Restrict calls from bridge

[leonp]

Hi,

I have a need to setup a bridge with a remote asterisk server, to allow internal to internal calls with a partner we work with.

While I have set this up ok, my partner is able to make outbound calls to any destination via the bridge, rather than only being allowed to call internal extensions.

Is there a way I can change this behaviour to restrict this?

Thanks.

 

[eddv123]

Hi Leonp,

The only thing of this nature that can be done on the 3CX end is restrict via an Outbound rule to the bridge. This can be done by restricting from:

* Calls from extension(s).
* Calls to Numbers with a length of.
* Calls from extension group(s).

 

[leonp]

Thanks.

So I did try adding the extension group DEFAULT to my outbound rule which allows calls to the SIP trunk, however the users at the other end of the bridge were still able to make outbound calls.

It isn't feasible to manually add extension numbers and I'm not sure how I could do it with calls of a certain length.

Did I need to restart something after adding the extension group to the outbound rule perhaps?
Is the bridge considered part of the DEFAULT group?

Thanks,

Leon

 

[eddv123]

By "other end of the bridge" I assume you mean the Asterisk end ?

If yes this is one of the limitations to Bridging 3CX to a non-3CX PBX, you won't get the functionality at the other end unless it is another 3CX PBX. You could maybe work something out with Asterisk but I find that Asterisk Systems take a lot of development and support for the system is scarce (unless you want to find an expert and pay big bucks!).

 

[leonp]

I'm not sure what functionality you are referring to, but as the system admin of my own 3cx system, I should have the ability to control what any user (local extension or bridge) can or cannot dial.

Currently, if the Asterisk server at the other end is configured such that their users can dial any number and that call is forwarded across the bridge, then my 3cx system will process that and allow it to dial out to external numbers.

 

[eddv123]

If you are talking about the 3CX end then perfectly fine to do this. What you are doing with the Outbound rule is restricting who and what can dial across the bridge, not what is coming back.

 

[leonp]

I've attached the outbound rule that I have.

With this rule, I would not expect calls across the bridge to be able to dial numbers beginning with 0 because the bridge extension (10001) is not part of the DEFAULT extension group (as far as I can tell).

Am I missing something?

Thanks.

 

[YiannisH_3CX]

10001 is a system extension though that is used by bridges and trunks and it will not affect the outbound rules so calls starting with 0 will still go out.
What is the extension range of the Asterisk PBX and what is the extension range of the 3CX?
Do they have the same length ? And obviously we do not know what the Asterisk PBX is sending and what information we can use from the Invite to restrict access to the trunk. A wireshark capture might be needed to determine the correct outbound rules needed to block access to the trunk.

 

[leejor]

While I have set this up ok, my partner is able to make outbound calls to any destination via the bridge, rather than only being allowed to call internal extensions.

So...this has me understand that the Asterisk PBX is calling over the bridge, and out over your outbound trunks, is this correct?

If that is the case, then what rules are they using at the far end? If an access digit (?+1234) rings your 3CX extension 1234, then who (at the far end) set up a rule to allow an outside call over the bridge? Are they doing this deliberately after you asked them to stop? It should not be a choice of the far end user, it has to be by design, of whoever creates the routing rules at the far end.

Outbound rules at the 3CX end can be restricted to certain extensions, even if that is a range, that includes all local extension numbers. Have you tried that?

 

[leonp]

10001 is a system extension though that is used by bridges and trunks and it will not affect the outbound rules so calls starting with 0 will still go out.
What is the extension range of the Asterisk PBX and what is the extension range of the 3CX?
Do they have the same length ? And obviously we do not know what the Asterisk PBX is sending and what information we can use from the Invite to restrict access to the trunk. A wireshark capture might be needed to determine the correct outbound rules needed to block access to the trunk.

Extensions at remote end are 3XXX. Extensions at local end are 4XXX. See below for some more context.

So...this has me understand that the Asterisk PBX is calling over the bridge, and out over your outbound trunks, is this correct?

