White List vs Black List

[Bob Denny]

Our switch is publicly visible as we call in from the road via 4G/5G mobile data (Bria SIP phones), public WiFI (yes we know the risks) etc. Meanwhile the switch busters are constantly trying to break in, resulting in a steady stream of auth and request caused blacklisting. I looked in the manual but it is unclear how the white list vs black list rules are applied. Suppose I blocked everything 0.0.0.0/0.0.0.0 with a blacklist entry, then I add white list entries for our office net and Verizon mobile data. Before I waste my time and cause problems here in the office, can someone explain how the rules are applied. Do white lists override black lists or ???

 

[leejor]

I'm not certain that doing blanket blacklist on 3CX is the best option, or that the whitelist will override (never tried it). Generally blocking everything, BUT... is best done on a router or firewall.

 

[Bob Denny]

I would except the phone switch is running on Google Cloud. I have no control over any firewall etc.

 

[YiannisH_3CX]

Hello @Bob Denny

Please note that white list IP addresses do override the blacklist entries however the 3CX server is not a firewall and should not replace a firewall. If you are running the 3CX on google cloud you can use the Debian IP tables to allow / Deny IP addresses.
https://www.3cx.com/3cxacademy/videos/advanced/security-with-3cx-phone-system/

 

[Bob Denny]

Is this what you mean?

https://cloud.google.com/vpc/docs/using-firewalls

 

[StefanW]

yes, but in your setup do not use 3CX to do this job of filtering. It will consume to much power.
Use the default OS firewalls (Windows Firewall or Linux IPtables) to do the job.

To your question, white list is over blacklist.
If set
Block: 0.0.0.0/0
White: 1.2.3.4/32

Only 1.2.3.4/32 will be allowed.

 

[dredd0606]

If you are running on Google Cloud, they have very robust firewall tools that you can customize to your hearts content, using the link you provided. They do not run on the VM, but rather as part of your virtual network. I greatly prefer offloading the firewall to google than using iptables on the pbx.

 

[Bob Denny]

Ah! I will look. I have been ultra busy. Right now I only have 28 blacklists.