Is it necessary to block all SIP traffic other than from provider?

[Fred2k]

I'm currently setting up a test 3CX system, and was reading this article about setting up the firewall. From the below image it looks like your're supposed to lock down SIP and media traffic so that it only comes from your SIP provider:

We use Gradwell as our SIP trunk provider, and I asked them for a list of IPs so that we can block all SIP traffic other than from them. They sent me this article which says "Gradwell does not recommend you filter VoIP traffic by IP because our network is dynamic and liable to change without notice"

So I just wanted to find out how other people set this up, and if this poses any sort of security threat i.e. leaving ports 5060 and 9000 - 10999 open from any external IP?

 

[Wendelspanswick]

We used to leave 5060 open till we realised you could lock it down to a single SIP provider IP, all that happened was the Blacklist used to fill up pretty quickly.

 

[Fred2k]

Thanks for response.

How does 3CX know what to blacklist and what is genuine?

 

[Wendelspanswick]

Thanks for response.

How does 3CX know what to blacklist and what is genuine?

I'm guessing that the correct senders IP registration address is not in the incoming SIP header.

 

[leejor]

There are several parameters in the Blacklist options. Those are what determines when an IP is placed on the list, and for how long. In many cases it is because of the use of an incorrect password (for registration) being attempted too many times.

https://www.3cx.com/docs/allow-deny-ip-addresses/

While limiting access to only your provider sounds ideal, if you have remote extensions, especially from dynamic IP's, this will not be a good solution for you. There are lots of things to take into consideration.

 

[haywardi]

I lock SIP to the range of IP addresses provided by my VOIP provider. The real problem is getting the correct list from your provider, mine supplies from several different blocks & ranges. This is a nightmare to set up on the firewall but once complete no more hacking. I found blacklist difficult and not preemptive, i.e. it has to recognise a hack before it blocks which still leaves you open to 'if they get it right quickly enough, they will get in' a chance I was unwilling to take.

 

[leejor]

I go though that Blacklist every once in a while and make the entries permanent (change expiry to 20 years in the future). The default blacklist expiry time should also be set to a few days, or longer.