Properly securing your router/firewall with UDM PRO (need help please)

[Hgesser]

Hello, sorry for the very newbie question here.

I just started with unifi, an UDM PRO. I am trying to setup port 5060 to only be allowed to provider public IP, but I am having difficulties in figure out how to do this with UDM.

Could you please give me a hand?

What else do you recommend I do with the UDM, in regards of ports or any other recommendations? I am loving the unifi and the 3CX but this is a different beast to what I am used to and am afraid I wont be securing the 3CX properly.

Thank you SOOOOO very much!!!

 

[cobaltit]

As this is a UDM question, you would be better off asking in the Ubiquiti forums.

 

[Hgesser]

I tried, but it seems like no one in the forum is using UDM pro with 3cx... Thanks though, I truly appreciate your reply and I will keep trying. I did do a few things in my UDM, but I honestly don't know if I have properly protected it. I was hoping someone here would know better.

 

[cobaltit]

But this has nothing to do with 3CX. If you had ANY SIP provider and ANY PBX behind it it would be the exact same steps.

 

[Hgesser]

Understood. This is my first time trying 3CX, or anything like it, I am really a newbie, trying to save money since our business is closed due to the pandemic and we need to cut expenses. I thought these forums would be the perfect place to find help. I got everything working, everything. Now I just wanted to make sure that the system is secure.

Forgive me, I didn't know where to look for help, still don't know. Clearly this isn't the right place to ask for help.

Thanks again and have a great week.

 

[cobaltit]

3CX out of the box is already secure. Doing what you are trying to do is 'extra' that is not needed unless you are especially paranoid or have some compliance requirement. As long as you stick to the 3CX defaults with complex passwords, disabling remote extensions, restricted country blocking, etc you should be fine.

 

[Hgesser]

Thanks for that. That is what I have been reading. BUT I am having a lot of attacks on port 5060 and a couple others... which alerted me to look for help. Thanks!!

 

[cobaltit]

You are not getting specific attacks. Those automated scans were happening before you even heard about 3CX even if you move 3CX to the cloud they will still be scanning the default SIP port. Nothing to be concerned about. Keep 3CX current, keep with the defaults, turn on the global blacklist and ignore the messages.

 

[cobaltit]

As far as restricting traffic, this isn't 3CX specific, nor is it even VoIP specific. The same method for restricting traffic applies to any incoming traffic to any port/service. Which is why I recommended the Ubiquiti forums. And in your case, if this is for your business, then I don't see why you wouldn't take advantage of the free 3CX hosting and then you wouldn't have to worry about any of this.

But in your case, assuming you created a port forward for the SIP traffic, it would make sense to fill out the field that says 'Limited':

 

[YiannisH_3CX]

As @cobaltit mentioned this is probably a question for the Unifi forums as we are talking about specific configuration for the UDM Pro.
I am sure there are plenty of online resources and YouTube videos explaining how to do this so all you need to know are the 3CX ports which you can find here: https://www.3cx.com/docs/ports/ so you can forward the correct ones and the IP(s) of your provider.
Also make sure that you do not have any remote phones configured via STUN as those will stop working once you limit 5060 to your providers IP.

What i would recommend is to port forward all the necessary ports and then run the 3CX firewall checker to make sure everything is configured correctly. That will give you a fallback point in case something wrong. Then limit port 5060 and check that you can still make calls and everything is still working. If something goes wrong then you can return to the working config.

 

[Hgesser]

You are not getting specific attacks. Those automated scans were happening before you even heard about 3CX even if you move 3CX to the cloud they will still be scanning the default SIP port. Nothing to be concerned about. Keep 3CX current, keep with the defaults, turn on the global blacklist and ignore the messages.

I would agree with you if all other ports were having the same issue. But over 500 in a day, for that port alone?

 

[Hgesser]

As far as restricting traffic, this isn't 3CX specific, nor is it even VoIP specific. The same method for restricting traffic applies to any incoming traffic to any port/service. Which is why I recommended the Ubiquiti forums. And in your case, if this is for your business, then I don't see why you wouldn't take advantage of the free 3CX hosting and then you wouldn't have to worry about any of this.

But in your case, assuming you created a port forward for the SIP traffic, it would make sense to fill out the field that says 'Limited':

View attachment 20193

Thank, you. This is what I thought. But this allows for just ONE IP only. My provider uses 2 IPs.

I guess I will have to use only one of their IPs and cross my fingers it works! Thank you.

 

[Hgesser]

As @cobaltit mentioned this is probably a question for the Unifi forums as we are talking about specific configuration for the UDM Pro.
I am sure there are plenty of online resources and YouTube videos explaining how to do this so all you need to know are the 3CX ports which you can find here: https://www.3cx.com/docs/ports/ so you can forward the correct ones and the IP(s) of your provider.
Also make sure that you do not have any remote phones configured via STUN as those will stop working once you limit 5060 to your providers IP.

What i would recommend is to port forward all the necessary ports and then run the 3CX firewall checker to make sure everything is configured correctly. That will give you a fallback point in case something wrong. Then limit port 5060 and check that you can still make calls and everything is still working. If something goes wrong then you can return to the working config.

Thank you! I appreciate it.

 

[cobaltit]

If you put in two rules, one for each IP, it should work. At least that's what it says in the UI forums:

Allowing multiple "From" remote IP's in port forward rule | Ubiquiti Community

 

[Hgesser]

YOU ARE A GENIOUS! I will definitely try that... You have no idea how many hours since yesterday I have been looking into forums looking for an answer... Also tried creating WAN IN and OUT rules (those I could add multiple IPs, but did not work), but never thought about creating two rules... I truly hope this works, truly do! THANK YOU!