<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Of perhaps some interest if you’re blocking a large amount of IP addresses (or whitelisting client IPs) is ipset.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="http://ipset.netfilter.org/">http://ipset.netfilter.org/</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Allows you to create a set then just have on rule in iptables. Plus has an atomic swap feature so you can build up new sets “offline” then flip them in.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">-Michael<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org]
<b>On Behalf Of </b>Sergey Safarov<br>
<b>Sent:</b> Friday, November 13, 2015 2:13 AM<br>
<b>To:</b> FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org><br>
<b>Subject:</b> Re: [Freeswitch-users] event based sipVicious blocker<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Think solution where INVITE mesages DROP/REJECT action will be implemented in mod_fail2ban is be have high pefomance<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Iprables is good solution, but cannot help for TLS connection.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">He is my iptables status where configure fail2ban. At present time 99% scans is made via UDP transport and 1% for TCP.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Chain f2b-freeswitch-local-tcp (1 references)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> pkts bytes target prot opt in out source destination <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 37.8.37.84
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 195.154.134.220 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 188.227.169.113 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 104.214.34.182
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 85.25.218.94
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 80.84.58.173
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 37.8.47.155 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 23.239.65.132 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 188.138.33.13 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 188.138.33.113
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 80.84.55.178
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 188.227.170.157 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 77.245.68.44
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 1 52 REJECT all -- * * 88.150.240.111
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 31.3.230.210
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 37.8.20.231 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 213.136.75.235
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 195.154.177.146 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 37.8.77.83
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 88.150.240.169
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 188.138.33.203
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 188.138.118.21
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 104.255.70.242
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 77.245.65.98
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 88.150.240.245
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 217.118.19.157
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 188.227.170.13
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 217.172.189.41
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 85.114.130.146
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 85.25.207.231 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 6 252 RETURN all -- * * <a href="http://0.0.0.0/0">
0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Chain f2b-freeswitch-local-udp (1 references)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> pkts bytes target prot opt in out source destination <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 4 3122 REJECT all -- * * 37.8.37.84
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 0 0 REJECT all -- * * 195.154.134.220 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 10 7949 REJECT all -- * * 188.227.169.113 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 201 158K REJECT all -- * * 104.214.34.182
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 15 11677 REJECT all -- * * 85.25.218.94
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 11 8635 REJECT all -- * * 80.84.58.173
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 11 8649 REJECT all -- * * 37.8.47.155 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 48 37438 REJECT all -- * * 23.239.65.132 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 144 116K REJECT all -- * * 188.138.33.13 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 42 33201 REJECT all -- * * 188.138.33.113
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 6 4699 REJECT all -- * * 80.84.55.178
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 75 61117 REJECT all -- * * 188.227.170.157 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 130 104K REJECT all -- * * 77.245.68.44
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 133 108K REJECT all -- * * 88.150.240.111
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">29897 14M REJECT all -- * * 31.3.230.210
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 26 20426 REJECT all -- * * 37.8.20.231 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 312 247K REJECT all -- * * 213.136.75.235
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 1133 612K REJECT all -- * * 195.154.177.146 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 2 1570 REJECT all -- * * 37.8.77.83
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">85917 40M REJECT all -- * * 88.150.240.169
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 73 57484 REJECT all -- * * 188.138.33.203
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 64 50450 REJECT all -- * * 188.138.118.21
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 46 36467 REJECT all -- * * 104.255.70.242
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 3077 2388K REJECT all -- * * 77.245.65.98
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 21 16564 REJECT all -- * * 88.150.240.245
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 104 81759 REJECT all -- * * 217.118.19.157
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 95 75254 REJECT all -- * * 188.227.170.13
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 62 48840 REJECT all -- * * 217.172.189.41
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 2483 1974K REJECT all -- * * 85.114.130.146
<a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 51 39876 REJECT all -- * * 85.25.207.231 <a href="http://0.0.0.0/0">0.0.0.0/0</a> reject-with icmp-port-unreachable<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2351K 1204M RETURN all -- * * <a href="http://0.0.0.0/0">
0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Sergey.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Fri, Nov 13, 2015 at 9:38 AM, jay binks <<a href="mailto:jaybinks@gmail.com" target="_blank">jaybinks@gmail.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Doing it like you want is fine for education, however its not the best way, because it wont scale efficiently.<o:p></o:p></p>
<div>
<p class="MsoNormal">mod_sofia takes significant resources to consume a SIP Invite and generate events.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">iptables will stop Freeswitch having to process these INVITES, thus saving CPU.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">BUT you may not really care, if this is just for a home PBX.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Jay<o:p></o:p></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 13 November 2015 at 14:18, Russell Treleaven <<a href="mailto:rtreleaven@bunnykick.ca" target="_blank">rtreleaven@bunnykick.ca</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">figured out how to use events without a socket and thought I would share.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">my $con = new freeswitch::EventConsumer("CHANNEL_CREATE");<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">$con->bind(<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">"CUSTOM",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">"sofia::pre_register"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">);<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">while(my $e = $con->pop(1)) {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">freeswitch::consoleLog(<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">"INFO",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">$e->serialize . "\n"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">);<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">}<o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, Nov 11, 2015 at 11:33 AM, Ken Rice <<a href="mailto:krice@freeswitch.org" target="_blank">krice@freeswitch.org</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Why not just block it with iptables?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "VaxSIPUserAgent" --algo bm</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "sipcli" --algo bm</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "VaxSIPUserAgent" --algo bm</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "friendly-scanner" --algo bm</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "sipcli" --algo bm</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">these will get 99% of it because the script kiddies doing the scanning aren’t really that bright… there
may be some additional strings to want to block, but these work great when combined with fail2bans log parser</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">
<a href="mailto:freeswitch-users-bounces@lists.freeswitch.org" target="_blank">freeswitch-users-bounces@lists.freeswitch.org</a> [mailto:<a href="mailto:freeswitch-users-bounces@lists.freeswitch.org" target="_blank">freeswitch-users-bounces@lists.freeswitch.org</a>]
<b>On Behalf Of </b>Russell Treleaven<br>
<b>Sent:</b> Wednesday, November 11, 2015 10:29 AM<br>
<b>To:</b> FreeSWITCH Users Help <<a href="mailto:freeswitch-users@lists.freeswitch.org" target="_blank">freeswitch-users@lists.freeswitch.org</a>><br>
<b>Subject:</b> [Freeswitch-users] event based sipVicious blocker</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I am working on a freeswitch sipVicious blocker.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I would like to run it from within freeswitch.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Is there a way to get events while running within freeswitch without running a socket via ESL::ESLconnection?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">#!/usr/bin/perl<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">use strict;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">use warnings;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">use ESL;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">my $c = new ESL::ESLconnection(<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> "localhost",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> "8021",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> "ClueCon"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">);<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">$c->events(<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> "plain",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> "CHANNEL_CREATE CUSTOM sofia::pre_register"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">);<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">while ($c->connected()) {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> my $event = $c->recvEvent();<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">#do some stuff <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">}<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal">_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org" target="_blank">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://confluence.freeswitch.org" target="_blank">http://confluence.freeswitch.org</a><br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><br>
_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org" target="_blank">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://confluence.freeswitch.org" target="_blank">http://confluence.freeswitch.org</a><br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><span class="hoenzb"><span style="color:#888888">-- <o:p></o:p></span></span></p>
<div>
<p class="MsoNormal"><span style="color:#888888">Sincerely<br>
<br>
Jay</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><br>
_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://confluence.freeswitch.org" target="_blank">http://confluence.freeswitch.org</a><br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>