Had to open 5060 inbound to get one providers trunk to signal inbound calls (either #STUN isn't working there or some #NAT issues), with predictable results..
Got older version of #fail2ban on this box to yeet all blighters trying to get in - by turning on security logging in /etc/asterisk/logfiles_custom.conf (add entry security_log => security), updating regexes in /etc/fail2ban/filter.d and pointing failt2ban jail to check /var/log/asterisk/security_log (main Asterisk log is in wrong format and I don't know enough regex to fix that)
Also registered a #Voipfone virtual PBX extension to use as an extra trunk (needs contact-user and from-user set in #PJSIP config)
The picture @alex drew a few months back sums up exactly what dealing with these #VOIP #trunks is like




