Secure Asterisk and FreePBX from VoIP Fraud and Brute Force Attacks

Asterisk and FreePBX systems are constant targets for SIP scanning bots, credential stuffing attacks, and toll fraud rings. An unsecured PBX can rack up thousands of dollars in fraudulent international calls within hours of being compromised. VoIP fraud costs the global telecom industry over $38 billion annually according to the Asterisk security documentation, and most attacks exploit default configurations, weak passwords, and open SIP ports.

This guide covers a full security hardening strategy for Asterisk 22 LTS and FreePBX 17 running on Ubuntu 24.04 and Rocky Linux 10. We walk through PJSIP hardening, firewall rules, Fail2ban configuration, VoIPBL blocklist integration, TLS/SRTP encryption, dialplan lockdown, FreePBX security modules, monitoring, and network-level protections. If you’re running a production FreePBX installation, every section here applies to your setup.

Prerequisites

• A running Asterisk 22 LTS or FreePBX 17 server on Ubuntu 24.04 or Rocky Linux 10
• Root or sudo access to the server
• SIP ports: 5060/UDP (SIP), 5061/TCP (SIP-TLS), 10000-20000/UDP (RTP media)
• A list of trusted IP addresses or subnets for your SIP trunks and extensions
• Basic familiarity with Asterisk CLI and PJSIP configuration

Step 1: PJSIP Security Hardening

PJSIP is the default SIP channel driver in Asterisk 22. The default configuration is permissive by design, which means you need to lock it down before exposing the system to the internet.

Disable Guest Calls

Guest calls allow unauthenticated SIP requests to hit your dialplan. This is the single biggest security hole in most Asterisk installations. Disable it in /etc/asterisk/pjsip.conf:

[global]
type=global
; Reject all unauthenticated inbound calls
allow_guest=no

Prevent Extension Enumeration

By default, Asterisk returns different error messages for valid vs invalid usernames. Attackers use this to enumerate your extensions. Force identical responses for all failed auth attempts in /etc/asterisk/pjsip.conf:

[global]
type=global
allow_guest=no
; Return same error for valid and invalid usernames
alwaysauthreject=yes

Enforce Strong Passwords

Never use passwords that match the extension number. Every endpoint password must be at least 12 characters with mixed case, numbers, and symbols. Here is an example endpoint configuration:

[1001]
type=endpoint
context=internal
disallow=all
allow=ulaw,alaw,opus
auth=1001-auth
aors=1001

[1001-auth]
type=auth
auth_type=userpass
username=1001
; Strong password - minimum 12 chars, no extension matching
password=Xk9#mP2vL8@qR5w

Restrict Endpoints by IP

Use permit/deny ACLs to restrict which IP addresses can register as each endpoint. This stops stolen credentials from being used outside your network:

[1001]
type=endpoint
context=internal
disallow=all
allow=ulaw,alaw
auth=1001-auth
aors=1001

[1001-aor]
type=aor
max_contacts=1
; Only allow registration from office subnet
contact_acl=office-acl

[office-acl]
type=acl
deny=0.0.0.0/0.0.0.0
permit=10.0.1.0/24
permit=192.168.1.0/24

Disable Unused Codecs and Protocols

Only enable the codecs your phones actually use. Every enabled feature is an attack surface. In each endpoint definition:

disallow=all
allow=ulaw,alaw

Reload the PJSIP module after making changes:

sudo asterisk -rx "module reload res_pjsip.so"

Verify your endpoint configuration loaded correctly:

sudo asterisk -rx "pjsip show endpoints"

Step 2: Firewall Configuration for Asterisk

The firewall is your first line of defense. Only allow SIP and RTP traffic from known, trusted IPs. Everything else gets dropped.

UFW Rules for Ubuntu 24.04

Configure UFW to allow SIP and RTP only from your trusted networks. Replace the example IPs with your SIP trunk provider and office network addresses:

# Reset UFW to clean state (careful on remote servers - keep SSH allowed)
$ sudo ufw allow 22/tcp

# Allow SIP from trusted SIP trunk provider
$ sudo ufw allow from 203.0.113.10 to any port 5060 proto udp
$ sudo ufw allow from 203.0.113.10 to any port 5061 proto tcp

# Allow SIP from office network
$ sudo ufw allow from 10.0.1.0/24 to any port 5060 proto udp
$ sudo ufw allow from 10.0.1.0/24 to any port 5061 proto tcp

