Keep extensions 7101 and 7102 reachable from approved office addresses and require each extension's password. Configure and test source restriction and authentication independently. This lab uses a directly reachable Linux test node with the FreeSWITCH v1.11.3 vanilla layout. It assumes ordinary IPv4 UDP/TCP SIP on internal port 5060. Review separate listeners and policies for carrier trunks, TLS, WebSocket, or public access.
Restrict sources at the host firewall
Record a baseline registration and a two-way call in both directions. Identify the source IPs as seen by the server. Use two fixed test addresses and a third test endpoint outside the list. If two phones share a NAT egress, the source IP rule sees the same address for both.
Create /etc/nftables.d/fs17-lab.nft on the test node. Verify that the table name is free and substitute the actual source addresses and port. The 192.0.2 addresses are documentation placeholders. The rule applies at the host input hook. A forwarded container port or an SBC can place enforcement on a different path.
table inet fs17_lab {
chain sip_input {
# 只给测试 SIP 端口加来源限制，其他流量继续走现有规则。
type filter hook input priority -10; policy accept;
# 两个地址均为文档占位，加载前替换为服务端看到的来源。
ip saddr { 192.0.2.71, 192.0.2.72 } udp dport 5060 counter accept
ip saddr { 192.0.2.71, 192.0.2.72 } tcp dport 5060 counter accept
# 剩下的 IPv4 和 IPv6 流量都会在这里被拦下。
udp dport 5060 counter drop
tcp dport 5060 counter drop
}
}
The inet family covers IPv4 and IPv6. The two ip saddr rules pass matching IPv4 sources in this chain. The subsequent rules drop other traffic to the same UDP or TCP port and count those matches. Priority -10 controls hook ordering, with lower numbers running earlier. Other base chains can still drop traffic accepted here. RTP, management traffic, and other services continue through the existing policy. Check that the SIP port is dedicated to the intended lab service before loading.
Keep the extension password checks
Find the actual root with fs_cli -x 'global_getvar conf_dir' and back up sip_profiles/internal.xml. Merge the following parameters into its existing settings and leave bindings, domain and dialplan in place. Keep separate directory passwords for 7101 and 7102. Remove any existing apply-register-acl and apply-proxy-acl from this lab profile and check that later includes do not restore them.
<!-- 合并进 internal 的 settings；已有同名设置直接替换。 -->
<!-- 清掉原有信任列表，分机继续走口令认证。 -->
<param name="apply-inbound-acl" value="none"/>
<param name="auth-calls" value="true"/>
<param name="auth-calls-acl-only" value="false"/>
<param name="accept-blind-reg" value="false"/>
<param name="accept-blind-auth" value="false"/>
<param name="inbound-reg-force-matching-username" value="true"/>
The none value clears previously accumulated inbound ACL entries. The vanilla internal profile references domains, which can use directory CIDR entries to authorize requests by address. This lab uses the firewall for network scope and SIP Digest for identity. auth-calls=true enables inbound INVITE authentication and auth-calls-acl-only=false retains the regular challenge path. Both blind settings are disabled. inbound-reg-force-matching-username requires the registration identity and authentication username to agree.
In v1.11.3, a source denied by apply-register-acl gets 403. A matching source can enter REG_AUTO_REGISTER and skip the normal password challenge. Successful registration with the correct password checks only the positive case. Test a wrong password as well. If a carrier or trusted SBC is authenticated by IP, design that path separately with a scoped profile and dialplan entry. A downstream server sees the actual peer address, and identity behind an SBC depends on the trust boundary and authentication on each hop.
Apply and verify both controls
Keep an OS console available. Drain calls on the lab node before restarting the profile. A profile restart can interrupt calls and registrations. Refresh the XML and verify the profile and new registrations after the restart.
# 确认当前 SIP profile、实际端口与管理规则。
fs_cli -x 'sofia status profile internal'
sudo nft list ruleset
# 检查语法后，仅加载实验表。
sudo nft -c -f /etc/nftables.d/fs17-lab.nft
sudo nft -f /etc/nftables.d/fs17-lab.nft
sudo nft list table inet fs17_lab
# 在无活跃通话的测试机上重新读取 Sofia profile。
fs_cli -x 'reloadxml'
fs_cli -x 'sofia profile internal restart'
fs_cli -x 'sofia status profile internal reg'
Start a fresh registration from 7101 on an allowed address. Look for the challenge, the authenticated retry, and a successful final response. Repeat with 7102. Call each direction and check two-way audio. Then use a wrong password with a test account from an allowed address. Confirm that no new binding succeeds. Remove the old binding through normal phone unregistration or wait for expiry, and correlate the result by time and address. An initial 401 can be part of normal authentication.
From an owned third endpoint outside the list, attempt registration using the same authorized test account. Verify the drop counter and confirm that the request did not reach FreeSWITCH. A timeout without a 403 is expected for a packet dropped at the firewall. In this lab, 7101 and 7102 are SIP extensions. Agent and tier state belongs to queue dispatch.
Diagnose and roll back
- An approved phone times out. Check the counters, the actual source address and port, and other chains. Verify the input or forward path for a container.
- A wrong password still registers. Rule out an old binding, identify the actual profile, and inspect the registration ACL and blind or trusted settings. Use redacted SIP signaling to confirm whether a new authentication exchange occurred.
- Registration works and calling fails. Examine INVITE authentication and dialplan context separately. Routing, agent state and media each need their own checks.
- A password change causes repeated challenges. Compare the username, realm and offered algorithms. RFC 8760 defines stronger Digest algorithms. Confirm support at both ends before changing the deployment.
Restore the backed-up profile and verify its restart from the console. Remove the experiment table with sudo nft delete table inet fs17_lab and remove any persistent include you added for the temporary file. Retest registration and calling in both directions. These expected results were checked against public documentation and source code without a live deployment test.