I have a questions regarding the firewall rules for Asterisk VoIP server.

I have a restricted access to UDP/TCP port 5060, which seems to be blocking calls.

I want to make sure that my VoIP Server is not hacked, or misused. So, if anyone can let me know which ports needs to be open to all, I would really appreciate it.

Any help on this is very helpful.

Right now, the Asterisk server has the following access control.

USD/TCP port 5060, restrictive access.

UDP ports 10000:20000, global access for RTP media.

Thanks for all those who will contribute to the solution of this problem. I am very sure this will be useful to a lot of admins out there.

BTW, I have been referring to these Links to solve some amount of problem.



  • Can you comment more on what "restrictive access" means? – Hyppy Dec 9 '14 at 19:10
  • restrictive access would be allowing only a couple of subnets, access to UDP/TCP port 5060. these subnets belong to the users, who should be registered to the VoIP server. – Vijit Jain Dec 9 '14 at 19:14
  • It must also be open to anywhere that you receive calls from. – Michael Hampton Dec 9 '14 at 19:25
  • @MichaelHampton Thanks, I figured i would need to do that, Just needed to be sure. So I recon, this would be an ever increasing IP Table list. Correct? – Vijit Jain Dec 9 '14 at 19:29

The wiki post you referenced above is seriously misguided (and that's also why the author complains that he is still getting hacked). Manually managing an iptables list is the wrong approach - even worse the author is simply limiting access to the SIP and RTP ports and looking for user agents (without restricting source IP's, connection rates, etc). IP's change constantly, hackers change agent strings, etc. Unless you have only a few users with static IP's at home, only connect from home, etc. this is approach is just wrong.

If your goal is security take a look at some of the tools and techniques to secure your VoIP server here: Asterisk Security. A poorly configured PBX can leave you with a $50k bill after a weekend of toll calls from hackers.

|improve this answer|||||

I opened only rtp port (10000:20000) and 5060 from public IP's VoIP provider to my asterisk server. Obviously the traffics from your asterisk to your VoIP provider must allowed. Moreover you can add fali2ban with asterisk patterns for create a second combat line. For increase your security level you can add in peer options (your extensions) the source networks allowed for registration of your phone and use strong password.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.