SMS Firewall & Operator Security

An SMS firewall is a network element that inspects inbound A2P and P2P messaging traffic to protect a mobile operator's revenue and its subscribers. It sits in the messaging path and enforces both security policy and commercial policy on enterprise senders.

The commercial case is direct: A2P messaging is a significant operator revenue stream, and grey-route bypass leaks it. The firewall's job is to detect that bypass, block it, and force traffic back onto billed, official channels.

The subscriber-protection case is equally important: filtering spam, smishing, and sender-ID spoofing preserves trust in the operator's network. GSMA guidance (the IR.70/IR.71 family and the FS security series) frames the controls a firewall is expected to implement.

Grey-route / MT-bypass is typically the largest single leak: A2P traffic delivered as P2P, or injected at the signalling layer, to avoid termination fees. Detecting it means recognising traffic that behaves like an enterprise sender but arrives through a person-to-person path.

Sender-ID spoofing and brand impersonation let fraudsters send messages that appear to come from a bank or a well-known service. Smishing — SMS phishing — rides on this, using convincing sender IDs and malicious URLs to steal credentials.

SIM-farm abuse and spam add volume-based threats: high fan-out, repeated content, and velocity spikes that a firewall must distinguish from legitimate high-volume P2P. Signalling-layer anomalies — SRI-SM probing, faked-MSC addresses — are handled with reference to GSMA FS.11 category controls.

Inline (SMSC MT proxy) mode places the firewall directly in the message path so it can block in real time. It offers the strongest enforcement but sits on the critical path, so high availability and low latency under load are non-negotiable.

Offline or passive mode mirrors traffic for analysis without blocking. It is useful for baselining and tuning detection rules before enforcement, and for producing evidence, but it cannot stop a message on its own.

Home-routing is the deployment that closes the bypass gap most decisively, and it deserves its own lesson because of how it changes the signalling flow.

In classic SS7 delivery, a sending network first queries the recipient's network with an SRI-SM (Send Routing Info for Short Message) to learn where the subscriber is, then delivers the message straight to that location. Bypass exploits this by injecting MT messages directly, sidestepping the operator's billing and controls.

Home-routing intercepts the SRI-SM and returns the address of the firewall instead of the real subscriber location. All MT-terminating traffic is then forced through the firewall, which inspects, bills, and forwards it — closing the direct-injection path.

This is why home-routing is central to A2P revenue assurance: it makes the firewall an unavoidable checkpoint for every terminating message, rather than one that clever bypass can route around.

Blocking bypass is only half the value; the other half is converting the recovered traffic into revenue. Once grey-route traffic is forced onto official channels, it becomes billable A2P — the core commercial argument for deploying a firewall.

Sound programmes run new rules in shadow / simulation mode against live traffic first, so a policy change doesn't cause revenue-affecting false positives at go-live. Rule changes should be versioned, auditable, and access-controlled.

Evidence closes the loop: exportable reports, per-route reconciliation quantifying leakage recovered, and signalling traces that support disputes with wholesale partners. BroadNet's operator-side firewall and SS7-firewall products implement these controls, backed by ISO 27001 and SOC 2 Type II certification.