TIPS About SIP URI calling ...

[Halea]

I've searched on this forum and FreePBX's and found several discussion threads about my question below, but I still don't have a good understanding about the riskiness of doing what I am trying to do.

In a nutshell, there are a dozen of SIP URIs that I want my PBX users to be able to call via the standard extension numbering scheme. I would configure those custom extensions to use the "PJSIP/anonymous/sip:nnnn@<fqdn>" format.

I don't want any random or unauthenticated sip uri calls into my PBX.

What are the inherent risks of setting
"Allow Anonymous Inbound SIP Calls" to NO, while setting
"Allow SIP Guests" to YES
under "IncrediblePBX WebGUI > Settings > Asterisk SIP Settings > General SIP Settings > Security Settings" ?

 

[kenn10]

A lot depends on whether your firewall is locked down to whitelisted IP's. Your statement above is unclear. Are users on the PBX calling an internal number that in turn calls a SIP URI outside the system or are users outside your system trying to use a SIP URI to call into your system? If they are calls going out of your system, you should not need to turn on either of the anonymous inbound or SIP Guest settings.

Obviously, if you allow Anonymous inbound, and your firewall is not locked down, you'll be barraged with junk calls and hack attempts. The same applies for SIP guests. You can moderate that somewhat with tighter fail2ban settings. Sangoma's FreePBX uses the responsive firewall to try to block hack attempts.

If you have a very random FQDN for your PBX and only allow inbound calls via that FQDN, you might moderate the risk of annoyance calls and hack attempts by blocking the sip ports to the direct IP.

 

[wardmundy]

@kenn10 is spot on. An obfuscated FQDN coupled with blocking calls to your IP address is the way to go for SIP URI calling. Adding the Press-7 trick eliminates about 99.9% of spam calls. More tips here.

 

[Halea]

@kenn10 : Users on the PBX will dial an extension which is programmed to make a sip uri call. This machine has pjsip only. In the good old days of chan_sip this was easy and as you said there was no need to turn on "Allow SIP Guests". But with PJSIP the syntax has changed and now you have to use a construct like
PJSIP/anonymous/sip:[email protected].
And even this only works if either "Allow SIP Guests" is set to YES or alternatively "Allow SIP Guests" is set to NO but you have created a bonefide pjsip trunk to the domain (in this example mouselike.org).
But the second alternative is costly if your different sip uris are targeting different domains.
In my case I have a dozen sip uri destinations, but they are all on different fqdns, so I would have to create a dozen trunks in addition to the dozen custom extensions. Which is possible if security wise it's warranted.
With the first approach, I create the same custom extensions and simply turn on "Allow SIP Guests", and everything works as it should. No need for additional trunks.
Now where I am struggling is; what am I allowing when I turn on "Allow SIP Guests"?
I'm guessing that if hackers try to access my PBX in "anonymous" mode (whatever that means), "Allow Anonymous Inbound SIP Calls = No" provides some protection. But that also (probably) implies that they can access in non-anonymous mode and stress FreePBS/Asterisk's access/validation/authorization mechanisms for which I have little knowledge, thus my worry/interrogation.

PS: I tried to create a "generic" (non target fqdn dependent) trunk for this purpose but it didn't work. ChatGPT gave me some guidance but it was worthless.

 

[Samot]

In chan_pjsip you need to create endpoints for your needs. The anonymous endpoint will **accept calls from any place** this is for **inbound to Asterisk/PBX**. For outbound calls from Asterisk/PBX you need to use a default outbound endpoint that is meant just for that, you don't set it up for inbound.

In my case I have a dozen sip uri destinations, but they are all on different fqdns, so I would have to create a dozen trunks in addition to the dozen custom extensions. Which is possible if security wise it's warranted.

You do not need to make numerous endpoints for this. You can use a single outbound endpoint using the SIP URI dialing method for chan_pjsip. Assuming the endpoint is called "outbound"

Dial(PJSIP/outbound/sip:[email protected]:5060)
OR
Dial(PJSIP/outbound/sip:${SIPURI_DEST})

That's it, now you can dial numerous SIP URIs from a single outbound chan_pjsip endpoint.

