Limit phone registration to LAN (v20)

[budtz]

Hi,

I would like to limit IP phone and 3CX softphone registration to my on-premise 3CX PBX to LAN IPs only. The option mentioned in this post - "Block remote tunnel extensions" is no longer present in v20. There's a "Block remote non-tunnel connection" which is checked by default, but nothing regarding tunneled connections. Any ideas?

Casper.

 

[Alphabetic]

That option would prevent STUN devices.
Locking down 5090 on your firewall would prevent external tunnel connections and 5060 to anything but your SIP provider will prevent registrations externally.
Make sure you've got split DNS set up so your devices can resolve FQDN internally.

 

[budtz]

I've already got all incoming 3CX ports locked down to my SIP provider and my 3CX softphone indeed wont connect when I am not on LAN. However it still rings when I call it although I can't actually take the call. I guess this is being done via fpo.3cx.dk which is my external PBX?

 

[SweetAction]

I've already got all incoming 3CX ports locked down to my SIP provider and my 3CX softphone indeed wont connect when I am not on LAN. However it still rings when I call it although I can't actually take the call. I guess this is being done via fpo.3cx.dk which is my external PBX?

Ringing happens with a push notification from Google/Apple, not from the PBX. Some things in the app happen over tunnel (5090) and some happen via management port (5001/443), so to prevent app users 100% make sure to block those 2 ports from external users before they can register the app.

If they already registered, a regenerate on the extension should invalidate it.