DESCRIPTION
Summary
As we introduce public VoIP peering capabilities (such as the previously proposed e164.org ENUM routing engine), our custom PBX will become increasingly vulnerable to malicious internet traffic. We need to implement a native, embedded PBX Firewall / Session Border Controller (SBC) module. This security engine must police incoming SIP signaling (UDP/TCP/TLS 5060-5061) and RTP media streams (UDP 10000-20000), protecting the core PBX telephony logic from SIP scanning, distributed denial of service (DDoS) attacks, brute-force registration attempts, and unauthorized toll-fraud exploitation.
Key Architectural Requirements
1. Dynamic Network Access Control Lists (ACLs) & Whitelisting
- Implement a multi-tiered ACL mechanism that validates incoming packets before parsing the SIP application layer.
- Explicitly allow the administrator to lock down incoming SIP trunking/peering traffic exclusively to trusted source IP addresses or network subnets (e.g., specific carrier gateways or direct enterprise peers).
- Anonymous SIP Disallowance: Provide a global toggle to automatically reject unauthenticated inbound
INVITE requests unless they originate from explicitly whitelisted network ranges or validated peering domains.
2. SIP Rate Limiting & Intrusion Prevention System (IPS)
- Monitor and throttle the volumetric processing of unauthenticated inbound traffic.
- Establish standard rate-limiting thresholds (e.g., maximum 20 SIP requests/second per source IP address). Exceeding these thresholds should trigger an automatic, temporary IP drop/ban via kernel space (
iptables or nftables bindings).
- Detect pattern signatures indicative of malicious scanning software (e.g., SIP Vicious toolsets hunting for active extension ranges).
3. Topology Hiding & Header Sanitization
- The SBC component must decouple the public-facing transport interface from the internal PBX application architecture.
- Rewrite critical SIP headers (such as
Via, Record-Route, Contact, and User-Agent) on all outbound packets to strip out internal server hostnames, private local IP addresses, or sensitive software version identifiers.
4. Stateful Back-to-Back User Agent (B2BUA) Media Anchoring
- Enforce symmetric RTP handling to prevent media hijacking.
- The system must force both sides of a peering call to terminate media directly at our network boundary (acting as a media proxy), opening up RTP ports dynamically on a pinhole basis and closing them immediately upon session termination (
BYE).
Relevant Technical Standards & References
1. Official RFC Specifications
2. Open Source Ecosystem Implementation Paradigms
- Kamailio / OpenSIPS Architecture Guides: Industry benchmarks demonstrating high-throughput SIP routing proxy structures, topology hiding configurations, and user-space rate-limiting implementations.
- Fail2ban Integration Guides: Reference architectures showcasing how to programmatically read application-layer SIP logging to orchestrate lower-level system firewall rules.
Definition of Done (DoD)
DESCRIPTION
Summary
As we introduce public VoIP peering capabilities (such as the previously proposed e164.org ENUM routing engine), our custom PBX will become increasingly vulnerable to malicious internet traffic. We need to implement a native, embedded PBX Firewall / Session Border Controller (SBC) module. This security engine must police incoming SIP signaling (
UDP/TCP/TLS 5060-5061) and RTP media streams (UDP 10000-20000), protecting the core PBX telephony logic from SIP scanning, distributed denial of service (DDoS) attacks, brute-force registration attempts, and unauthorized toll-fraud exploitation.Key Architectural Requirements
1. Dynamic Network Access Control Lists (ACLs) & Whitelisting
INVITErequests unless they originate from explicitly whitelisted network ranges or validated peering domains.2. SIP Rate Limiting & Intrusion Prevention System (IPS)
iptablesornftablesbindings).3. Topology Hiding & Header Sanitization
Via,Record-Route,Contact, andUser-Agent) on all outbound packets to strip out internal server hostnames, private local IP addresses, or sensitive software version identifiers.4. Stateful Back-to-Back User Agent (B2BUA) Media Anchoring
BYE).Relevant Technical Standards & References
1. Official RFC Specifications
2. Open Source Ecosystem Implementation Paradigms
Definition of Done (DoD)
iptables/nftables) to execute real-time bans on abusive source IPs.INVITEfrom an untrusted IP address is safely blocked with a403 Forbiddenresponse or dropped silently without hitting the deep application dial-plan engine.