# Allow RTP media ports from same trusted sources
$ sudo ufw allow from 203.0.113.10 to any port 10000:20000 proto udp
$ sudo ufw allow from 10.0.1.0/24 to any port 10000:20000 proto udp

# Allow FreePBX web interface from admin network only
$ sudo ufw allow from 10.0.1.0/24 to any port 443 proto tcp

# Enable UFW
$ sudo ufw enable
$ sudo ufw status verbose

Firewalld Rules for Rocky Linux 10

On Rocky Linux 10, use firewalld rich rules to restrict SIP access to trusted IPs only:

# Allow SIP from trusted trunk provider
$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.10" port port="5060" protocol="udp" accept'
$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.10" port port="5061" protocol="tcp" accept'

# Allow SIP from office network
$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.1.0/24" port port="5060" protocol="udp" accept'
$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.1.0/24" port port="5061" protocol="tcp" accept'

# Allow RTP media range
$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.10" port port="10000-20000" protocol="udp" accept'
$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.1.0/24" port port="10000-20000" protocol="udp" accept'

# Reload and verify
$ sudo firewall-cmd --reload
$ sudo firewall-cmd --list-rich-rules

Rate Limiting SIP Traffic with nftables

Even with IP restrictions, add rate limiting to catch compromised trusted hosts or misconfigured devices flooding your SIP port. Create an nftables rule file at /etc/nftables.d/sip-ratelimit.conf:

table inet sip_limit {
    chain input {
        type filter hook input priority -10; policy accept;
        # Rate limit SIP to 15 packets per second per source IP
        udp dport 5060 meter sip_meter { ip saddr limit rate 15/second burst 30 packets } accept
        udp dport 5060 meter sip_meter { ip saddr limit rate over 15/second } drop
    }
}

Load the nftables configuration:

$ sudo nft -f /etc/nftables.d/sip-ratelimit.conf
$ sudo nft list table inet sip_limit

To make it persistent across reboots, include the file in your main /etc/nftables.conf:

include "/etc/nftables.d/sip-ratelimit.conf"

Step 3: Configure Fail2ban for Asterisk Security

Fail2ban monitors Asterisk log files for repeated authentication failures and automatically bans the offending IP addresses. This is your primary defense against brute force attacks on SIP credentials.

Install Fail2ban

On Ubuntu 24.04:

$ sudo apt update
$ sudo apt install -y fail2ban
$ sudo systemctl enable --now fail2ban

On Rocky Linux 10:

$ sudo dnf install -y epel-release
$ sudo dnf install -y fail2ban
$ sudo systemctl enable --now fail2ban

Create the Asterisk Filter

Create a custom filter that matches PJSIP authentication failures. Write this to /etc/fail2ban/filter.d/asterisk.conf:

[INCLUDES]
before = common.conf

[Definition]
_daemon = asterisk

failregex = NOTICE.* .*: Registration from '.*' failed for ':.*' - Wrong password
            NOTICE.* .*: Registration from '.*' failed for ':.*' - No matching peer found
            NOTICE.* .*: Registration from '.*' failed for ':.*' - Username/auth name mismatch
            NOTICE.* .*: Registration from '.*' failed for ':.*' - Device does not match ACL
            NOTICE.*  failed to authenticate as '.*'
            SECURITY.* SecurityEvent="FailedACL".*RemoteAddress=".*/.*//.*"
            SECURITY.* SecurityEvent="InvalidAccountID".*RemoteAddress=".*/.*//.*"
            SECURITY.* SecurityEvent="ChallengeResponseFailed".*RemoteAddress=".*/.*//.*"
            SECURITY.* SecurityEvent="InvalidPassword".*RemoteAddress=".*/.*//.*"

ignoreregex =

Create the Asterisk Jail

Create the jail configuration at /etc/fail2ban/jail.d/asterisk.conf:

[asterisk]
enabled  = true
filter   = asterisk
action   = iptables-allports[name=asterisk, protocol=all]
logpath  = /var/log/asterisk/messages
maxretry = 3
findtime = 600
bantime  = 3600
# Whitelist your trusted networks
ignoreip = 127.0.0.1/8 10.0.1.0/24

This configuration bans an IP for 1 hour after 3 failed authentication attempts within a 10-minute window. Adjust ignoreip to include your office network and SIP trunk provider IPs.

