Geo blocking and SIP edge protection
Two layers keep scanners and guessers away from your phone ports and your console. Both complement the admin IP allow-list.
SIP edge protection
The SIP edge protects every phone port (UDP, TCP, TLS and WebSocket) before a request is parsed. It works automatically.
- Allow and deny lists. An allow-listed address always passes. A denied address is dropped.
- Automatic bans. An address that fails digest authentication too often (10 times in 10 minutes by default), sends a known scanner
User-Agent, or floods the port is banned. Open connections from it are closed. Over UDP only failures that answer a challenge the PBX sent to that address count, so a spoofer cannot get someone else banned. - Rate limits. New connections and messages are limited per address.
- Per-account throttling. Guessing one account's password from many addresses is slowed down: after 5 failures, sources that never signed in as that account wait, doubling up to 60 seconds. After 20 failures in 15 minutes the account is locked to challenge-only for such sources. Phones at their usual addresses keep working. An administrator can lift a lock on the device.
- Call caps. Concurrent-call limits per extension and per trunk.
- Voicemail PIN probing. An address that tries wrong PINs on three different mailboxes is banned. Registered phones and allow-listed addresses are spared.
Administrators see and manage bans, lists and locked devices and mailboxes under Admin, Security. The alerts SipBanSpike, SipAccountLocked and SipCompanyUnderAttack report attacks, see Alerts.
Geo blocking
Geo blocking refuses traffic by the country of the source address, on the SIP edge and on the API and the console, before sign-in. Open Admin, Geo blocking.
| Setting | Meaning |
|---|---|
| Mode | Off, Deny (refuse the listed countries) or Allow (serve only the listed countries). |
| Countries | ISO two-letter codes. |
| Block unknown addresses | Refuse addresses the country table does not know. |
| Scope | API guards every /api/v1 route including sign-in and the desk phones' provisioning files. System guards only the install-wide administration. |
| Also apply to the SIP edge | The saved rule guards the phone ports too. It replaces the configured SIP rule on every SIP edge within 30 seconds, without a restart. |
Loopback, private and link-local addresses are never blocked. Allow-listed addresses always pass.
The country table is not included. Download an IP-to-country CSV, for example the DB-IP "IP to Country Lite" file, accept its licence, and point [geo] database in mpbx.toml at it. Restart the PBX once to load it. Without a table nothing can be blocked, and saving a rule is refused (MPBX-NET-GEO-NO-DATABASE).
Per company. A company can add its own SIP rule on top of the install-wide one. It can refuse more, never less.
Travelling users. Exempt one extension from the rule until a date, and remove the exemption when they are back. The extension must still authenticate with its device credentials.
Locking yourself out
- A rule that would block your own address is refused (
MPBX-NET-GEO-LOCKOUT). The page shows the address and country the PBX sees. - Someone on the PBX host can always reach it, because loopback is never blocked. Starting the process with
MPBX_GEO_BYPASS=1ignores the saved rule until you remove it.
Limits
VPNs, roaming mobile carriers and anycast ranges are mis-placed by every country table. Geo blocking lowers noise. It is not authentication. Refusals return MPBX-NET-GEO-BLOCKED; see the network error codes.