Auto Whitelist IPs as trusted zones

FreePBX Endpoints
1

I am seeking out guidance for being able to auto whitelist remote IPs.

Here is my setup:

  • Cloud Hosted FreePBX
  • Built in Firewall Enabled. Intrusion Detection Enabled.
  • Two remote locations that use Starlink as their ISP.

For all that do not know, Starlink constantly changes the public IP address at these locations, so I am whitelisting the Network Zones for these remote locations daily. If I do not add these new IPs to the Trusted Network Zone, the phones are no longer able to dial out. However, all inbound calls to extensions remain in tact after the IP changes.

My intrusion detection works as expected and has the feature enabled to auto-whitelist IPs from extensions that successfully register. However, this does not work as a two-way sync between Intrusion Detection and Trusted Network Zones. Does anyone know of a setting or feature I can enable that will automatically trust the Network Zone of a remote location in which the extension successfully registers?

2

What transports and ports are you listening/answering on?

3

PJSIP
UDP for transport

Ports 5060 and 5061 respectively

Edit: added UDP

4

Do you have responsive enabled for pjsip in the firewall? This is pretty much why it exists.

5

Screenshot 2024-10-08 at 12.50.04 PM
Screenshot 2024-10-08 at 12.50.04 PM2242×952 243 KB

It appears so. This is what I was anticipating would make it work.

6

I went to my VOIP doctor and said " Everytime I accept UDP:5060-5099 I get hurt by floods of bogus calls", he answered “No Shit !”, so I said “So what can I do?” , and he said “Try not using that transport!”, so I didn’t and what do you know ? IT MAGICALLY STOPPED HURTING!!

7

Thanks dicko

We set up Wireguard on our remote site routers to a site with a static IP.
Then, we send voice traffic over then connection. Keeps the firewall list simple.

8

You could always whitelist i.e. 98.97.0.0/16 subnet in the firewall, assuming the rotating IPs are at least within the same scope.

Turn off the responsive firewall, I would also change the listen port as Dicko said.

9

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.