TIPS going public on public vps server

[bobmats]

http://nerdvittles.com/deploying-an-incredible-pbx-2021-public-server/

gives info on deploying a public server.

I am switching from a 2014 installation to new incredible pbx 2021 and have allready installed this op a public vps server using the manual but have not yet executed the deploy public server script.

Phone register using an ip.
Have added fqdn using dyndns so my office can access webinterface.
Setup some fqdn's only access to sip.

Other ip's are unable to access the vps so it's closed and works. Basically the server is life public exposed but firewall blocks everything only my ip, correct ?

When going live my understanding is the following will happen.
Currently I use an ip to register my phone, when going puble the server gets a name 3d5rtaw4.myserver.com
Phone now don't need a dyndns anymore but can register using the 3d5rtaw4.myserver.com fqdn. Am I correct that this will only give access to sip port registration.

Currently when I use the fqdn 3d5rtaw4.myserver.com some softphones only have 1 way audio, therefore I use the ip now.
Will this go away when using the fqdn going live.

Will my server still block all traffic when doing the public deployment ?
When yes I assume I can still add and ip of fqdn (dyn ip) to give that ip access to webinterface.

Going public makes above possible and is ideal when I have many mobile based phone that want to access the server.
If i have no mobile based phones I really don't need to go live ?

 

[ostridge]

Setup some fqdn's only access to sip.

so in /root/add-fqdn that is -
1 - SIP (UDP) and/or 2 - SIP (TCP) are allowed

public exposed but firewall blocks everything only my ip, correct ?

yes iptables blocks if iptables is up it shows in the pbxstatus output as ' IPtables: UP '. but check

iptables -Ln ##(to make certain)
# There will be lots of lies like these (examples for trusted providers' IPs ):-
 
ACCEPT     udp  --  8.3.252.23           0.0.0.0/0            multiport dports 5060,5061,5062,5063,5064,5065,5066,5067,5068,5069,4569
ACCEPT     udp  --  8.14.120.23          0.0.0.0/0            multiport dports 5060,5061,5062,5063,5064,5065,5066,5067,5068,5069,4569
ACCEPT     udp  --  8.17.37.23           0.0.0.0/0            multiport dports 5060,5061,5062,5063,5064,5065,5066,5067,5068,5069,4569
ACCEPT     udp  --  66.54.140.46         0.0.0.0/0            multiport dports 5060,5061,5062,5063,5064,5065,5066,5067,5068,5069,4569
ACCEPT     udp  --  66.54.140.47         0.0.0.0/0            multiport dports 5060,5061,5062,5063,5064,5065,5066,5067,5068,5069,4569
ACCEPT     udp  --  64.62.236.143        0.0.0.0/0            udp dpts:5060:5069
ACCEPT     udp  --  24.211.64.206        0.0.0.0/0            udp dpts:5060:5069
ACCEPT     udp  --  199.30.56.194        0.0.0.0/0            udp dpts:5060:5069
ACCEPT     udp  --  209.216.15.70        0.0.0.0/0            udp dpts:5060:5069
ACCEPT     udp  --  209.216.2.211        0.0.0.0/0            udp dpts:5060:5069

when going puble the server gets a name 3d5rtaw4.myserver.com

So
/root/add-fqdn myservername 3d5rtaw4.myserver.com
Then allow the ports you need with
"Enter the services desired by number. Separate entries with commas.
For example: 1,4 would activate standard UDP SIP plus web access."

You still use your ip for other ports

 

[bobmats]

Ok so I need to add my fdqn also when going public. This was not written in the deploying manual ?

I assume most save option is to use the 3d5rtaw4.myserver.com only option 1 udp sip as otherwise the webaccess will also be public when accessing thru 3d5rtaw4.myserver.com ?

I can still use a dyndns ip to allow acces to the ip address of the server instead of the fqdn 3d5rtaw4.myserver.com ?

Wait do I only need to add 3d5rtaw4.myserver.com as fqdn or do i need to run the deploy script first ?

 

[wardmundy]

Reread the tutorial. You cannot EVER use the IP address of your PUBLIC PBX to gain SIP/PJsip access. All ports aren't blocked. For example, SSH is open on the port you designate during the setup. Be sure to disable ALL of your add-ip and add-fqdn entries BEFORE converting to a PUBLIC server. New whitelisted entries basically grant web access, and there are ways to do this so that UCP is separated from FreePBX GUI access. All of this is covered in the tutorial and in greater detail.

 

[bobmats]

Ward, ok undersrand, after deploy scrip sip only connects thru: 3d5rtaw4.myserver.com (example)
Al other services I can add dyndns address via add-fqdn to gain web access, webmin, ssh etc still using the ip address.

Will try this weekend. So far everything seems to work.

Have debian 10.10 and when using: sudo iptables -L I see many ip's that your script has added I assume voip.ms les.net etc.
When I add my own did providers do I also need to add their sip server thru add-fqdn or is a port opened when adding a trunk.

 

[ostridge]

add their sip server thru add-fqdn

yes this bit is correct