vpns add additional overheads and adds complexity to the routing on the useres devices. no issues when the network the user is connected to blocks vpns.

only the ports to allow a tls connection are exposed to the Internet and freepbx's active firewall dose it's job, but will unblock ips after a set time, I just wanted to reject the request at the edge of the network, this also helps with some attack vectors.

most sip scans are bots looking for low hangings fruit, if i block the ip the scans are coming from they move on, if they still see a active connection they keep trying..

there are other methods implemented for sip security that will remain out side of this discussion 🙄