[Freeswitch-users] Question about SIP security

[Patrick Lists]

On 07/31/2010 01:54 PM, Hristo Benev wrote:
>  
> I also see a lot of attempts to connect to 5060, but it looks like a botnet since I never have more than 1 form 1 IP - Here fail2ban is helpless since attempts per IP limit is never reached.

Unless you set the number of failed attempts to 1.

If it fits your application you can also use something like
http://www.ipdeny.com/ to block port 5060 for certain countries.

Regards,
Patrick