---
title: "Asterisk PBX Security"
slug: "asterisk-pbx-security"
description: "This article provides essential information on locking down and securing your Asterisk PBX."
tags: ["firewall", "Asterisk", "pbx", "configuration", "outbound", "IP addresses", "password", "SIP", "sip trunk configuration"]
updated: 2025-10-28T20:32:08Z
published: 2025-10-28T20:32:08Z
canonical: "support.bcmone.com/asterisk-pbx-security"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.bcmone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Asterisk PBX Security

As attacks become more sophisticated over time, it's crucial to ensure your Asterisk system is as secure as possible.

- To make brute-force attacks on your system more difficult by not revealing valid extensions on your system, add the following line to the appropriate ***.conf** file—for example, **sip.conf** or **sip_general_custom.conf**:

`alwaysauthreject=yes`
- To bind your Asterisk phone system to communicate on a non-standard port, add the following line to the appropriate conf file—for example, **sip.conf** or **sip_general_custom.conf**. By implementing this, your system will no longer communicate on port **5060**, and will instead use the value specified by `####`, where `####` is your SIP communication port: `bindport=####`
- If you are using [Outbound Allowed IPs](/flowroute-support/docs/set-up-account-restrictions-for-fraud-prevention) and *not* using SIP credentials in the PBX, remove the **username** and **password** from your Flowroute peer details.
- Install and configure [Fail2ban](http://www.fail2ban.org/wiki/index.php/Main_Page) so that IPs attempting authentication with your Asterisk PBX system will be blocked from contacting your system.
- If possible, reduce the default RTP port range your Asterisk phone systems uses. If you are not using more than 100 concurrent connections, you can reduce the RTP range in **/etc/asterisk/rtp.conf** from `10000-20000` down to `19000-20000`. This reduces the number of open ports on your system.
- Change the default ARI, AMP, and FOP passwords in the **amportal.conf**. It is ideal to lock-out the AMI port—the default is **5038** using IP Tables from anyone outside your network.

> [!WARNING]
> **NOTE:** This file only exists on systems which have the FreePBX installed.
- Ensure that your Asterisk phone system uses strong passwords and that no blank password is set as a default password. You can generate strong passwords from any of the following sites:

  - [www.strongpasswordgenerator.com](http://strongpasswordgenerator.com/)
  - [Norton Password Generator](https://identitysafe.norton.com/password-generator/)
  - [Gibson Research Corporation](https://www.grc.com/passwords.htm)
- Use a Firewall to restrict traffic from and into your system. Refer to [Interconnection with Flowroute](/flowroute-support/docs/interconnection-with-flowroute-pops) and [Firewall Requirements for Direct Media Delivery](/flowroute-support/docs/firewall-requirements-for-direct-media-delivery) for more information on how to configure whitelisting for Flowroute services.
- Review your system logs as well keep your system patched and up-to-date from application flaws.

## Related

- [Firewall Requirements for Direct Media Delivery](/firewall-requirements-for-direct-media-delivery.md)
- [Reviewing Your Connected PoPs](/reviewing-your-connected-pops.md)