Set up the firewall

The switch has a built-in firewall that limits who can reach SIP, the web interface, TFTP, SSH and the database. You can also put an external firewall in front of the switch against DDoS and port scans. This page sets up both. Allow 20 minutes.

Before you start

• You have Administrator access to the root environment of the panel.
• You have the list of IP addresses that may reach the web interface, and the addresses of your customers’ and vendors’ SIP equipment.
• You know the public IP addresses of the switch.

Step 1: Restrict access with the IP Firewall

The IP Firewall holds allow and deny rules per type of access. Each type ends with a default rule for 0.0.0.0 with netmask 0.0.0.0, which means any address. The rules above it are checked first, top to bottom.

Type	Port	Default rule
Web	TCP 80, 443: web interface and the XML-RPC API	Allow
SIP/UDP	UDP 5060	Allow
SIP/TCP	TCP 5060	Deny
SIP/TLS	TCP 5061	Deny
TFTP	UDP 69: provisioning of IP phones	Deny
SSH	TCP 22, for the whole switch	Deny
DB	TCP 5432, for the whole switch	Deny

“Allow” for any address does not let anyone in without a password: it only makes the login page or the SIP port reachable.

1. Open System Management → IP Firewall.
2. Select the tab of the type, for example Web.
3. Click Add Rule and enter IP Address, Netmask and Description. Set Rule to Allow. Use netmask 255.255.255.255 for a single address.
4. Repeat for every trusted address or network. Use Up and Down to order your rules.
5. Click Edit in the default rule, set Rule to Deny and save it.
6. Click Save.

Screenshot "operations/ip-firewall" has not been generated yet — see scripts/screenshots/screens.yml.

Result: only the listed addresses reach this service. The default rule cannot be deleted or moved; only its Rule can change.

Caution

Add your own address to Web before you deny the default rule, or you lock yourself out of the panel. SIP/TCP and SIP/TLS stay closed until you allow them, even when a TLS listener is set up.

Step 2: Open the ports on an external firewall

An external firewall must let through what the switch needs. Allow these incoming connections from the public networks:

Port	Protocol	Used for
5060	UDP, and TCP if you use SIP over TCP	SIP signalling
5061	TCP	SIP over TLS, if you use it
10000–65000	UDP	RTP media relayed by the switch
4569	UDP	IAX2, if you use it

Allow the switch to start outgoing connections from these source ports:

Port	Protocol	Used for
5061, 5065 and up	UDP	Outgoing SIP from the call processes; one port per process, 5062 to 5064 are skipped

Open these only for your own networks, if at all:

Port	Protocol	Used for
80, 443	TCP	Web interface and XML-RPC API; port 80 redirects to 443 and is needed to issue certificates
22	TCP	SSH console
69	UDP	TFTP provisioning of IP phones
161	UDP	SNMP monitoring. See Monitor the switch with SNMP
5432	TCP	Direct database access

Note

FlySIP support reaches your switch from a fixed set of addresses. Ask support for the current list and allow all traffic from it, otherwise support cannot install updates or help you.

Step 3: Test it

1. From an address you did not allow, open the panel. The connection must time out.
2. From an allowed address, log in to the panel.
3. Make a test call from a customer’s device and check that it connects with two-way audio.

What’s next

• Install an SSL certificate for the web interface
• Accept and send SIP over TLS
• Security management