Solved Alot of External IP has been blacklisted

[SS001]

Hi All,

I have signed up got the free hosted 3CX trial on the 3Cx web page. So far it is working great. The only concern I have is that I get a lot of External IP's been blacklisted every day. (average 7 IP's a day are blocked)

I have set the expiration timer to be in a few years time but that still has not stopped the authentication failures. I can confirm that User agents that are trying to authenticate are not a device that I am aware of or part of my network.

e.g
The IP 64.145.94.124 on PBX mypbxfqdn.3cx.com has been blacklisted and will expire on 2022/12/06 15:19:17.

Affected Module: SIP Server

User agent: 3CXPhoneSystem <-- not sure why another 3cx user is trying to register to hosted instance unless they are hackers.

Reason: Too many failed authentications!

Since this is hosted by 3CX, I cannot control the Firewall rules to block all inbound connections on port 5060.

Do you have any tips on how I can make my hosted environment more secure and reduce the authentication attempts?


Kind Regards,
SS01

 

[AWS2P]

Nothing else than enable global blacklist in console if not already done.
Now as you choose 3CX hosted, settings are not all available, this is not fully in your hands but in 3cx team, so if you want to have full settings available, self host your VM on your own

 

[NickD_3CX]

Do you have any tips on how I can make my hosted environment more secure and reduce the authentication attempts?

Yes, first of all, avoid posting your real FQDN on a VoIP PBX Forum publicly, you are just inviting people to have a go at your system.... (I removed it for you)

As an extra measure, enable Global Blacklist to take advantage of the very large list of already known "bad" IPs.
Prefer using SBC/Apps that use the 3CX Tunnel, which means you do not need to uncheck the option "Disallow use of extension outside the LAN".

Last, and probably the most important, never manually generate the password for your extensions, leave them random.

 

[cobaltit]

So with 4 Billion+ IPv4 addresses I would hardly call 7 a day a lot . You'd be surprised at how many hits you'd get on your home internet. Don't use a stupid simple admin password, turn on the global blacklist, keep 3CX settings at default (complex passwords, etc) and keep it up to date.

 

[SS001]

HI All,

Thanks for this support. I will enable Global Blacklist.

Kind Regards,
Shanika Silva