Recidive Jail for Repeat Offenders

Attackers that keep coming back after a ban expires need escalating punishment. Add a recidive jail at /etc/fail2ban/jail.d/recidive.conf:

[recidive]
enabled  = true
filter   = recidive
action   = iptables-allports[name=recidive, protocol=all]
logpath  = /var/log/fail2ban.log
maxretry = 3
findtime = 86400
bantime  = 604800

This bans any IP that gets banned 3 times within 24 hours for an entire week. Restart Fail2ban and verify:

$ sudo systemctl restart fail2ban
$ sudo fail2ban-client status asterisk

Expected output:

Status for the jail: asterisk
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- File list:        /var/log/asterisk/messages
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

Make sure Asterisk security logging is enabled. Edit /etc/asterisk/logger.conf:

[logfiles]
messages => notice,warning,error,security

Reload the logger module:

sudo asterisk -rx "logger reload"

Step 4: VoIPBL Blocklist Integration

VoIPBL is a community-driven blocklist of known VoIP abuse IP addresses. It aggregates data from multiple honeypots and abuse reports. Instead of using long iptables chains (the old approach), the modern method uses ipset for fast lookups against thousands of blocked IPs.

Install ipset

On Ubuntu 24.04:

sudo apt install -y ipset

On Rocky Linux 10:

sudo dnf install -y ipset

Create the VoIPBL Update Script

Create the script at /usr/local/bin/voipbl-update.sh:

#!/bin/bash
# VoIPBL blocklist update script using ipset
# Downloads the VoIPBL blocklist and loads it into an ipset for fast matching

IPSET_NAME="voipbl"
BLOCKLIST_URL="https://voipbl.org/update/"
TMPFILE="/tmp/voipbl_list.txt"

# Download latest blocklist
curl -sf "$BLOCKLIST_URL" -o "$TMPFILE"
if [ $? -ne 0 ]; then
    echo "Failed to download VoIPBL blocklist"
    exit 1
fi

# Create ipset if it doesn't exist
ipset list "$IPSET_NAME" > /dev/null 2>&1
if [ $? -ne 0 ]; then
    ipset create "$IPSET_NAME" hash:net maxelem 200000
    # Add iptables/nftables rule to drop traffic from this set
    iptables -I INPUT -m set --match-set "$IPSET_NAME" src -j DROP
fi

# Flush and reload
ipset flush "$IPSET_NAME"

while IFS= read -r line; do
    # Skip comments and empty lines
    [[ "$line" =~ ^#.*$ ]] && continue
    [[ -z "$line" ]] && continue
    ipset add "$IPSET_NAME" "$line" 2>/dev/null
done < "$TMPFILE"

COUNT=$(ipset list "$IPSET_NAME" | grep -c "^[0-9]")
echo "VoIPBL: Loaded $COUNT entries into ipset"
rm -f "$TMPFILE"

Make it executable and run the initial load:

$ sudo chmod +x /usr/local/bin/voipbl-update.sh
$ sudo /usr/local/bin/voipbl-update.sh

Schedule Automatic Updates

Add a cron job to update the blocklist every 4 hours:

echo "0 */4 * * * root /usr/local/bin/voipbl-update.sh > /dev/null 2>&1" | sudo tee /etc/cron.d/voipbl

Verify the ipset is loaded and active:

sudo ipset list voipbl | head -10

Step 5: TLS and SRTP Encryption

Without TLS, SIP signaling travels in plain text - usernames, passwords, and call details are visible to anyone sniffing the network. SRTP encrypts the actual audio stream. Both are mandatory for any production VoIP deployment.

Generate TLS Certificates

For production, use Let's Encrypt certificates. For lab environments, generate a self-signed certificate:

$ sudo mkdir -p /etc/asterisk/keys
$ sudo openssl req -new -x509 -days 365 -nodes \
  -keyout /etc/asterisk/keys/asterisk.key \
  -out /etc/asterisk/keys/asterisk.crt \
  -subj "/CN=pbx.example.com/O=MyCompany"
$ sudo cat /etc/asterisk/keys/asterisk.key /etc/asterisk/keys/asterisk.crt > /etc/asterisk/keys/asterisk.pem
$ sudo chown asterisk:asterisk /etc/asterisk/keys/*
$ sudo chmod 640 /etc/asterisk/keys/*

