I'm currently setting up a test 3CX system, and was reading this article about setting up the firewall. From the below image it looks like your're supposed to lock down SIP and media traffic so that it only comes from your SIP provider:
We use Gradwell as our SIP trunk provider, and I asked...