz
Physical Memory 4 GB
two 320 GB screws
serves 40 internal lines in the office
devices SPA301- G2 D
- link
150
, several on the speaker (probably softphones on smart phones), add a landline number (via SIP)
questions:
- will the current iron be enough?
- whether it is necessary to change the distribution kit?
- how to block access as much as possible (with static IPs it’s clear, through permit "the desired IP", but with dynamics? just a complex password?

Answer 1

- will the current iron be enough?

in full
Not necessary
Use a VPN for maximum protection.

Answer 2

• Iron should be enough
  
• If the distribution provides all the necessary functionality and is stable, it is better to keep the current one.
  
• To improve security, you can use a non-standard port. Also, you need to install and configure fail2ban, which will look at the Asterisk log for an excessive number of failed authorizations and block a potential attacker
  

Answer 3

Is there enough iron? - the Asterisk load on the hardware should be calculated not by the number of subscribers, but by simultaneous calls . Just monitor your current load and see if an upgrade is needed. But in general it is unlikely that this will be needed.
how to close access as much as possible? either a VPN, as suggested by Arsen in a previous answer, or a firewall or strong passwords.