Configure PJSIP TLS Transport

Add a TLS transport to /etc/asterisk/pjsip.conf:

; Standard UDP transport (keep for internal/legacy devices)
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060

; TLS transport for encrypted SIP signaling
[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
cert_file=/etc/asterisk/keys/asterisk.crt
priv_key_file=/etc/asterisk/keys/asterisk.key
; Require TLS 1.2 minimum
method=tlsv1_2

Enable SRTP on Endpoints

For each endpoint that supports encryption, add SRTP settings:

[1001]
type=endpoint
context=internal
transport=transport-tls
disallow=all
allow=ulaw,alaw
auth=1001-auth
aors=1001
; Require SRTP for media encryption
media_encryption=sdes
; Force TLS - reject unencrypted connections
media_encryption_optimistic=no

To force all connections through TLS and completely disable unencrypted SIP, comment out or remove the UDP transport. Reload PJSIP and verify:

$ sudo asterisk -rx "module reload res_pjsip.so"
$ sudo asterisk -rx "pjsip show transports"

Step 6: Dialplan Security Hardening

A poorly designed dialplan is the most common way attackers turn a compromised extension into a toll fraud machine. Lock down your dialplan to prevent unauthorized international and premium rate calls.

Context Separation

Never put internal and external calling capabilities in the same context. Separate your dialplan into restricted contexts in /etc/asterisk/extensions.conf:

; Internal calls only - no outbound access
[internal]
; Local extensions 1000-1999
exten => _1XXX,1,Dial(PJSIP/${EXTEN},30)
 same => n,VoiceMail(${EXTEN}@default)
 same => n,Hangup()

; Domestic outbound - no international
[domestic-out]
include => internal
; US domestic calls (1 + 10 digits)
exten => _1NXXNXXXXXX,1,Set(TIMEOUT(absolute)=3600)
 same => n,Dial(PJSIP/${EXTEN}@trunk-provider,60)
 same => n,Hangup()

; Local 10-digit dialing
exten => _NXXNXXXXXX,1,Set(TIMEOUT(absolute)=3600)
 same => n,Dial(PJSIP/1${EXTEN}@trunk-provider,60)
 same => n,Hangup()

Block Premium and International Numbers

Explicitly block known fraud destinations. Add these patterns to every outbound context:

; Block premium rate numbers (900, 976)
exten => _1900XXXXXXX,1,Hangup(21)
exten => _1976XXXXXXX,1,Hangup(21)

; Block international dialing (011 prefix)
exten => _011.,1,Hangup(21)

; Block 00 international prefix
exten => _00.,1,Hangup(21)

PIN-Based Authorization for International Calls

If some users need international calling, require a PIN before connecting. Create an international context with PIN verification:

[international-out]
include => domestic-out
; International calls require PIN authentication
exten => _011.,1,Authenticate(8472,a)
 same => n,Set(TIMEOUT(absolute)=7200)
 same => n,Set(CDR(userfield)=INTL-AUTH)
 same => n,Dial(PJSIP/${EXTEN}@trunk-provider,60)
 same => n,Hangup()

Set Call Duration Limits

Always set TIMEOUT(absolute) on outbound calls to prevent calls from running indefinitely if a channel gets stuck. The value is in seconds - 3600 equals 1 hour:

exten => _NXXNXXXXXX,1,Set(TIMEOUT(absolute)=3600)
 same => n,Dial(PJSIP/${EXTEN}@trunk-provider,60)
 same => n,Hangup()

Reload the dialplan after changes:

sudo asterisk -rx "dialplan reload"

Step 7: FreePBX Security Module Configuration

FreePBX includes built-in security modules that add protection layers on top of Asterisk. Access these through the FreePBX web interface under Admin > System Admin and Connectivity > Firewall.

