Skip to main content

Security and network access

Admin IP allow-list​

Under Admin, IP allow-list you limit who can reach the administration of the PBX to a list of networks. The check runs before sign-in: a request from any other address gets 403 MPBX-NET-ADMIN-IP-DENIED and the answer reveals nothing about users or tokens.

  • Entries are IPv4 or IPv6 addresses or CIDR blocks, up to 64.
  • Scope system covers the install-wide administration. Scope api covers every /api/v1 route, including the apps' sign-in; use it only when all users come from known networks or a VPN.
  • It is off by default. Changes are audited.
  • A list that excludes your own address is refused (MPBX-NET-ALLOWLIST-LOCKOUT); the console offers "Add my address".
  • Loopback is always allowed, so someone with a shell on the PBX host can always fix the list.

Behind a reverse proxy​

The allow-list judges the address the PBX sees. Behind a reverse proxy without further configuration, every client looks like the proxy, and the loopback rule then lets everybody in when the proxy runs on the same host. Whenever you use the allow-list behind a proxy, set in mpbx.toml:

[http]
trusted_proxies = ["10.0.0.0/8"]   # the networks of your own proxies

The X-Forwarded-For header is then read only when the connection comes from one of those networks. The older trust_forwarded_for = true switch also works, but trusts the header from any peer, so use it only when the API port cannot be reached except through the proxy. See Install with Docker Compose for the deployment layout.

Other protections​

  • Geo blocking and the SIP edge (allow list, deny list and bans) protect the API and the phone ports.
  • Two-factor sign-in and single sign-on protect accounts.
  • Audit log: see Activity and history.