SBC and Network Security

The SBC (Session Border Controller) area is where UCBC protects and manages the network edge of your phone system — the boundary where calls and traffic enter and leave your box. This is a security- and network-administration area: the tools here watch for abuse, control who can reach your system, manage your network settings, and let you investigate call/connection problems without needing command-line access.

Overview#

This area includes:

• Nodes — the list of call-handling destinations your system's front door forwards traffic to, plus a live system status view.
• Networking — your network interfaces (IP addresses) and static routes, including a live traffic chart per interface.
• Firewall — four tabs: Firewall rules, Banned IPs, Access Controls, and a Whitelist that protects trusted addresses from every automatic ban mechanism.
• Fraud Detection — flags suspicious outbound call patterns, such as calls from an unexpected country or to a number range commonly abused for fraud.
• ACME Settings — automatic SSL/TLS certificate issuance and renewal for Microsoft Teams trunks.
• Event Guard Logs — a record of registration attempts that were automatically blocked.
• Troubleshooting (brief mention) — a built-in live packet-capture and call-event tool for diagnosing problems without shell access.

---

The SBC Nodes screen

Screenshot needed · sbc-nodes

Nodes#

What it's for: Nodes tell your system's front door where to send incoming SIP traffic — essentially, the list of real call-processing destinations behind the scenes. Most installs only need the automatically-managed ones that are already there.

How to use it:

1. Go to SBC > Nodes. The Nodes tab lists each destination, its Set (SIP or WebSocket), status, and description. Changes take effect within a few seconds automatically.
2. Click Add to create one manually: choose the Set (1 = SIP, 2 = WebSocket), enter the Destination (e.g. sip:127.0.0.1:5080), set Enabled, and save.
3. A node marked (system) is managed automatically and cannot be deleted.
4. The Status tab shows whether the underlying services are running, how many IP addresses are currently banned, and the live health of each destination set.

---

Networking#

What it's for: lets you view and change your server's own network configuration — IP addresses, gateways, and static routes — directly from the web interface, without needing to connect over SSH.

How to use it — Interfaces tab:

1. Go to SBC > Networking. Each network interface is listed with its current IP/CIDR, gateway, hardware address, and state.
2. Click Edit next to an interface to change its IP Address/CIDR or Gateway. Saving asks for double confirmation, since changing the address of the interface you're connected through can disconnect your own session.
3. If you change an interface's address, a reminder banner appears with a Write to All System button — click it to propagate the new address to every other part of the system that also needs to know it (so nothing is left pointing at the old address).

How to use it — Routing tab:

1. Open the Routing tab to see current static routes (destination, gateway, device, metric).
2. Add a new route by entering a Destination (a network, a single address, or default), a Gateway, and optionally a specific Device, then click Add Route.
3. Edit or delete an existing route using the controls next to each row.

Live traffic view: click any interface's name to open a live, real-time chart of its send/receive rate, along with the peak rates seen since you opened the page. Useful for confirming a circuit is actually passing traffic, or spotting an unexpected spike.

---

The SBC Networking screen

Screenshot needed · sbc-networking

Firewall#

What it's for: controls which addresses, ports, and protocols are allowed to reach your system at the network level, and shows you who's currently banned for bad behavior.

Firewall tab#

• System Rules are the platform's own fixed, built-in rules (protocol and port are fixed and cannot be changed) — you can only narrow which Source IP/CIDR is allowed to reach each one. Leaving the source blank allows any address (the default).
• Custom Rules are rules you create yourself.

How to add a custom rule:

1. Go to SBC > Firewall (Firewall tab) and click Add.
2. Choose Action (Allow or Deny), Protocol (TCP/UDP/ICMP/All), and optionally a Port or port range (only valid for TCP/UDP).
3. Optionally restrict it to a Source IP/CIDR.
4. Set Enabled and save.

A Deny rule always requires a specific source address or network — you cannot deny "everywhere," and you cannot deny a network wider than roughly 16.7 million addresses (a /8), since that's almost always a mistake rather than an intentional block. The system also blocks you from denying its own trusted internal addresses, since that would break call processing.

How to edit/delete: click a custom rule to edit it, or select rows and click Delete. System rules can only have their source address edited (via the edit link on that row) — the underlying rule itself can't be removed.

Banned IPs tab#

Shows IP addresses currently banned by two independent mechanisms:

• Flood/scan and repeated-authentication-failure bans — automatic, short-lived bans (currently around 3 days) triggered by abusive SIP traffic patterns.
• OS-level firewall bans — a separate, lower-level banning mechanism.

Use the search box to find a specific address, and click Unban next to any entry to lift it immediately.

Whitelist tab#

What it's for: protects a trusted IP address or network from every automatic ban mechanism on the platform at once — both the flood/scan/auth-failure bans and the OS-level firewall bans. Use this for addresses you know are safe but that might otherwise trip a ban (for example, your own office IP, a monitoring service, or a carrier that occasionally sends bursts of traffic).