Responsive Firewall

The FreePBX Responsive Firewall dynamically manages iptables rules based on SIP registration behavior. Enable it from the FreePBX admin panel:

• Navigate to Connectivity > Firewall
• Enable the firewall and set the mode to "Responsive"
• Under "Interfaces", mark your WAN interface as "Internet (default reject)"
• Mark your LAN interface as "Local" or "Trusted"
• Under "Services", set SIP protocol to "Internet" only if remote phones need access - otherwise "Local" only

Intrusion Detection

FreePBX integrates with Fail2ban through its Intrusion Detection module:

• Go to Admin > System Admin > Intrusion Detection
• Set Max Retry to 3
• Set Ban Time to 3600 seconds (1 hour)
• Set Find Time to 600 seconds (10 minutes)
• Add your admin and trunk IPs to the whitelist

SIP Settings Hardening

From the FreePBX admin panel, navigate to Settings > Asterisk SIP Settings:

• Set "Allow Anonymous Inbound SIP Calls" to No
• Under PJSIP Settings tab, set the TLS certificate to your installed cert
• Enable "TLS" transport and set the TLS port to 5061
• Set NAT settings correctly for your network topology

Disable Unused Services

Reduce attack surface by disabling services you do not use. Go to Admin > Module Admin and disable:

• WebRTC if not using browser-based phones
• UCP (User Control Panel) if not needed for end users
• RestAPI if not using third-party integrations
• Any conferencing modules not in active use

Step 8: Monitoring and Alerting

Security without monitoring is blind. You need to know when attacks happen and when something unusual occurs on your PBX.

Asterisk CLI Security Commands

Run these commands regularly to audit your system state:

# Check current registrations - look for unknown IPs
$ sudo asterisk -rx "pjsip show registrations"

# View active channels - watch for unexpected calls
$ sudo asterisk -rx "core show channels verbose"

# Check failed auth attempts in the log
$ sudo grep "failed" /var/log/asterisk/messages | tail -20

# View current Fail2ban bans
$ sudo fail2ban-client status asterisk

Email Alerts for Failed Authentication

Create a script that sends email alerts when authentication failures exceed a threshold. Save this to /usr/local/bin/asterisk-auth-alert.sh:

#!/bin/bash
# Alert on excessive Asterisk auth failures
THRESHOLD=10
LOG="/var/log/asterisk/messages"
MAILTO="[email protected]"

COUNT=$(grep -c "failed to authenticate" "$LOG" 2>/dev/null)
if [ "$COUNT" -gt "$THRESHOLD" ]; then
    DETAILS=$(grep "failed to authenticate" "$LOG" | tail -20)
    echo -e "Warning: $COUNT auth failures detected.\n\nRecent failures:\n$DETAILS" | \
        mail -s "Asterisk Auth Alert - $COUNT failures" "$MAILTO"
fi

Schedule it to run every 15 minutes via cron:

$ echo "*/15 * * * * root /usr/local/bin/asterisk-auth-alert.sh" | sudo tee /etc/cron.d/asterisk-auth-alert
$ sudo chmod +x /usr/local/bin/asterisk-auth-alert.sh

CDR Analysis for Unusual Call Patterns

Query Call Detail Records to detect fraud indicators - calls to high-cost destinations, off-hours calling, or abnormal call volumes. If using the Asterisk CDR CSV backend:

# Find international calls in the last 24 hours
$ sudo awk -F',' '$7 ~ /^011/ || $7 ~ /^00/' /var/log/asterisk/cdr-csv/Master.csv | tail -20

# Find calls longer than 2 hours (7200 seconds)
$ sudo awk -F',' '$13 > 7200' /var/log/asterisk/cdr-csv/Master.csv | tail -10

# Count calls per destination in the last day
$ sudo awk -F',' '{print $7}' /var/log/asterisk/cdr-csv/Master.csv | sort | uniq -c | sort -rn | head -20

For FreePBX, use the CDR Reports module under Reports > CDR Reports to visually review call patterns. Set up daily email reports for outbound call summaries.

Step 9: Network-Level Protection

Server-level security is necessary but not sufficient. Network architecture decisions provide defense in depth against VoIP attacks.

Session Border Controller with Kamailio

Place a SIP-aware proxy in front of Asterisk to filter and rate-limit SIP traffic before it reaches the PBX. Kamailio is the standard open-source SBC for this purpose. The architecture looks like this:

• Internet traffic hits Kamailio on a public IP
• Kamailio authenticates, rate-limits, and filters SIP requests
• Valid traffic gets forwarded to Asterisk on a private IP
• Asterisk never directly faces the internet

This topology means attackers never interact with Asterisk directly, and Kamailio can handle far more concurrent SIP requests than Asterisk while applying security policies.

VPN for Remote Extensions

Remote workers should connect to the PBX through a VPN tunnel rather than exposing SIP ports to the internet. WireGuard is the best option for this - it's fast, simple, and uses modern cryptography. Remote phones connect to the WireGuard VPN first, then register to Asterisk using the VPN tunnel IP.

