SIP URI Incoming calls - Open to attacks?

[hernanp]

Hi everyone. I've been experimenting with receiving calls via sip uri into my 3CX. Caller would call DID@FDQN and, if an incoming route is defined with that DID, call will be accepted and routed.

I think that calls should only be accepted from validated IPs. Am I wrong? Could anyone flood my 3CX by sending thousands of calls to that SIP URI from random IPs?
Could this be a security issue?

I'm not an expert, but I recall, in Asterisk, you would route IP calls from unknown IP addresses to a specific context....

Hopefully the question makes sense.

Thanks!

 

[dkdocks]

IP's will be blacklisted for too many requests for X time, as well as global blacklist etc..

 

[leejor]

If you open up to Direct SIP calls, then this is a possibility. Hackers (not a "wanted" caller) will generally not be using your URL, they will be targeting your IP, at random. I've found that , while some do try to call a valid extension number, the vast majority are attempting to place an outgoing call (that's where the money is), to an international format number, which, for most 3CX installs, is not going to work.

If you publish your numbers somewhere as XXX@FQDN, then yes , of course, you run the risk of someone seeing that, and then trying other numbers. Most hack attempts, are, however, automated and sequentially "test" IP's to see if port 5060 responds before making some registration or call attempts.

If there are only specific IP's that you wish to receive Direct SIP calls from, them you may want to invest in a properly configured firewall, to block all but those.

 

[hernanp]

Thanks Leejor! So, there is no built in firewall in 3CX to allow only certain IPs?

 

[leejor]

Some have tried blocking all IP's, and then using a whitelist, to what success, I'm not certain. You might do a search through the forum. While 3CX is very good at blocking (and recording) hack attempts, it is still not a proper firewall. If you permit direct SIP calls, and one is detected to a valid destination , then 3CX would have no reason to block it.

 

[cobaltit]

Thanks Leejor! So, there is no built in firewall in 3CX to allow only certain IPs?

There is the blacklist and whitelist, but 3CX is not a firewall. If you want a firewall to do that, then put a firewall in front of 3CX.

 

[vincen]

If you permit direct SIP calls, and one is detected to a valid destination , then 3CX would have no reason to block it.

Sorry for naive question from a beginner but isn't there an easy way to setup 3CX to allow only local extension access from these direct SIP Calls ? to avoid any risks of outside calls made by these direct SIP calls !

Thanks

 

[leejor]

At this point, if you enable Direct SIP calls, it allows both internal and external.

Keep in mind that unless a hacker has a vendetta against your particular company, most don't want to simply call your extensions. They want to be able to dial out on your trunks to place international calls, that's where the money is, and 3CX is very good at blocking that.

Direct SIP calls from a hacker, will probably be to your IP, rather than your URL..