Block Authentications by country

[FuTech-Nel]

I am running 3CX v18.0 (Build 314) on Debian OS 18.

We have been receiving multiple IP blacklist emails. Upon inspecting the IP addresses, we have learned that the attempts are coming from outside the US.

Is there a way I can block authentication attempts from outside the US?

 

[SweetAction]

You could enable the global blacklist. No country blocking exists, but you could also import IPs to block and just make a list of ranges from outside the US.

 

[SteveITS]

If it's self-hosted you can block countries in your office/data center firewall.

 

[leejor]

Unfortunately many IP address ranges can span several countries/regions. It certainly would make it a lot easier, from a security point of view, if there was a simple listing, and fixed range for each country, but as we run out of IPV4 addresses; they go to whoever needs them.

As you can see by this...

https://lite.ip2location.com/ip-address-ranges-by-country?lang=en_US

They can jump all over the place.

 

[ChrisC_3CX]

Just want to add that enabling the "Global Blacklist" would definitely be the first thing to do to increase security. You could also consider using console restrictions in the security settings to lockdown Management Console access to only specific IPs.

Blocking specific ranges in theory should work but as @leejor said, in the real world might be extremely difficult or outright impossible. I'm not sure if you could use features such as geo-location on the firewall to achieve something similar to what you're looking for but this is anyway configuration outside of 3CX.

For general information on how to harden your PBXs security I would suggest maybe taking a look at this guide: https://www.3cx.com/docs/voip-security/