Being asked to open all outbound ports

[snagrat]

I am supporting a company and I have been asked by a third party telephone provider to open up all TCP/UDP ports to a /20 IP range.

 

I have pushed back to ask for confirmation of the exact ports that need to be opened but they are still pushing for all. They have suggested only doing it for the phones rather than the whole internal network.

 

However, I am still not happy. Am I right that the specific ports numbers should be provided? A /20 also seems large for a phone system to work.

 

What is the risk with having outbound ports open (not inbound) in this situation

[Oaktech]

Cover.

 

Your.

 

A**.

[CHiLL]

What @Oaktech said.

 

ChatGPT outlines some security concerns for this request, with the key takeaway being:

Opening all outbound ports for a /20 CIDR network greatly increases your attack surface, making it easier for external attackers, malware, and insiders to exploit vulnerabilities. This practice is highly discouraged unless there are robust compensating controls in place.

[localzuk]

SIP uses ports around 5060-5082 for the SIP stuff. But then the media can use 10000-2000 or maybe 49152-64512 etc... so a huge range of ports.

 

Do you know what underlying system it is?

[snagrat]

SIP uses ports around 5060-5082 for the SIP stuff. But then the media can use 10000-2000 or maybe 49152-64512 etc... so a huge range of ports.

 

Do you know what underlying system it is?

 

I'm not aware of the system, it's their own system apparently?

 

I'm aware the media ports can be a large range which I would be happy with, but surely they should know what these are. Plus, the media range is normally on a range not used by any other service.

[mavhc]

I assume they're running the pbx, surely they should setup a vpn

 

They're just making it simple for themselves to debug of course. I've seen hosted pbx companies go as far as to supply an internet connection and router to a site to avoid config problems

 

However what does opening all ports for that IP range mean in the end? That your devices can make connections to that IP range. Is that a problem? It's not incoming ports to your network

[snagrat]

I assume they're running the pbx, surely they should setup a vpn

 

They're just making it simple for themselves to debug of course. I've seen hosted pbx companies go as far as to supply an internet connection and router to a site to avoid config problems

 

However what does opening all ports for that IP range mean in the end? That your devices can make connections to that IP range. Is that a problem? It's not incoming ports to your network

 

I wouldn’t worry too much if it was a smaller subnet, but again why do I need to open for 4000 IP addresses?

 

Some risk is acceptable, but I feel their requirements could be easily reduced if they knew the setup better

[Davit2005]

Some of these suppliers have no idea, it bugs the hell out of me. We get asked to add IP addresses to allowlists for incoming and I have to continually say we only work with firewall policies that are specific. From > To and application and/or port. Then it takes them a week (or more) to give us the correct info.

[akidosaint]

Push to have your concerns dealt with by their 2nd line\3rd line techs. I suspect sales bod\engineer are commissioned per successful onboarding

 

Also what happens if you google the /20 address does this return just the company or as localzuk alluded to is there a bigger company such as Gamma or BT cloudvoice providing the back end. I've seen a school switch supplier but pretty much stick with the same back end with a few additional ports.

[snagrat]

Well the /20 range is based on Switzerland which is another red flag for this.

[Edu-IT]

I'm not aware of the system, it's their own system apparently?

 

I'm aware the media ports can be a large range which I would be happy with, but surely they should know what these are. Plus, the media range is normally on a range not used by any other service.

Who is the provider?

[MatthewL]

Your right to ask, we've had big companies say no and ended up monitoring firewalls to restrict things down.

 

Typically voice will use a range of ports such as 5080, 5060, 5061, 5004, 9000, 80, 443, 5004, 9000, 10000-60000 (used for Webex client for example), we have a list of IP's along as anything, but when you look at the FQDN's its using its only a handful.

 

Our handsets are on a seperate network but as you are locking down a set number of ports to that IP list you are locking things down as best as you can but VOIP does require quite a bit, don't be surprised for them to ask you for you external IP to allow things through, if you can create an outbound NAT for them bits and give it its own IP address if you have any spare.

 

On the other hand 3CX only requires 5060, 5061, 5090, 9000-10999 in my instance. Any good supplier will have a technical document available on their website with the details in, stand your ground and get it all from them in a confirmed email, don't be surprised if things change once you have implemented it and they don't tell you, common theme we have with our VOIP supplier.

