Firewall around configuration interface in 17

[penguinpbx (C. Maj)]

Breaking this out from a post in another thread:

@tmittelstaedt

I’d also point out that having the FreePBX configuration interface accessible to 0.0.0.0/0 on your internal LAN is flipping insecure and stupid anyway. That should be locked down to only the IP addresses used by your IT group at the very least. Even Cisco got nailed by that vulnerability with their older UCM/callmanager interface which has unfixed vulnerabilities in it.

Moving a bit further, is binding the config interface to localhost and then tunneling over SSH the best “default” solution?

What breaks in that situation? UCP?

[billsimon]

The FreePBX firewall allows you to open or close admin GUI access as much as you like. You can set up the firewall immediately after deploying FreePBX. Having access initially open is the right default.

I understand your perspective. You work with Ansible, you script your installs, you are comfortable with SSH. Look around the forum and you’ll see most users would just be stumped by an SSH-tunnel-by-default config.

[penguinpbx (C. Maj)]

Point well taken, thank you.