[Freeswitch-users] Banning IP address that attempt registration via IP

[Jai Rangi]

This little script has been doing a great job for us.

#!/bin/bash
publicIP=`/sbin/ifconfig eth0 | sed -En 's/.*inet
(addr:)?(([0-9]*\.){3}[0-9]*).*/\2/p'`
for ip in `grep "Can't find user"
/usr/local/freeswitch/var/log/freeswitch/freeswitch.log | grep $publicIP |
awk '{print $10}'  | sort  | uniq` ; do
       /sbin/iptables -I INPUT -s $ip -m comment --comment "`date`
$comment" -j DROP
done


*Jai Rangi*
Cebod Technologies LLC dba DIDforSale/Cebod Telecom
O 949-471-0102 | C 949-419-7634 <1-949-419-7634> | F 949-269-0449 /
949-232-1410 | jprangi at didforsale.com  www.didforsale.com |2472 Chambers Rd
Ste 100, Tustin, CA 92780







On Sun, Jul 26, 2020 at 8:57 PM Don Hawkins <hawkins at hawkinsegroup.com>
wrote:

> Hey everyone!
>
> So I have quite a few "security" features installed on the server,
> including custom IP banning methods using IP Tables, (fail2ban caused too
> many issues).
>
> All endpoints on our system register via a domain, I'm looking for
> suggestions on how to block IP addresses that attempt to register with the
> IP address only.
>
> In other words, every time the warning below is received I'd like to ban
> that particular IP or at least add it to a list somewhere.
>
> WARNING: "You must define a domain called 'XXX.XXX.XX.XXX' in your
> directory and add a user with the id"
>
> I'm thinking of a custom script that scans the logs (which logs?)
>
> Any advice is appreciated.
>
> Thanks!
>
> _________________________________________________________________________
>
> The FreeSWITCH project is sponsored by SignalWire https://signalwire.com
> Enhance your FreeSWITCH install with disruptive priced SMS and PSTN
> services.
> Build your next product on our scalable cloud platform.
>
> Join our online community to chat in real time
> https://signalwire.community
>
> Professional FreeSWITCH Services
> sales at freeswitch.com
> https://freeswitch.com
>
> Official FreeSWITCH Sites
> https://freeswitch.com/oss
> https://freeswitch.org/confluence
> https://cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> https://freeswitch.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20200726/76ef1bd6/attachment.html>