TIPS Freepbx security measures

[Rrrr]

Thanks for the tips and yes, I am monthly refilling SIP prepaids, however I was considering some trunks that are postpaid.
Would a VPN between server and client be the ultimate safe solution?

 

[synack]

If it were me doing it, I would do it the following ways in order of preference:
1) Firewall/Router to Firewall/Router VPN(site to site)
2) Client to Router (road warrior style) VPN
3) Client to Server VPN
4) Firewall/Router NAT with whitelisting ACLs
5) Server with IPtables Whitelisting. *

The Firewall/Router can be another Linux, I just prefer 1 layer of separation between the Internet and the service provided (DMZ style)

* The trouble of server whitelisting:
Imagine if you were playing around with the server, and something went wrong with IP tables? your directly attached server would be naked to the internet.
IP tables has an extremely stupid policy of being fully open by default, so if you have a configuration file error, it fails unconfigured and OPEN... sigh.
With a separate server running IP tables acting as a NAT firewall however, it would fail open.. but also *without* NAT, and thereby protecting your internal assets.