Firewall Rules In Google Cloud Platform

[The Chief]

Hi All - I'm new to 3CX and I have an issue with SIP Attacks to my system. I setup in Google Cloud and my VM Instance is working, the firewall comes back from 3CX as all green, my Gamma sip trunks are pointed at the public ip address of my instance.

Everything works, I can dial out and in, all my phones that are connected are remote phones/app/web client. Since connecting my SIP Trunks I keep getting emails from 3CX saying that some ip addresses have been blacklisted.

Like I say I'm new to cloud providers/hosted VM instances, the firewall rules in GCP have all the ip address ranges set to 0.0.0.0 for all ports ( ingress 0.0.0.0 tcp 443/ ingress 0.0.0.0 tcp&udp 5060 ) etc etc...

Do I need to set the firewall rules on all ports to only allow calls in and out from Gamma , who my SIP trunks are with? Do I need to make an outbound rule as well?

Any help or guidance would be greatly appreciated.

 

[JohnS_3CX]

Hello,

This is expected in the world of SIP, attackers always try to hijack systems to take over control.

3CX has built-in security that detects these attempts and blocks them. This is why you get those emails, and you will see them often, for as long as attackers exist. We also provide the 3CX Global Blacklist that is updated daily with known attackers, and you will not even get an email for those attacking IPs because the system ignores them by default.

You can set a specific rule for 5060 such that your SIP port only talks to the provider's IP but this is not always desired, as any remote extensions that rely on it will be left out. Our apps can talk to the PBX via the 3CX tunnel so they are not affected, but a STUN phone sitting behind a dynamic WAN IP will not be able to talk to the PBX on 5060. If you don't use STUN phones or any other devices that need to talk directly to 5060 you should be ok. This means you will stop seeing those attempts being made, but you have to take care if you use hostname registrars like sip.provider.com instead of an IP address. This is because if they ever change their IP your rules will become invalid and your calls will stop.

As for instructions, this depends on the specific host you use, but I'm sure you can look up the google documentation on best practices and how-to's.