I asked Chatgpt and this is the detailed guide it provided me. Does this sound right? is there anything specific I should do with firewall to protect eth0 from unwanted traffic since eth0 is public firewall facing as I only want eth0 to provide sip trunk for incoming and outgoing calls, ssh, web ui
Step 1: System Prep and Interface Configuration
A. Assign Static IPs
Edit /etc/network/interfaces (or /etc/netplan/*.yaml on newer Debian versions — use ip a to check interface names):
For Debian 12+, likely using Netplan. Example /etc/netplan/01-netcfg.yaml:
network:
version: 2
renderer: networkd
ethernets:
eth0:
dhcp4: no
addresses:
- 10.0.0.254/24
gateway4: 10.0.0.1
nameservers:
addresses: [8.8.8.8, 1.1.1.1]
eth1:
dhcp4: no
addresses:
- 192.168.0.1/24
Then run:
sudo netplan apply
eth0 = External (Internet + SIP trunk)
eth1 = Internal (Phones)
Step 2: Enable and Configure the FreePBX Firewall
FreePBX has its own intelligent firewall which understands VoIP-specific traffic better than plain iptables/UFW.
A. Enable the FreePBX Firewall
From the FreePBX web GUI:
- Go to Admin > System Admin > Firewall
- Click Enable Firewall
B. Define Zones:
- eth0 → Internet zone
- eth1 → Trusted/Internal zone
To do this:
- Go to Connectivity > Firewall > Interfaces
- Assign:
eth0 → Interneteth1 → Trusted
C. Services
Go to Connectivity > Firewall > Services:
Allow only these on Internet:
- SIP (chan_pjsip or chan_sip) — depending on what you’re using
- RTP Ports (usually UDP 10000–20000)
- HTTPS (for Web UI, or HTTP if not using SSL)
- SSH
Do NOT allow:
- WebRTC
- TFTP
- NTP
- Rest APIs
- UCP
- Admin (unless you really need it remotely)
Step 3: RTP and SIP Port Configuration in FreePBX
SIP Settings
- Go to Settings > Asterisk SIP Settings
- Under General SIP Settings:
- External Address: your public IP (or FQDN)
- Local Networks:
10.0.0.0/24192.168.0.0/24
RTP Ports
Still in SIP Settings:
- RTP Port Range: leave default
10000–20000 unless restricted
- Ensure router/firewall has these UDP ports forwarded to
10.0.0.254 (eth0)
Step 4: Configure iptables/UFW (optional)
While FreePBX’s firewall is solid, you may want to harden Debian’s native firewall too. If you use UFW (simpler than iptables), here’s a base config.
A. Install and Configure UFW:
sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
Then allow only essential ports:
# SIP (change ports if needed)
sudo ufw allow from any to 10.0.0.254 port 5060 proto udp
sudo ufw allow from any to 10.0.0.254 port 5061 proto udp
# RTP
sudo ufw allow from any to 10.0.0.254 port 10000:20000 proto udp
# Web UI
sudo ufw allow from your_admin_ip to any port 443 proto tcp
# SSH
sudo ufw allow from your_admin_ip to any port 22 proto tcp
Then enable it:
sudo ufw enable
Note: If using FreePBX firewall, ensure UFW doesn’t block it. It’s usually safest to let FreePBX manage traffic if you’re not very experienced with iptables.
Step 5: Test Your Routing and SIP Path
A. Phones (Internal) ➝ FreePBX ➝ SIP Trunk
- Register a few phones to FreePBX from the 192.168.0.x network
- Test internal calls
- Test outbound SIP calls
B. External ➝ SIP ➝ FreePBX ➝ Phones
- Make an inbound call to your public number (via Gamma SIP)
- Verify call lands on a local phone
Step 6: Best Practices
Disable unused FreePBX modules and admin interfaces
Enforce strong FreePBX passwords (Admin + Extensions)
Regularly apply Debian and FreePBX updates
Set up intrusion detection (Fail2Ban is included in FreePBX firewall)
Optional: Disable SIP guest access (no anonymous calls)
