Limiting incoming SIP calls in Janus SIP plugin to registered server only

General
1

Hello everyone,

I’m currently facing a challenge with a standard Janus setup, where we use the Janus WebSockets Interface along with the Janus SIP plugin. This setup enables app users to register on a SIP server, facilitating both outgoing and incoming calls. The setup is on a VPS with a public IP, and we’re using SIP over UDP. So far, so good.

However, we’ve hit a snag. Users have started receiving unsolicited incoming calls from unknown numbers. After analyzing tcpdump logs on the VPS, it’s apparent that these calls originate from an unknown IP, not the registered SIP server (which operates in proxy mode, implying all calls should only come from its IP). These calls target dynamically allocated ports, not the standard 5060. It appears to be the work of a SIP crawler script, mistakenly probing for a SIP trunk on my server, resulting in these nuisance calls.

I’m exploring solutions but facing constraints:

  1. A firewall rule isn’t feasible due to the dynamic nature of the SIP server IPs our users may register with.
  2. Shifting to TCP for SIP signaling isn’t an option, as some older SIP servers our users rely on don’t support TCP.

This leads to my question, as per the topic title: Is there a way to configure the Janus SIP plugin (or perhaps with some Sofia-SIP settings) to only accept incoming calls from the SIP server it’s registered with?

Any suggestions, workarounds, or insights into how others might have tackled a similar issue would be greatly appreciated.

Thank you in advance for your help!

2

What you’re talking about seems something like a trunk mode, that the SIP plugin currently doesn’t support. When you configure a proxy/outbound you’re telling the plugin where to go through for outgoing calls, it says nothing about how it should process incoming calls. I don’t know if Sofia SIP has a way to enforce that constraint on incoming calls too.

That said, I’ve been working on a trunk mode recently, but it’s not ready yet. Maybe in a few weeks.

1 Like