Small Town Sysadmin

Phones & PBX

Locking down an on-prem phone system that's exposed to the internet

Scanners find internet-facing phone systems within minutes. Here's how to cut the exposure, stop toll fraud, and keep the admin interface off the public internet.

If your office runs an on-prem phone system (Switchvox, FreePBX, raw Asterisk, or something similar) and it has a public IP address, it’s being scanned right now. Automated tools sweep the internet around the clock looking for SIP services, then try extension numbers and passwords until something works.

The payoff for the attacker is usually toll fraud: using your phone system to place expensive international or premium-rate calls, often overnight or over a weekend when nobody’s watching. The bill lands on you. A weaker but still common outcome is a flood of junk calls that ring desk phones at 3 a.m.

The fixes below work on almost any platform. The menu names differ, but the ideas don’t.

Before changing firewall rules on a production phone system, confirm how your remote phones and your SIP trunk connect. Locking the wrong thing down can take the phones offline.

Keep the admin interface off the internet

This one matters most. The web admin page of a phone system should never be reachable from the public internet. Put it behind a VPN, or restrict it to your office’s management network.

This isn’t hypothetical. In August 2025, Sangoma disclosed CVE-2025-57819, a critical vulnerability in FreePBX that was exploited against administrator interfaces reachable from the internet. Systems whose admin page was only reachable internally weren’t exposed to that attack path. Patching fixes a specific bug; keeping the interface private protects you from the next one too.

Only accept SIP from people who should be sending it

Most small offices need SIP traffic from two places: the phone carrier, and sometimes a handful of remote phones.

  • Restrict the SIP trunk to the carrier’s addresses. Your provider can tell you which IP addresses or ranges their signaling and media come from. Allow those at the firewall, and nobody else, for the trunk.
  • Put remote phones on a VPN where you can. A phone that connects over VPN doesn’t need SIP open to the world at all.
  • If you must allow remote phones directly, limit it to known addresses when possible, and use the platform’s built-in protection. On Switchvox, that’s the blocked-IP list and its access controls. On FreePBX, it’s the Firewall module: Responsive Firewall limits SIP traffic from hosts that haven’t successfully registered, and Intrusion Detection bans addresses after repeated failures.
  • Turn off anonymous and guest SIP calls unless you have a specific reason to accept calls that aren’t from your carrier.

If an IP address keeps showing up in the blocked list, that’s normal internet noise. If your blocked list is huge and growing daily, that’s a sign SIP is more exposed than it needs to be.

Make extension passwords unguessable

Scanners guess extension passwords. Default, short, or pattern-based passwords like the extension number followed by “1234” fall fast. Use long, randomly generated SIP secrets for every extension. Phones store them, so nobody has to type them. Change any that were ever set to something memorable, and remove extensions that no longer have a phone.

Limit what a compromised extension can do

Assume one extension will eventually be compromised, and limit the damage:

  • Block international and premium-rate dialing for every extension that doesn’t need it, which is most of them in a small office.
  • Restrict calling by time of day if the platform supports it. A county office has no reason to place international calls at 2 a.m.
  • Ask your carrier about fraud controls: spending limits, international blocks at the carrier level, and alerts for unusual call volume. This is the net under everything else.

Keep it patched and backed up

Phone systems are easy to forget because they just work. Put them on the same patch schedule as your servers, and subscribe to your vendor’s security advisories.

If you’re on Asterisk directly, note that the old chan_sip channel driver was removed as of Asterisk 21. Systems still depending on it are running old versions, and moving to chan_pjsip should be on the roadmap.

Back up the configuration regularly, and store a copy somewhere other than the phone system itself. Rebuilding from a backup is a lot faster than rebuilding from memory.

Watch the call records

Your call detail records will show fraud before your bill does. A quick weekly look for international calls, unusually long calls, and after-hours activity catches most problems early. Some platforms can email an alert when calls go to certain destinations, so turn that on if yours can.

Sources

All articles