PBX — Security Best Practices

Overview

VoIP systems are frequent targets for toll fraud, credential stuffing, and DoS attacks. The SipLive PBX includes multiple protection layers, but correct configuration is critical.

Firewall Rules (Open Only What's Needed)

• 5060/UDP — SIP (restrict to known carrier IPs where possible)
• 5061/TCP — SIP/TLS
• 8089/TCP — WebRTC WSS
• 10000–20000/UDP — RTP media
• 443/TCP — HTTPS portal
• 22/TCP — SSH (restrict to management IPs only)

Fail2Ban

Monitors Asterisk security logs and blocks IPs after repeated failed auth attempts.

• Watches /var/log/asterisk/security for SECURITY events.
• Bans after 5 failed attempts within 60 seconds.
• Ban duration: 1 hour (3600 seconds).

fail2ban-client status asterisk          # View active bans
fail2ban-client unban <IP>              # Unban an IP

Strong SIP Credentials

• Minimum 16 characters with mixed case, numbers, and symbols.
• Avoid patterns derived from extension numbers.
• Rotate credentials after staff departures.
• Never reuse passwords across extensions.

IP Authentication for Trunks

Use IP-based auth for carrier trunks wherever possible. IP-auth trunks only accept calls from the carrier's known IP range — immune to credential theft. Allowlist carrier IPs in the firewall or PJSIP endpoint's contact_acl.

SRTP and TLS

• SRTP is mandatory on all WebRTC (WSS) endpoints.
• Enable TLS for trunk transport when the carrier supports it.
• Use CA-signed certificates (not self-signed) on ports 5061 and 8089.
• Renew Let's Encrypt certificates before their 90-day expiry.

Toll Fraud Monitoring

Watch for these patterns in CDR reports:

• High volume of short calls to international numbers.
• Calls to premium-rate numbers (900, 976, high-cost international).
• Off-hours calling from extensions that normally don't call at night.

Set maximum daily spend limits with your carrier and enable CDR alerts for anomalous call volumes.