3CX Debian - Linux Firewall

[amir_]

Hi,

To comply with security audits, I need to know, by default, does the Linux version of 3CX use IPTables?

TIA,

Amir

 

[VoIPTools]

If you installed V16 or upgraded to V18 from 16, it uses IPTables. If you performed a fresh install of V18, it will use NFTables.

 

[amir_]

We are running v16. So when we do a DEFAULT installation and then make further changes via the Management Consoles, are those implemented via IPTables at the OS Level?

 

[amir_]

How does the 3CX Debian ISO leverage the IPTables OS level firewall? Are clients simply limited to the GUI for configuring security ? If so, what is the default rule set for IPTables for v16?

 

[amir_]

In this thread:
https://www.3cx.com/community/threads/how-to-disable-3cx-appliance-firewall.59899/

YiannisH_3CX wrote:
If you used the 3CX ISO then the basic IP tables rules were automatically configured for you. This is done on the OS level though so if you need to remove them (not recommended) you will need to do so through SSH. As mentioned if the phones register in the first place then the issue is not with the IP tables.

What are these mysterious "basic IP tables rules" which are "automatically configured for you"?

 

[amir_]

This is what I'm coming up with - it appears that 3CX, by default, writes the following rules into IPTABLE:

ANY / ANY TCP 5000,5001,5060, 5061 and 5090
ANY / ANY UDP 5060 and 5090

Can I get confirmation from someone ?

root@3cxprod:~# iptables -nL --line-numbers
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT udp -- 0.0.0.0/0 224.0.1.75
2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 5000,5001,5060,5061,5090 tcp flags:0x17/0x02 ctstate NEW
3 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 5060,5090

Chain FORWARD (policy ACCEPT)
num target prot opt source destination

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

 

[amir_]

Do most folks just leave the default rule set ANY / ANY in place and NOT restrict inbound SIP traffic to source IP ranges?

 

[VoIPTools]

I assume we are talking about 3CX servers hosted in the cloud.

How restrictive you are when configuring the 3CX firewall depends on your environment. Do you have a firewall between your 3CX server and the outside world? If so, you would want to place your restrictions primarily on the edge firewall.

However, if your 3CX server is directly on the public internet, then very careful configuration of the firewall is required. For example, if you have remote users who do not have secure VPN access or a static IP address, you will not be able to restrict access to the 3CX server. But if all your users are behind the corporate firewall, then absolutely restrict access to the 3CX server to just the IP of your office firewall.

Frankly, there are those who would restrict access to the 3CX server even within your corporate network. I generally would not take it that far, but I guess that depends on how far you want to go to secure your infrastructure.

Conceptually, I have a problem with allowing people to get all the way to your 3CX server before implementing security. It's better to ensure unauthorized access is controlled BEFORE they get to the 3CX server. Relying exclusively on the Linux firewall gives me heartburn.

 

[cobaltit]

3CX comes with some basic security defaults but realistically you'd want something else in front of 3CX to do that work. 3CX out of the box allows all ports required for 3CX functionality. Any restrictions to be implemented are best done on the same edge device you would implement restrictions for anything else on your network so it's all in one place.