VLAN Separation for VoIP

Place all VoIP devices on a dedicated VLAN, separate from user workstations and servers. This provides:

• QoS prioritization for voice traffic
• Network-level isolation from compromised workstations
• Easier firewall rules between VoIP and data networks
• Reduced broadcast domain for SIP discovery attacks

Configure your managed switch with a VoIP VLAN (e.g., VLAN 100) and assign all IP phones to it. Your Asterisk server should have an interface or tagged VLAN interface on VLAN 100.

GeoIP Blocking

If your organization only makes calls within specific countries, block SIP traffic from regions where you have no business. Use the xtables-addons GeoIP module with nftables:

# Install xtables-addons (Ubuntu 24.04)
$ sudo apt install -y xtables-addons-common libtext-csv-xs-perl

# Download GeoIP database
$ sudo mkdir -p /usr/share/xt_geoip
$ sudo /usr/lib/xtables-addons/xt_geoip_dl
$ sudo /usr/lib/xtables-addons/xt_geoip_build -D /usr/share/xt_geoip *.csv

# Block SIP from specific countries (example: block all except US, CA, GB)
$ sudo iptables -A INPUT -p udp --dport 5060 -m geoip ! --src-cc US,CA,GB -j DROP
$ sudo iptables -A INPUT -p tcp --dport 5061 -m geoip ! --src-cc US,CA,GB -j DROP

Adjust the country codes to match your legitimate caller locations. Update the GeoIP database monthly via cron.

Step 10: Regular Security Maintenance

Security is not a one-time configuration. Regular maintenance keeps your PBX protected as new threats emerge.

Keep Asterisk and FreePBX Updated

Always back up before updating. Asterisk security advisories are published regularly, and staying current is critical:

# Backup current configuration
$ sudo tar czf /root/asterisk-backup-$(date +%F).tar.gz /etc/asterisk/ /var/lib/asterisk/

# Update Asterisk (Ubuntu 24.04)
$ sudo apt update && sudo apt upgrade -y asterisk

# Update Asterisk (Rocky Linux 10)
$ sudo dnf update -y asterisk

# For FreePBX module updates
$ sudo fwconsole ma upgradeall
$ sudo fwconsole reload

Password Rotation

Rotate SIP endpoint passwords on a schedule:

• Every 90 days for standard extensions
• Immediately after any employee departure
• Immediately after any security incident
• SIP trunk credentials should use IP-based authentication where possible, eliminating passwords entirely

Monthly Security Audit Checklist

Run through this checklist monthly to maintain your security posture:

Check	Command / Action	Expected Result
Review registered endpoints	pjsip show registrations	Only known IPs and extensions
Check Fail2ban ban count	fail2ban-client status asterisk	Note trends - increasing bans may signal targeted attack
Review CDR for international calls	FreePBX CDR Reports or CSV analysis	No unauthorized international calls
Verify VoIPBL is updating	ipset list voipbl | wc -l	Thousands of entries (blocklist is active)
Test Fail2ban filter	fail2ban-regex /var/log/asterisk/messages /etc/fail2ban/filter.d/asterisk.conf	Filter matches auth failures in log
Check for Asterisk updates	apt list --upgradable or dnf check-update	Apply any security patches
Verify TLS certificate expiry	openssl x509 -enddate -noout -in /etc/asterisk/keys/asterisk.crt	More than 30 days until expiry
Review firewall rules	ufw status or firewall-cmd --list-all	No unexpected open ports

Conclusion

A properly secured Asterisk/FreePBX system combines multiple defense layers - PJSIP hardening, strict firewall rules, Fail2ban with escalating bans, VoIPBL blocklists, TLS/SRTP encryption, locked-down dialplans, and network-level controls like VPN and SBC deployment. No single measure is sufficient on its own, but together they make your PBX a hard target for automated scanners and fraud rings. Apply every section in this guide, run the monthly audit checklist, and keep your system updated to stay ahead of VoIP threats.

Related Guides

• How To Install Asterisk 18 LTS on Debian 12/11/10
• Install Kamailio SIP Server on Ubuntu
• Setup WireGuard VPN on Ubuntu 24.04 / Debian 13 / Rocky Linux 10
• How To Generate Let's Encrypt SSL Certificates on Linux
• Install and use Firewalld on Ubuntu 24.04