Secure a Yeastar P-Series: remote access, FQDN, anti-fraud

The short answer: a Yeastar P-Series has every protection it needs, but they only help if they are enabled and tuned. We organise them in four layers. One: never expose the phone system through port forwarding, and use the Remote Access Service with a Yeastar FQDN. Two: filter the network, with allowed countries, Yeastar’s global blocklist and auto defense. Three: protect accounts, with two-factor authentication, strong passwords and registration restrictions. Four: limit outbound calls, the last line of defence against toll fraud. Firmware updates complete the set.

At ALLSAFE SOLUTIONS, a Yeastar certified partner and a specialist in cybersecurity in Morocco, we apply these settings on every phone system we install or take over. Every feature cited comes from the P-Series security guide published on help.yeastar.com and from the security page on yeastar.com. Menu names are those of the Software edition; they may vary slightly by edition and version.

Why a phone system is a target

A phone system exposed to the internet attracts two kinds of attacks: mass registration attempts on SIP accounts, and attempts on the administration interface. The goal is almost always the same: placing calls to premium-rate or international numbers at the company’s expense, often at night or at weekends. Yeastar’s guide makes the point: attempts mostly happen outside business hours, over weekends and during holidays. The bill then lands with the carrier.

Threat	Yeastar feature that addresses it
System exposed through port forwarding	Remote Access Service, Yeastar FQDN
Attacks from countries unrelated to the business	Allowed Country IPs
Known malicious IP addresses	Global Anti-hacking IP Blocklist
Brute force, request flooding	Auto Defense (dynamic firewall rules)
Stolen administrator password	Two-factor authentication, password policy
Unknown device registering an extension	User Agent and IP restrictions, lockout after failures
Fraudulent outbound calls	Route permissions, PIN, time conditions, allowed countries, call frequency and duration
Known software vulnerability	Automatic firmware upgrade

Layer 1: remote access without port forwarding

Yeastar’s recommendation is clear: avoid port forwarding, which exposes the system to the internet, and use the Remote Access Service. This service binds a Yeastar-supplied domain name (FQDN) to the phone system, giving secure access to the web portal and Linkus clients, as well as remote LDAP server access, without opening a port on the company firewall.

Three points to watch:

• The FQDN is permanent. Yeastar states it cannot be changed once saved. Choose a neutral name.
• Restrict accounts. By default, every extension can reach the Linkus web client via the FQDN. Yeastar recommends restricting remote access by account and by IP address.
• Remote SIP. If remote SIP registration via the FQDN is enabled, Yeastar recommends the same account and IP restrictions.

For users, rolling out Linkus remotely is covered in our guide to Yeastar Linkus. If your network already has a business firewall, it stays on the front line: we configure it with the same rigour as in 10 FortiGate security settings after installation.

Layer 2: network filtering built into the phone system

Allowed Country IPs. Under Security > Security Settings, enable the protection and allow only the countries and regions you need. Yeastar’s warning: allow your own country first, or you lose access to the system. Also think of the countries where Linkus users travel, and the region of the DNS server used by the system, on which push notifications depend.

Global Anti-hacking IP Blocklist. Yeastar centralises IP addresses blocked by Yeastar systems worldwide and suspected of malicious activity. By joining the programme, the system drops every connection from these addresses. Participation is checked under Security > Security Settings > Security Options.

Static Defense. Static firewall rules accept trusted addresses and block known threats. Yeastar advises keeping the local network accept rules before adding restrictive ones, and blocking untrusted HTTP access on port 80, since many attacks come through web connections.

Auto Defense. Dynamic rules automatically block an IP address that sends too many packets within a given period, which neutralises brute force and mass connection attempts. The system ships with default rules for SSH, SIP registration and web access, which can be extended.

Layer 3: accounts and registrations

Super administrator two-factor authentication. From the portal, account menu then security settings, enable 2FA with an authenticator app (Google Authenticator, Microsoft Authenticator, FreeOTP or Authy) or a code sent by email. A trusted device option avoids re-entering the code on the usual workstation. For the broader framework, see rolling out MFA in a business.

User two-factor authentication. The administrator can make 2FA mandatory for all extensions (Security Options). Otherwise each user chooses whether to enable it in the Linkus desktop or web client.

