Advice on hardening security

[Lee Cramman]

We have a cloud install deployed from 3CX and hosted by Google. We have a single site (for which I have whitelisted the IP) tunneling through a SBC and also mobile clients using 3CX for Android.

So far I've decreased the failed authentication threshold to 10, the failed challenge requests to 100 and increased the blacklist time interval to 999999999. I block ranges of IP's whenever they are blacklisted.

The number of failed authentications / blacklists I'm seeing have gone up significantly in the last few days (about 20 new ones per day) and I was wondering if there is any further hardening of the server / firewall that is advisable or if this is to be expected?

Thanks

 

[Lee Cramman]

Forgot to mention, this morning I also blocked ports 5060 / 5061 to all but our provider.

 

[YiannisH_3CX]

Hello @Lee Cramman

If only your providers IP is allowed to port 5060 then you should be OK from a security perspective. Make sure that no remote devices are connecting to port 5060 to avoid any issues.

 

[Lee Cramman]

Cheers,

The blacklisting has effectively stopped since re-configuring the firewall to block port 5060.

 

[YiannisH_3CX]

Glad to see the issue has been resolved.