AWS Lightsail Ports

[The Chief]

I've trialling AWS Lightsail and i have the below ports configured. The 3CX system has 6 phones on it, 4 are using an SBC at one office, but the 2 other Yealink T48G phones are going to use STUN. If i change UDP 5060 to be locked down to Gamma SIP trunk, it stops the STUN from working, should i only set a firewall rule for incoming on UDP5060 to Gamma? Not too sure where in AWS Lightsail that i can only have an incoming rule for 5060 UDP.
Add rule

Application	Protocol	Port or range / Code	Restricted to
SSH	TCP	22	Any IPv4 address Lightsail browser SSH/RDP
HTTP	TCP	80	Any IPv4 address
HTTPS	TCP	443	Any IPv4 address
Custom	TCP	2528	Any IPv4 address
Custom	TCP	5001	Any IPv4 address
Custom	TCP	5015	Any IPv4 address
Custom	TCP	5060 5061	Any IPv4 address
Custom	TCP	5090	Any IPv4 address
Custom	UDP	5060	Any IPv4 address
Custom	UDP	5090	Any IPv4 address
Custom	UDP	9000 10999	Any IPv4 address

 

[VasilisV_3CX]

Hi @The Chief,

Are the IPs at the STUN site static or dynamic?

Not too sure where in AWS Lightsail that i can only have an incoming rule for 5060 UDP.

Are you unable to set up multiple rules here? I didn't understand.

Also please note that the following ports can be removed from the list:

1. 80
2. 5015
3. 5001 (IF you are using 443)

 

[The Chief]

They will be dynamic but i could set them as static if needed.

I'll delete the ports 80, 5015 and 5001 as i am using 443.

I can setup other rules, but it doesn't have inbound and outbound rules. I was concerned in just locking down port 5060 for my sip trunk provider?

 

[VasilisV_3CX]

If they could be set to static IPs, why not do so and then whitelist them?

Alternatively you can use a SBC.

 

[The Chief]

Thanks VasilisV i will set them as Static and add them to the whitelist. Thanks for your help.

 

[VasilisV_3CX]

No problem @The Chief, let me know if you have any problems.