[PaddyNewman]

It's a hard no from me, most providers will have specifics. If they don't, at most I'd open UDP 5060 and 10000-65535.

 

Gamma use 6000-40000 for voice, but others use 10k+ so... Worth a try.

 

Also would assume you can lock down a source VLAN too, so limit your spread.

 

Gamma ask you to allow a /18 or something so the size doesn't bother me but I'm always cautious about companies that say 'all ports mate'...

[mavhc]

They're outgoing ports though, not incoming, right?

[snagrat]

They're outgoing ports though, not incoming, right?

Correct.

[mavhc]

So what's the theoretical security problem? That your phones can make phone calls?

[snagrat]

So what's the theoretical security problem? That your phones can make phone calls?

Or.....

 

IP range is sold in future. Ransomware/Virus uses non-standard port to steal data.

 

Unlikely, but I have been involved in a situation where ransomware did upload over non-standard ports.

[msi_school]

So what's the theoretical security problem? That your phones can make phone calls?

 

I agree with @mavhc, what's the problem? These ports are out going, you are not making allowing any extra access into your network by opening them, a stateful firewall generally already has all outgoing open as a default.

[mavhc]

Or.....

 

IP range is sold in future. Ransomware/Virus uses non-standard port to steal data.

 

Unlikely, but I have been involved in a situation where ransomware did upload over non-standard ports.

 

What data?

 

It's a managed phone service I assume, so maybe they can change the config of your phones, in which case vlan them off from the rest of the network.

 

Pretty sure that when the phone company goes bust you'll notice before your phones start connecting to Evil Corp

[TechMonkey]

Not sure I get the argument here, we are now arguing to be slap dash about our boundary and security?

 

Things should not be opened unless needed, and least privileges permitted, in or out. Outgoing allows nefarious players to establish a connection. It is why we lock down DNS connections to only selected services or internal. As snagrat said, there would be no control over who the IP addresses are used by. Potentially that could be the range of a hosted service or cloud service (AWS, Azure, Google Cloud) which would mean anyone on those services would have the ability to setup a communication channel. Just let everything through is quite an outdated practice.

[snagrat]

What data?

 

It's a managed phone service I assume, so maybe they can change the config of your phones, in which case vlan them off from the rest of the network.

 

Pretty sure that when the phone company goes bust you'll notice before your phones start connecting to Evil Corp

 

The data from any computer or server. It may not be a phone if the client IP changes through DHCP? VLAN is an option but not right away, or fix IP the phones so we could at least modify the rule to only include them.

 

As it is a /20, it is unlikely that the phone system needs the whole range. Possibly using only a /32 which would leave the possibility for the remaining IPs to move to a different solution at any point without us knowing.

 

 

Its all highly unlikely, I appreciate that, but alarm bells will ring when the provider is unable to confirm what specific ports are required.

[psydii]

SIP is old and crappy and sensitive to latency so pushing it through a vpn presents its own challenges. We've got firewall rules for all the SIP devices to allow them the access they have asked for.

 

It hurts my soul, but not as much as getting fired because the phone system doesn't work properly.

[Dos_Box]

Paging @tom_newton

[tom_newton]

SIP is a bit of a crummy protocol. The setup is done on 5060 but then the rtp streams are all random high port. A sip helper or proxy can work out which ports to open in real-time.

 

My suggestion is to vlan off the phones and open the ports outbound just for them, outbound doesn't offer too much impact to security as long as its not arbitrary for eg desktops that could be compromised and use open ports for exfil

[mavhc]

The data from any computer or server. It may not be a phone if the client IP changes through DHCP? VLAN is an option but not right away, or fix IP the phones so we could at least modify the rule to only include them.

 

As it is a /20, it is unlikely that the phone system needs the whole range. Possibly using only a /32 which would leave the possibility for the remaining IPs to move to a different solution at any point without us knowing.

 

 

Its all highly unlikely, I appreciate that, but alarm bells will ring when the provider is unable to confirm what specific ports are required.

 

I'm still confused, how will Dr Evil make a computer on your LAN send data to IPs currently owned by another company? Firstly they'd just send it to an IP they rented from Azure/AWS/GCS that you wouldn't be suspicious of, secondly how did they access your server?

 

I agree that the VOIP company is crap though, I suggest Gamma SIP and running Freepbx locally, I have 1 IP on my end connected to 1 IP on their end