Cloud providers and firewalls

[Chris Fella]

Hi all, What are peoples experience using the cloud for 3cx? Specifically about whether to have firewall rules or just use 3cx/debian.

I know that ovh is cheap and works well but but not support ip ranges in firewall rules for RTP for sip providers so have to have those ports open to all?

TIA
Chris

 

[cobaltit]

Is OVH really that much cheaper than Lightsail? And are you trying to say you are worried about your PBX being hacked via the RTP ports?

 

[Chris Fella]

We have resisted using cloud PBX's because of security concerns. was just wondering what others are using. OVH doesn't provide an meaniful firewall of the server. Only very basic rules.

Do most have site to site vpn to their cloud PBX?

Does lightsail give you firewall rules for ranges of ports and support site to site VPN?


thx

 

[cobaltit]

I guess I don't understand the security concerns as far as what are you actually risking? Toll Fraud? If you really care about security then you don't start at the low end of the hosting providers (OVH) because as you noticed they don't have the features you are looking for. Lightsail has a basic firewall with port ranges (but no IP range restrictions) and no VPN. If you want a fully configurable firewall configuration and site to site VPN capability you are looking at AWS, Azure or GCP. All of this is documented by each provider.

But if you are on a budget then use OVH and then use the IP Blacklist and admin console restrictions to lockdown your instance. A brand new 3CX install will set complex passwords for endpoints which is going to be your most common attack vector.