If that is the case, then what rules are they using at the far end? If an access digit (?+1234) rings your 3CX extension 1234, then who (at the far end) set up a rule to allow an outside call over the bridge? Are they doing this deliberately after you asked them to stop? It should not be a choice of the far end user, it has to be by design, of whoever creates the routing rules at the far end.

Outbound rules at the 3CX end can be restricted to certain extensions, even if that is a range, that includes all local extension numbers. Have you tried that?

Yes, you are correct. Please understand that this is not currently happening, but I have no control over the remote PBX and so I am trying to protect myself from someone at the 3rd party doing this, even if by mistake.

I have attempted to restrict my outbound rule to extensions which are a member of the DEFAULT group as shown in my screenshot - so am I wrong to expect that this should be enough to prevent this from happening?

I'll provide a SIP trace shortly.

 

[leonp]

IP of remote PBX has been replaced with XXX.XXX.XXX.XXX
Local IP of 3CX has been replaced with YYY.YYY.YYY.YYY
SIP trunk provider IP has been replaced with ZZZ.ZZZ.ZZZ.ZZZ
Public IP of 3CX has been replaced with WWW.WWW.WWW.WWW
07891444444 was the number called from the phone extension at Asterisk Server from user "Neil/3170"

In the attached file...

Line 1 - INVITE comes in from remote PBX to dial external number.

Lines 31, 43, 56 - The INVITE is repeated with the appropriate authentication.

Line 87 - 3CX attempts to connect the call to SIP Trunk Provider

Line 113 - 3CX informs Asterisk that it is attempting the call.

 

[leejor]

It is an interesting question...one i have not tested.....if the same extension number exists on the "bridged" PBX, does 3CX know to allow only the local extension with the same number, and not the remote extension? Is "screening" in the outbound rules, based on Caller ID, the INVITE, or something else. I'm going to suspect it will be the latter.

Sorry...added all that before i saw the above post.

So, you have the outbound rules restricted to only the local range of extensions, yet a call from an extension on the other PBX gets through?

 

[YiannisH_3CX]

Try the following and let me know if that works.
Create an outbound rule at the very top of the list and set the "Calls from extensions" field to 10001 and make sure all routes are set to "BLOCK CALLS"

 

[leonp]

Hi,

I tired exactly as you suggested and then also tried adding "0" to the prefix as per the attached image.

The outbound call was still attempted.

Leon

 

[YiannisH_3CX]

Ok in that case you need to create a Outbound rule that included all extensions in the remote site and block them. Something like the example in the screenshot

 

[leonp]

Hi,

I'm not in a position right now to test this, but I will do so and report back.

It does occur to me however that I am reliant on the remote system always sending their normal extension numbers as caller ID, which means that implementing it this way takes it out of my control.

I'm a bit surprised that this isn't a simple thing to do. Question still remains - why does my default outbound rule which is restricted to members of my DEFAULT group, still allow calls from the bridge which I understand is not in the DEFAULT group.

Leon

 

[YiannisH_3CX]

Obviously the system is designed to work as a bridge with another 3CX PBX and when using 2 3CX PBX's if the same extension number is not part of the Default group the calls is dropped.
I have never tested it with an Asterisk PBX so i cannot be sure why this does not work. We will need to see the PBX logs in verbose to be able to determine what the PBX is doing internally in your scenario that allows the call to go through.
Also when you have a bridge with another system you should be able to control both sides. Even if the other side of the bridge was a 3CX PBX the first thing i would recommend was to block the calls in that side of the bridge.
You currently have a bridge with a system that can send calls to your trunks without permission. If that was my system that is what i would be concerned about.

 

[leonp]

Ok - how would I gather those logs to help with this further?

With regards your last comment, I am concerned about it, hence this forum post Since I cannot control the other end, I want to restrict it at my own system.

 

[YiannisH_3CX]

Please check your inbox as i will send you a p.m. with what we need and how to get the files to me.