3CX Being Consistently Attacked

[NableIT]

The system is getting constantly targeted and attacked by random public IP addresses that are attempting to authenticate in. This is occurring consistently roughly every 5 minutes.

Its getting to a point that it is affecting call quality and latency. We have made it so the console is only accessible from a specific IP address but that doesn't seem to have stopped the attacks.

Is there anything I can change on my end to prevent these attacks from occurring?

Thanks for your support!

 

[SteveITS]

Assuming the firewall check already passes, so you’re clean, in your firewall you can limit SIP ports to your provider and web ports to say your country. We also have IDS in front of servers we host.

 

[SweetAction]

Also make sure to turn on the global blocklist for attacks against the https port. But as Steve said, limit 5060/5061 to just the SIP providers.

 

[AWS2P]

Well even with all this set up, I get lots of tries on Webclient /Api module and this is automaticlaly blocked only for 15 minutes , I can get 10-15 same IPs blacklisted everywhere onl my pbxs

 

[KyriacosS_3CX]

As with any system with a public facing IP, 3CX PBXs will get scanned/attacked all the time, especially now - as you are probably all aware - there is a massive uptick in attempts to bridge all types of systems.

While 3CX takes all possible steps to create a secure product, deployments should follow standard best practices, and in this case we are primarily talking about locking down IP based access to just the regions, or preferably networks, that are absolutely necessary.

 

[AWS2P]

Thanks Kyriacos for remembering us what 3CX do to protect PBxs , my goal was just to say if blacklisted IPs could stay blacklisted more than 15 minutes.
In one hour of time, this night theses IPs have been added to the blacklist for only 15 minutes. On all the pbx, I get same IP list in same order.

For sure I can extend IP ranges and blacklisted time manually, but do you expect us to do this on all our pbxs daily? (I do this already for some)

Could it be possible to increase blacklisted IPs to a longer time duration ?

 

[Hexanet]

Hi AWS2P,

you can easily change your blacklist time to increase the blocking time in the 3CX config :

 

[bitn2]

Hi AWS2P,

you can easily change your blacklist time to increase the blocking time in the 3CX config :

View attachment 51185

Thats only for sip attacks.. The attacks are to the webclient.

 

[AWS2P]

Hi AWS2P,

you can easily change your blacklist time to increase the blocking time in the 3CX config :

View attachment 51185

My settings are stronger set than default but no way to set something for Webclient /API there as BITN2 said

 

[paulodagraca]

Hello AWS2P,

Yes, i understand that your request is to single blacklist for lots longer than 15 min. per event.
It would also be beneficial to already blacklist these IP's for "Vultr Holdings" -> taken from your screendump.

*unzip file, and import to 3CX system blacklist.

Paulo

 

[AWS2P]

thanks Paulo, what do you use to mass know which provider/country Ips are coming from? what kind of tool do you use to create file to import in 3CX?

 

[paulodagraca]

Hello AWS2P,

I do this all manual

Find IP from 3CX blacklist report - Example 108.61.208.95

There you will find the first part 108. check this in IANA:
You will find that 108/8 ARIN whois.arin.net is in administration with ARIN

The full subnet can be found at: CIDR: 45.77.62.0/23
And the name at: Full Name: Vultr Holdings, LLC

Well something like this anyways, you may already be fully aware of this information anyways.
Again this is all manual work did not ever taken the time to script any of this.

Paulo

 

[paulodagraca]

Hello AWS2P,

Did not answer this question:
what kind of tool do you use to create file to import in 3CX?

Again, i do not.
Just export some lines of the existing Blacklist and use notepad to copy lines, and fast add extra lines with IP bloks.
Than re-import the file back again in the 3CX

Paulo

 

[AWS2P]

As you did this manually, really Big Big thanks for your time providing me a file ready to import .