Asterisk / Distros

whocares256

What free versions of Asterisk are currently available?

I know of the following:
FreePBX
3CX
PIAF
FreeSwitch

Is there still a free version of SwitchVox? I found my old registration key and backup settings but it won’t register or import backup settings.

HardlyWorthit

whocares256 What free versions of Asterisk are currently available?

Those are PBXs’ or Asterisk PBX GUI, but they are not all Asterisk based.
Maybe look here: https://nerdvittles.com/

Davesworld

whocares256

FreeSwitch and Asterisk are in the same category. Freeswitch was created by Asterisk developers who wanted to address the shortcomings of Asterisk and other telephony platforms. I prefer FreeSwitch and use FusionPBX, which is a web-based GUI with a database that uses FreeSwitch as its core.

Davesworld

HardlyWorthit

That article you linked is quite good. It’s difficult not to like Ward Mundy. Interesting that he mentioned RackNerd, as I used the Black Friday special to move all my servers to it, and they were willing to mount an iso for me on each so I can install Debian 12 manually. It’s been a good move.

I created a separate partition for /var/lib/freeswitch and changed the installer to put backups in /var/lib/freeswitch/backup rather than /var/backup. This allows a fresh install without losing messages and other recordings since I don’t format that partition on an install, and the nightly saved databases are there. I use PostgreSQL. I have a script to restore PostgreSQL databases in FusionPBX. It took some trial and error to fix the ones others have made long ago.

SLC_96

FusionPBX is great! I could never go back to asterisk distros.

If you follow the security section of the docs, you can leave your sip ports open to the world and roam freely.

Samot

SLC_96 I have no idea how you came to that conclusion. Leaving it open isn’t safe, not even according to their docs.

Davesworld

SLC_96
I only open port 5060 in the firewall to specific IP addresses. 5060 UDP non-TLS is where most of the scanners operate. Leaving that wide open is a sure way to get a lot of noise in your call logs due to call attempts off of your server. One can run sngrep to see all attempts, even outside the firewall, : that could not get through. Running fs_cli will show what is happening in Freeswitch itself, mostly registrations, until you make or receive a call.

SLC_96

You can use two separate sip profiles, one for internal extensions and one for providers. The internal profile would only accept authenticated traffic, the provider profile would only accept invites from the specified IP addresses of your sip providers. This stops randoms from trying to send calls to your pbx while allowing customer devices from any address.

On the internal sip profile, you can disallow sip invites by IP address by banning all hosts that make any attempts. This catches most automated scans during the first attempt. SIP clients would need to use a domain name to be successful.

You also can ban hosts after several failed sip auth attempts.

FusionPBX makes this set up easier than the asterisk/freepbx distros I have used, but I acknowledge it has been a long time since I used one.

Davesworld

SLC_96
There already ARE internal and external SIP profiles. The external is solely for gateways, and you must put the IP addresses of those in Advanced > Providers > Access Controls in Fusion PBX. Also one SHOULD create firewall rules that ONLY allow those IPs to access ports 5080-5081. Neither anveo direct nor Bulk VS have ever used tls that I can see yet I include port 5081 in the rules. FusionPBX uses iptables rather than nftables. The only reason I can see is there is no way to makes these same rules in nftables.
-A INPUT -p udp -m udp –dport 5060:5091 -m string –string “friendly-scanner” –algo bm –icase -j DROP
-A INPUT -p tcp -m tcp –dport 5060:5091 -m string –string “friendly-scanner” –algo bm –icase -j DROP
-A INPUT -p udp -m udp –dport 5060:5091 -m string –string “sipcli/” –algo bm –icase -j DROP
-A INPUT -p tcp -m tcp –dport 5060:5091 -m string –string “sipcli/” –algo bm –icase -j DROP
-A INPUT -p udp -m udp –dport 5060:5091 -m string –string “VaxSIPUserAgent/” –algo bm –icase -j DROP
-A INPUT -p tcp -m tcp –dport 5060:5091 -m string –string “VaxSIPUserAgent/” –algo bm –icase -j DROP
-A INPUT -p udp -m udp –dport 5060:5091 -m string –string “pplsip” –algo bm –icase -j DROP
-A INPUT -p tcp -m tcp –dport 5060:5091 -m string –string “pplsip” –algo bm –icase -j DROP
-A INPUT -p udp -m udp –dport 5060:5091 -m string –string “system ” –algo bm –icase -j DROP
-A INPUT -p tcp -m tcp –dport 5060:5091 -m string –string “system ” –algo bm –icase -j DROP
-A INPUT -p udp -m udp –dport 5060:5091 -m string –string “exec.” –algo bm –icase -j DROP
-A INPUT -p tcp -m tcp –dport 5060:5091 -m string –string “exec.” –algo bm –icase -j DROP

