<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">PB 20618<br>
<br>
Everytime, it is a 0 billsec. For now, international calls are not
authorized. But in a near future, I want to authorized them.<br>
<br>
I verified what Ken wrote:<br>
<br>
A) make sure you are not using the default username and passwords
for<br>
registered sip users <b>(not using default username and password.
All default users/extensions have been removed)</b><br>
B) don't allow unauthenticated calls to go back out to the PSTN <b>(I
don't have PSTN lines)</b><br>
C) Use appropriate firewall rules to only allow places you should
be getting<br>
calls from <b>(Already done)</b><br>
D) use something like Fail2Ban to block people attempting to make
repeated<br>
failed calls/registration attempts in a short period of time... <br>
<br>
Actually, I have fail2ban that blocks registration attemps. I
don't know how to block failed calls. Can you guide me to a web
site or help me to ban failed calls?<br>
<br>
Thank you for your quick replies!<br>
<br>
Fred<br>
<br>
Le 2013-02-22 09:01, Christian Benke a écrit :<br>
</div>
<blockquote
cite="mid:CAAMQ8bRJB84jxoncpr94F+xiaKckqCmqiSB1jZ0=gmeioyS2BQ@mail.gmail.com"
type="cite">
<pre wrap="">Do you have a logfile of these calls? Can you please paste it to
<a class="moz-txt-link-freetext" href="http://pastebin.freeswitch.org/">http://pastebin.freeswitch.org/</a>. Otherwise, please paste your
dialplans to pastebin so we can figure out what's really happening
with your calls, the csv has too little information. Do all of these
calls have 0 billsec?
If possible, you should turn off FreeSWITCH till you know the reason
for this calls, it looks very much like your system is not safe.
Best regards,
Christian
--
Central Asia by bike, starting May 2013 - <a class="moz-txt-link-freetext" href="http://poab.org">http://poab.org</a>
On 22 February 2013 14:26, Frederick Pruneau
<a class="moz-txt-link-rfc2396E" href="mailto:frederick@targointernet.com"><frederick@targointernet.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi everyone!
I have found in the log files some international calls from unknown
extensions. These extensions don't exist in my configuration. I tried to
block them in my firewall (iptables on my freeswitch server) but they
always use random IP adresses. Here is a short part of my Master.csv:
"1001","1001","0015972595646444","2013-02-22 02:05:27","","2013-02-22
02:05:27","0","NORMAL_CLEARING","3c876eae-7cbe-11e2-877f-b791adff5763","","","",""
"1001","1001","9011972595646444","2013-02-22 02:05:28","","2013-02-22
02:05:28","0","NORMAL_CLEARING","3d0d058c-7cbe-11e2-8783-b791adff5763","","","",""
"1001","1001","2011972595646444","2013-02-22 02:05:29","","2013-02-22
02:05:29","0","NORMAL_CLEARING","3da55576-7cbe-11e2-8787-b791adff5763","","","",""
"1001","1001","3011972595646444","2013-02-22 02:05:30","","2013-02-22
02:05:30","0","NORMAL_CLEARING","3e4727ca-7cbe-11e2-878b-b791adff5763","","","",""
"1001","1001","4011972595646444","2013-02-22 02:05:31","","2013-02-22
02:05:31","0","NORMAL_CLEARING","3eecc2e8-7cbe-11e2-878f-b791adff5763","","","",""
"1001","1001","5011972595646444","2013-02-22 02:05:32","","2013-02-22
02:05:32","0","NORMAL_CLEARING","3f633b94-7cbe-11e2-8793-b791adff5763","","","",""
"1001","1001","6011972595646444","2013-02-22 02:05:33","","2013-02-22
02:05:33","0","NORMAL_CLEARING","3fc49902-7cbe-11e2-8797-b791adff5763","","","",""
"1001","1001","7011972595646444","2013-02-22 02:05:33","","2013-02-22
02:05:33","0","NORMAL_CLEARING","403c0622-7cbe-11e2-879b-b791adff5763","","","",""
"1001","1001","8011972595646444","2013-02-22 02:05:34","","2013-02-22
02:05:34","0","NORMAL_CLEARING","40e61ef0-7cbe-11e2-879f-b791adff5763","","","",""
With my configuration, I need to be registered to make a call. I tried
to call with an unregistered phone and I was not able to make a call. I
don't know how they are able to do this but I need to block them. Is
there something that I am missing in my configuration to block unwanted
extensions to make calls?
Thanks in advance!
Fred
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
<a class="moz-txt-link-abbreviated" href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://www.freeswitchsolutions.com">http://www.freeswitchsolutions.com</a>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
<a class="moz-txt-link-freetext" href="http://www.cudatel.com">http://www.cudatel.com</a>
Official FreeSWITCH Sites
<a class="moz-txt-link-freetext" href="http://www.freeswitch.org">http://www.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://wiki.freeswitch.org">http://wiki.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://www.cluecon.com">http://www.cluecon.com</a>
FreeSWITCH-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a>
UNSUBSCRIBE:<a class="moz-txt-link-freetext" href="http://lists.freeswitch.org/mailman/options/freeswitch-users">http://lists.freeswitch.org/mailman/options/freeswitch-users</a>
<a class="moz-txt-link-freetext" href="http://www.freeswitch.org">http://www.freeswitch.org</a>
</pre>
</blockquote>
<pre wrap="">
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
<a class="moz-txt-link-abbreviated" href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://www.freeswitchsolutions.com">http://www.freeswitchsolutions.com</a>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
<a class="moz-txt-link-freetext" href="http://www.cudatel.com">http://www.cudatel.com</a>
Official FreeSWITCH Sites
<a class="moz-txt-link-freetext" href="http://www.freeswitch.org">http://www.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://wiki.freeswitch.org">http://wiki.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://www.cluecon.com">http://www.cluecon.com</a>
FreeSWITCH-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a>
UNSUBSCRIBE:<a class="moz-txt-link-freetext" href="http://lists.freeswitch.org/mailman/options/freeswitch-users">http://lists.freeswitch.org/mailman/options/freeswitch-users</a>
<a class="moz-txt-link-freetext" href="http://www.freeswitch.org">http://www.freeswitch.org</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Frédérick Pruneau
Administrateur réseau | Network administrator
Targo Communications
Ste-Clotilde : (450) 826-0031
Montréal : (514) 448-0773</pre>
</body>
</html>