Would be great to have some detail included concerning firewall rules / iptables rules. What I needed in the past - and hopefully realized manually - is a geoip blocking for sip and tls ports. Not really shure how and whether there is a need for rtp also. And in addition to be prepared for nft-tables once iptables will become end of life.