Lots of failed authentications - how can we avoid this ?

[next2]

Hi,

On our 3cx cloud instance, we see many failed authentications (and then, blacklisted IPs).
I think it would be safer to only authorize authentications coming from the 3CX tunnel and, for generic devices, from our public WAN IP address.
On the virtual server's firewall, incoming traffic on TCP 5060 and UDP 5060 is accepted only when the source is our public IP address, but we still see authentication attempts going through ...
So it means that another protocol/port is used for authentication, but which one ?

Thank you !

 

[cobaltit]

There is a really good article on the ports and what they are used for here:

https://www.3cx.com/docs/manual/firewall-router-configuration/

It's your firewall so only you can tell what ports are actually open to the world. Since you asked about authentication, here's a hint. How do you access the PBX?

 

[AWS2P]

on AWS lightsail, i've completly removed 5060 rule in VM firewall as it is not possible to specify an IP restriction on lightsail, for now not seen problems.
I have only SBC and APP using 5090

 

[Pierre_3CX]

Hello,
Additionally I would suggest to enable the Automatic Global 3CX IP Blacklist feature in your PBX from Settings / Security, so that your PBX blacklist is synced with our known list of offenders.