firewall configuration

[next2]

Hi,

On our 3cx cloud instance, we see many failed authentications and blacklisted IPs.
I think it would be safer to only authorize authentications coming from the 3CX tunnel and, for generic devices, from our public IP address.
We already accept TCP 5060 and UDP 5060 from our public IP address only, but we still see authentication attempts going through ...
Can you tell me which protocol/port is used for authentication ?

Thank you !

 

[eddv123]

Full list of 3CX ports:
https://www.3cx.com/docs/ports/

We mostly use VPN from the cloud using software but do the same and open up ports for trusted IP's only.

 

[next2]

Thank you for your message... As incoming traffic on TCP 5060 and UDP 5060 is accepted onluuy when soource IP is our WAN public IP, I suppose that another port is used for authentication, but I can't find which one... I'll also apply the same restrictions on TCP 5061 (secureSIP) and hope this will help.

 

[eddv123]

Authentication being SIP authentication ? this should be SIP 5060 also.