Strange calls from internal number

[Sepultura]

Hi,

one of our extensions (341) had a large number of strange calls during weekend. Calls came from various numbers like 100, 200, ..., 101, 201, ..., 1000, 2000, ...
Any idea what happened here? So far I could not find any hints for a server breach via ssh.

 

[Alphabetic]

https://www.3cx.com/community/threads/information-to-provide-when-requesting-help.67558/

 

[VasilisV_3CX]

Hi @Sepultura,

This seems that these caller IDs 100, 200 etc may be fake caller IDs, which seems to be run by a tool.

If you're not using STUN, I'd suggest limiting port 5060 SIP port to only the IPs used by your SIP trunk provider.

We've seen cases where port 5060 was being forwarded to the 3CX SBC on remote sites. This would allow attempts to reach port 5060 on those sites to reach the 3CX PBX via the 3CX Tunnel.

 

[Sepultura]

Hi,

port 5060 is not used by clients to connet to 3CX, only by the trunk providers?
Where are firewall rules on the 3CX Debian image located?
Still I do not understand how an not authenticated client can start calls

 

[VasilisV_3CX]

For all the apps and via SBC, port 5090 is used.

Only direct SIP / STUN, and SIP Trunk providers use 5060.

We don't recommend using the Linux Firewall, rather make the changes on the Firewall that sits between the Instance and the Internet.