How to use it:

1. Go to SBC > Firewall > Whitelist.
2. Enter the IP Address / CIDR (e.g. 203.0.113.5 or 203.0.113.0/24) and an optional description.
3. Click Add to Whitelist. The address is exempted from automatic bans within seconds.
4. Remove an entry at any time using the Delete action next to it.

Access Controls tab#

Manages reusable named lists of allowed/denied networks that other parts of the system (such as domains or trunks) can reference. Supports the same add, copy, and delete actions as other list screens in the platform.

---

Fraud Detection#

What it's for: Fraud Detection watches your outbound call traffic for signs of compromise or abuse — for example, a sudden run of calls from a country that customer has never called from before, or calls to international number ranges commonly targeted by International Revenue Share Fraud (IRSF) schemes. It surfaces these as a flagged list for you to review; it does not place or block calls on its own.

How to use it:

1. Go to SBC > Fraud Detection. By default you see only flagged calls (geo-mismatch or high-risk destination).
2. Use the date range and domain filters to narrow the results, or click Search/Reset.
3. The summary tiles at the top (Total Calls, Geo-Mismatch, High-Risk Destination, Source Countries) are clickable — clicking one filters the table to just that subset.
4. Expand the Calls by Source Country chart to see call volume by country, with any country that had a flagged call highlighted.
5. Review the detailed table: each row shows the call's time, customer, caller ID, destination, source IP and its resolved ISP/country, whether that source country matches the customer's own usual calling pattern, and whether the destination is flagged as high-risk.

---

ACME Settings#

What it's for: manages one platform-wide account with a trusted certificate authority (SSL.com or ZeroSSL), used to automatically request, install, and renew SSL/TLS certificates — most importantly, the certificates required for Microsoft Teams Direct Routing trunks (see the Customer Trunks article). This is a one-time, platform-wide setup, not something done per customer.

How to use it:

1. Go to SBC > ACME Settings.
2. Enter the Base Domain this platform uses for trunk subdomains (e.g. ucbc.example.com).
3. Choose a Certificate Authority (SSL.com or ZeroSSL) — note that Let's Encrypt is not accepted by Microsoft for this purpose and is not offered here.
4. Enter your Contact Email, and the EAB Key ID and EAB HMAC Key from your chosen certificate authority's account (the in-app how-to guide on the same page walks through getting these).
5. Click Save.

Once configured, every Microsoft Teams trunk created afterward can issue its own certificate with a single click from its own setup tab, and certificates are renewed automatically before they expire — nothing further to schedule.

---

Event Guard Logs#

What it's for: a log of registration attempts that were automatically blocked — for example, repeated failed login attempts from a given address, or traffic blocked purely based on its source IP. This is a useful first place to check when investigating a suspected brute-force attempt against an extension or trunk.

How to use it:

1. Go to Event Guard > Logs.
2. Use the Filter dropdown to narrow the list to IP-based blocks or authentication-failure blocks, or use the search box to look up a specific host, IP address, or extension.
3. Each entry shows the date/time, which filter triggered it, the source IP address (linked to a public IP lookup), the extension targeted (if any), and the status.
4. Select entries and use the Unblock action to remove a block you've confirmed is not a real threat.

---

Troubleshooting (Packet Capture / Event Capture)#

What it's for: a built-in, live diagnostic tool for investigating call quality or connection problems — such as a call that drops, has no audio, or fails to connect — without needing shell or SSH access to the server.

How to use it:

1. Go to Troubleshooting. There are two tabs:
   • Packet Capture — a live, real network packet capture session you can start and stop from the browser, with its own built-in filtering and call-flow view, plus a list of saved captures you can download.
   • Event Capture — a live view of internal call-processing events, useful for tracing what the system itself did with a call step by step.
2. Click Start Capture to begin a session; a live terminal view opens in the browser.
3. Use the tool's own filters to narrow what you're looking at to a specific call, extension, or IP address.
4. Click Stop when finished. Each session is isolated to the person who started it and is automatically cleaned up when the browser tab is closed.

This tool is intended for diagnosing a specific, active problem — for routine monitoring, use the Fraud Detection, Banned IPs, and Event Guard Logs tools described above instead.

Tips & Common Issues#

• A trusted partner keeps getting banned: add their address to the Whitelist tab rather than repeatedly unbanning them — the whitelist exempts them from every automatic ban mechanism going forward.
• Changed a server's IP address and lost connectivity: use Write to All System immediately after the change so every other service that referenced the old address is updated at the same time.
• A Deny rule won't save: check that you've specified a source address/network (not "any") and that it isn't unusually wide or one of the system's own protected addresses.
• Fraud Detection shows "not resolved" for Usual Country: this means the customer doesn't yet have enough call history for the system to establish a normal calling pattern — it isn't a "No," just "not enough data yet."
• MS Teams certificate setup fails: confirm ACME Settings has been configured once, platform-wide, before trying to issue a certificate for an individual trunk.