These are the iptables rules for IPs that both Anveo Direct and Bulk VS need to access the external profile. There are two blocks, one for TCP and the other for UDP.

-A INPUT -s 52.206.134.245/32 -p tcp -m tcp –dport 5080:5081 -j ACCEPT
-A INPUT -s 76.8.29.198/32 -p tcp -m tcp –dport 5080:5081 -j ACCEPT
-A INPUT -s 192.9.236.42/32 -p tcp -m tcp –dport 5080:5081 -j ACCEPT
-A INPUT -s 162.249.171.198/32 -p tcp -m tcp –dport 5080:5081 -j ACCEPT
-A INPUT -s 72.9.149.25/32 -p tcp -m tcp –dport 5080:5081 -j ACCEPT
-A INPUT -s 169.48.232.158/32 -p tcp -m tcp –dport 5080:5081 -j ACCEPT
-A INPUT -s 176.9.39.206/32 -p tcp -m tcp –dport 5080:5081 -j ACCEPT
-A INPUT -s 67.212.84.21/32 -p tcp -m tcp –dport 5080:5081 -j ACCEPT
-A INPUT -s 204.216.109.55/32 -p tcp -m tcp –dport 5080:5081 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 5080:5081 -j DROP
-A INPUT -s 52.206.134.245/32 -p udp -m udp –dport 5080:5081 -j ACCEPT
-A INPUT -s 76.8.29.198/32 -p udp -m udp –dport 5080:5081 -j ACCEPT
-A INPUT -s 192.9.236.42/32 -p udp -m udp –dport 5080:5081 -j ACCEPT
-A INPUT -s 162.249.171.198/32 -p udp -m udp –dport 5080:5081 -j ACCEPT
-A INPUT -s 72.9.149.25/32 -p udp -m udp –dport 5080:5081 -j ACCEPT
-A INPUT -s 169.48.232.158/32 -p udp -m udp –dport 5080:5081 -j ACCEPT
-A INPUT -s 176.9.39.206/32 -p udp -m udp –dport 5080:5081 -j ACCEPT
-A INPUT -s 67.212.84.21/32 -p udp -m udp –dport 5080:5081 -j ACCEPT
-A INPUT -s 204.216.109.55/32 -p udp -m udp –dport 5080:5081 -j ACCEPT
-A INPUT -p udp -m udp –dport 5080:5081 -j DROP

Davesworld

SLC_96
You can’t completely secure it from only the web GUI. You need to get your hands dirty with iptables. Ports 5060-5079 are for the internal profile (Does NOT mean LAN!), and the internal profile is for devices to register to the server, as the internal profile is where the sip signaling occurs. The eternal profile is purely to allow the SBCs, such as Anveo Direct and BilkVS, to communicate with the server, such as for incoming calls.

I highly recommend securing port 5060 to only the IPs that will not be using TLS to register. In this example, I only allow two IPs to access port 5060 for both UDP and TCP.

-A INPUT -s first ip/32 -p tcp -m tcp –dport 5060 -j ACCEPT
-A INPUT -s /second ip/32 -p tcp -m tcp –dport 5060 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 5060 -j DROP
-A INPUT -s first ip/32 -p udp -m udp –dport 5060 -j ACCEPT
-A INPUT -s second ip/32 -p udp -m udp –dport 5060 -j ACCEPT

This tremendously cuts down the noise and malicious scans.