 

[Halea]

@Samot : Brilliant! Thank you. That did it. It works flawlessly.

For reference, I edited the file pjsip.endpoint_custom.conf and added the following:
[sipuri]
type=endpoint
transport=0.0.0.0-udp
context=from-internal
disallow=all
allow=ulaw
allow=alaw
direct_media=no
force_rport=yes
rtp_symmetric=yes
rewrite_contact=yes
rtp_keepalive=15

then I saved it and reloaded pjsip.

I use the following construct for my custom extensions' URI field:
PJSIP/sipuri/sip:[email protected]

No need for target uri trunk creation, no need for anonymous or guest sip call things.

 

[wardmundy]

We do something similar for outbound SIP URI calls to Lenny.

In pjsip_custom.conf:

[anonymous-outbound]
type=endpoint
context=from-internal
disallow=all
allow=ulaw,alaw,g722
transport=transport-udp

For the custom extension Dial string:

PJSIP/anonymous-outbound/sip:[email protected],30,Tb(func-apply-sipheaders^s^1)

 

[wardmundy]

Just an FYI that on Incredible PBX platforms setting Allow SIP Guests YES is harmless as all the calls get discarded after logging them. It at least lets you know who is attacking your server...

[from-sip-external]
exten => _X.,1,NoOp(Received incoming SIP connection from unknown peer to ${EXTEN})
exten => _X.,n,Set(DID=${IF($["${EXTEN:1:2}"=""]?s:${EXTEN})})
exten => _X.,n,Goto(s,1)
exten => s,1,GotoIf($["${SIPLANG}"!=""]?setlanguage:checkanon)
exten => s,n(setlanguage),Set(CHANNEL(language)=${SIPLANG})
exten => s,n(checkanon),GotoIf($["${ALLOW_SIP_ANON}"!="yes"]?noanonymous)
exten => s,n,Goto(from-trunk,${DID},1)
exten => s,n(noanonymous),Set(TIMEOUT(absolute)=15)
exten => s,n,Set(receveip=${IF($["${CUT(CHANNEL,/,1)}" != "PJSIP"]?recvip:pjsip,remote_addr)})
exten => s,n,Log(WARNING,"Rejecting unknown SIP connection from ${CHANNEL(${receveip})}")
exten => s,n,Answer
exten => s,n,Wait(2)
exten => s,n,Playback(ss-noservice)
exten => s,n,Playtones(congestion)
exten => s,n,Congestion(5)
exten => h,1,Hangup

If you want to allow incoming SIP URI calls only from an obfuscated FQDN, e.g. sip://1234@thissecret.domain.net, and you've opened up your UDP SIP port in the firewall, then make a copy and adjust the [from-sip-external] context above in extensions_override_freepbx.conf that looks something like this:

[from-sip-external]
exten => _X.,1,NoOp(Received incoming SIP connection from unknown peer to ${EXTEN})
exten => _X.,n,GotoIf($["${SIPDOMAIN}"!="thissecret.domain.net"]?baddomain)
exten => _X.,n,Set(DID=${IF($["${EXTEN:1:2}"=""]?s:${EXTEN})})
exten => _X.,n,Goto(s,1)
exten => s,1,GotoIf($["${SIPLANG}"!=""]?setlanguage:checkanon)
exten => s,n(setlanguage),Set(CHANNEL(language)=${SIPLANG})
exten => s,n(checkanon),GotoIf($["${ALLOW_SIP_ANON}"!="yes"]?noanonymous)
exten => s,n,Goto(from-trunk,${DID},1)
exten => s,n(noanonymous),Set(TIMEOUT(absolute)=15)
exten => s,n,Set(receveip=${IF($["${CUT(CHANNEL,/,1)}" != "PJSIP"]?recvip:pjsip,remote_addr)})
exten => s,n(baddomain),Log(WARNING,"Rejecting unknown SIP connection from ${CHANNEL(${receveip})}")
exten => s,n,Answer
exten => s,n,Wait(2)
exten => s,n,Playback(ss-noservice)
exten => s,n,Playtones(congestion)
exten => s,n,Congestion(5)
exten => h,1,Hangup

Be sure to test this for security vulnerability in case you made a typo somewhere!