Passwords and roles. The system can enforce a minimum length and prevent reuse of recent passwords. Yeastar recommends complex SIP credentials, without the extension number or name. Built-in roles (administrator, operator, employee) and custom roles limit what each person can do.

Automatic lockout. After a number of failed logins or registrations from the same address, the system blocks that address and lists it under Blocked IPs.

Per-extension registration restrictions. In each extension’s Security tab, you can require a specific User Agent (for example the deployed phone model) and accept only certain IP addresses or subnets. Keep the number of concurrent registrations to the strict minimum.

Layer 4: anti-fraud on outbound calls

Yeastar calls outbound call security the last line of defence: if an account is compromised, it limits the damage.

Measure	What it does
Outbound route permissions	Separate routes for local, national and international calls, granted only to the relevant extensions
PIN code	A code must be entered before dialling on a sensitive route
Time conditions	Outbound calls allowed only during business hours
Allowed country codes	International calls limited to the users and countries needed
Blocked numbers	Blocking premium-rate numbers or prefixes
Call frequency	Cap on outbound calls per extension over a period
Concurrent calls	Cap on each SIP trunk
Call duration	Maximum duration, global or per extension

These rules work alongside the carrier’s: also ask for unneeded destinations to be blocked at trunk level; on choosing the trunk itself, see SIP trunk: keep your business numbers.

The system: updates, SSH, ports

Yeastar’s guide stresses three settings. Keep firmware up to date, with the automatic upgrade option under Maintenance > Upgrade, ideally outside business hours. Disable SSH and enable it only for troubleshooting. Change default ports if the system is exposed, port 5060 being a prime target. Finally, enable security event notifications (web user blocked, Linkus user blocked, extension registration blocked) to an address someone actually monitors.

Who protects what: phone system, firewall, carrier

Phone system security does not rest on a single device. We split the roles as follows:

Level	Role	Examples
Company firewall	Expose nothing, segment	No forwarding to the phone system, separate voice VLAN, SIP ALG disabled
Yeastar phone system	Filter, authenticate, limit	Allowed countries, blocklist, auto defense, 2FA, outbound rules
SIP trunk carrier	Limit at network level	Blocked destinations, call caps, usage alerts depending on the offer
Monitoring	Detect and respond	Lockout alerts, unusual call volumes, repeated login failures

The last level is often the most neglected. A well-tuned phone system that sends its alerts into the void only half protects you: someone has to read the notifications and act. That is the purpose of the 24/7 monitoring we provide, and of our overall approach to network security.

Mistakes we fix

1. Port 5060 and the web interface forwarded to the phone system to help a remote worker, then forgotten.
2. Country filtering enabled without allowing Morocco, or so strict that Linkus push stops working.
3. Global blocklist not joined, although it takes one checkbox.
4. A shared administrator password, without 2FA.
5. Weak SIP credentials reusing the extension number.
6. A single outbound route giving international access to every phone, at any hour.
7. Firmware never updated since installation.
8. Security alerts sent to a mailbox nobody reads.

Yeastar P-Series security checklist

• No port forwarding; Remote Access Service and FQDN in place.
• Remote access limited by account and IP address.
• Allowed countries set, Morocco included.
• Global Anti-hacking IP Blocklist joined.
• Auto Defense active, HTTP port 80 blocked from outside.
• Super administrator 2FA, 2FA enforced for extensions.
• Password policy and roles defined.
• User Agent and IP restricted for sensitive extensions.
• Outbound routes, PIN, hours, countries, frequency, duration.
• Automatic firmware upgrade, SSH disabled.
• Security notifications sent to a monitored address.

How we work

We start with a security audit of the phone system: internet exposure, accounts, routing rules, call logs and blocked addresses. We then apply the four layers described here, document the settings, and check that remote access and push notifications still work. The system is then monitored 24/7 as part of our IP telephony in Morocco offering, with critical incidents handled in under 15 minutes. Migrating from an older model? See Yeastar S-Series to P-Series migration.

Unsure about your phone system’s configuration? Request your free phone system audit: we reply within 24 business hours with a list of priority fixes.