Firewall

Admin → Security → Firewall controls who can reach each of Exovo's network services. Rules are enforced as packet filters in the telephony core, so a blocked scanner never reaches the SIP stack at all. That matters most when the server has a public address and no router in front of it, such as a VM in a data centre or a cloud host with a single public network interface.

What it covers

Each service has one setting: Open to everyone, Only these sources or Closed.

Some ports are deliberately not filtered:

• The web console (80 and the HTTPS port). A mistake here can never lock you out of the page that fixes it. Use Console Restrictions to limit who can sign in.
• The browser-calling relay (TURN, 3478).
• Call audio (16384–16484/udp). Carriers often send audio from addresses other than their signalling servers, and the phone system only accepts audio on ports it has opened for a live call.

Phones on the phone VPN and Cisco VPN arrive on their own tunnel interfaces and are never filtered here. The same goes for traffic inside Exovo itself, such as the web console talking to the core.

Rules are IPv4. On a host that publishes the ports over IPv6, Docker relays IPv6 clients so they appear to come from the host itself. The firewall never counts that address as an allowed source, so a restricted or closed service drops them too.

Only these sources

The service accepts the addresses you list and drops everyone else. Enter IPv4 addresses or CIDR ranges; Add private ranges adds 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 in one click. Some addresses are allowed automatically and listed under the service:

• Trusted: every Allow entry on the IP Blacklist.
• Trunk SIP: each trunk's server address (host names are looked up and kept current) and every address on the trunk allow-list.
• LAN SIP peers: the server address of each trunk in LAN mode.

The list shows under each service in Open to everyone too, so you can see what restricting it would keep allowed.

The trunk allow-list on the IP Blacklist page has its own switch, Restrict inbound to trunk IPs. When it's on, the phone system itself refuses trunk calls from any other address, whatever Trunk SIP is set to here. The firewall page says so under Trunk SIP and shows the list open. The firewall just drops those packets earlier.

Anything else registering to Phone SIP from outside the listed networks is dropped once it's restricted. That includes a remote gateway or a phone registering across the internet. Phones normally come in through an SBC or the phone VPN, which aren't filtered; otherwise add the device's address.

Restricting a service also cuts off connections already open from addresses it no longer allows. Only replies to connections the phone system opened itself, such as a trunk's registration, get through without matching a rule.

A provider that sends calls from addresses not on its trunk or the trunk allow-list will be dropped once Trunk SIP is restricted. Check the provider's documentation for its full signalling range and add it to the trunk allow-list first. Then place a test call in from a mobile.

Restricting the Tunnel stops the Exovo apps working anywhere outside the listed networks, because the apps connect from wherever their users are. Restrict it only if nobody uses the apps away from known sites.

Closed

Every packet to the service's ports is dropped, including trusted and trunk addresses. Close what you don't use, for example Cisco Enterprise on a system with no Cisco phones.

Custom rules

For an exception the services can't express, add a custom rule: Accept or Drop, protocol, a port or range, and a source (blank for any). Custom rules are checked in order, before the service settings. A custom accept is the way to let one address through a closed service.

Order and evaluation

The first matching rule decides:

1. Blocked addresses on the IP Blacklist, including abuse control's automatic bans.
2. Replies and calls already in progress, and Exovo's own internal traffic.
3. Your custom rules, in order.
4. Each service's setting.

Effective rules at the bottom of the page lists exactly what the core is enforcing, with how many packets each rule has matched since it was last applied. Each restricted service also shows how many packets it has dropped. Changes apply within a few seconds of Save, without interrupting calls.

Defaults

New installations start with Phone SIP and LAN SIP peers limited to the private ranges. Everything else is open. Systems installed before the firewall existed start with every service open and keep working exactly as before until you change something.

Set to defaults applies that starting policy in one click. Use it to set up a system installed before the firewall existed, or to undo changes that broke something. It replaces every service setting and removes all custom rules, after asking you to confirm.

When the dashboard warns that SIP scanning from the internet was detected, its Close it link opens this page with a one-click Restrict to private networks for Phone SIP.

The host's own firewall

Rules you add with iptables or ufw in the host's INPUT chain do not apply to Exovo's ports. Docker forwards published ports before the INPUT chain sees them. Use this page instead. If you also filter at the host, put rules in Docker's DOCKER-USER chain. A firewall in front of the server, such as a router or the hypervisor's firewall, still applies as normal.