Sip security in a WAN (internet) ISR used for SIP gateway & Internet access

[francisco.trigo]

Hi there!

I have a cisco router as a WAN router, is my home gateway router.

I set it like FXS & FXO gateway.

I'm using it with asterisk and FreePBX.

Now all looks great at works perfect, but talking about security some is really wrong with my config.

I'm having some external calls (intruders calls) from internet like this:

*Jun  3 22:47:42.403: //45/78445F178032/SIP/Call/sipSPICallInfo:

The Call Setup Information is:

Call Control Block (CCB) : 0x4A4F3920

State of The Call        : STATE_DEAD

TCP Sockets Used         : NO

Calling Number           : 1815

Called Number            : 900441224928466

Source IP Address (Sig  ): 190.55.225.200

Destn SIP Req Addr:Port  : 185.40.4.28:5070

Destn SIP Resp Addr:Port : 185.40.4.28:5070

Destination Name         : 185.40.4.28

*Jun  3 22:47:42.403: //45/78445F178032/SIP/Call/sipSPIMediaCallInfo:

Number of Media Streams: 1

Media Stream             : 1

Negotiated Codec         : g711ulaw

Negotiated Codec Bytes   : 160

Nego. Codec payload      : 0 (tx), 0 (rx)

Negotiated Dtmf-relay    : 6

Dtmf-relay Payload       : 101 (tx), 101 (rx)

Source IP Address (Media): 190.55.225.200

Source IP Port    (Media): 16834

Destn  IP Address (Media): 185.40.4.28

Destn  IP Port    (Media): 5072

Orig Destn IP Address:Port (Media): [ - ]:0

What is the cli commands to block all the sip signaling and other from my WAN interface (G0/0)?

Best Regards!

[Dennis Mink · Accepted solution]

If you know the public IP address of your SIP provider, permit that on port 5060/5061 and deny all else (implicitly).

also on you asteriks box, you might want  to put a dial plan in place that would restrict all numbers to be dialed but your own, so the 900441224928466 should not be allowed in as a called number and should just be dropped by your asterisk box.

Please rate if useful

[francisco.trigo]

Hi Dennis!

I will perform that tasks!

Best Regards