Should I place the 3CX PBX behind a Firewall/NAT or should I put it directly on the internet?

[Eiden]

Hi there,

pretty sure this is a dumb question but there we go:
We have 5 IP public IPv4 addresses which we can use do our desire. I have the following options for deploying the 3CX PBX deployment:
- Behind a pfSense firewall (I would assign one of the IPv4 addresses to the WAN interface of the pfSense and then portforward the required ports)
- Straight on the internet with a static IP (I would assign one of the IPv4 addresses to the interface of the 3CX VM. No firewall and no NAT. Does 3CX include some kind of basic firewall?

What's your take on this? Which way should I go?

 

[Saqqara]

I would always put servers behind a firewall, this way the firewall protects the server and your network.

Info on setting up PFSense for 3CX - https://www.3cx.com/docs/pfsense-firewall/

 

[JohnS_3CX]

Hi Eiden,

3CX does have various types of protection from hacking, but they are not the same as a firewall.

Either way can work of course, but if you set up your ports correctly you can stay behind the firewall and have an additional layer of protection which is always a better idea than leaving it entirely exposed.

 

[Eiden]

Thanks John! Will do so. I am currently following the guide posted by Saqqara and so far it is looking good.
Thanks again!