<div style="white-space:pre-wrap">Kamil,<br><br>Thanks a lot for pointing this out.<br><br>Regards<br></div><div class="gmail_quote gmail_msg"><div dir="ltr" class="gmail_msg">On Mon, Dec 12, 2016 at 4:44 AM Kamil Nigmatullin <<a href="mailto:kamil.nigmatullin@gmail.com" class="gmail_msg" target="_blank">kamil.nigmatullin@gmail.com</a>> wrote:<br class="gmail_msg"></div><blockquote class="gmail_quote gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="gmail_msg">The first was the problem, where attacker somehow got login and password (i think they broke thier ATA) from clinet and used it. But for this client there was a limit of one line. I used limit module with local database. What attacker actially did, is that they used REFER attack, where they put their own number as a referrer, and opened unlimited lines to PSTN. So the, solution was - to replace limit functunality to opensips. <div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg">The second - it is not actually the FS issue. It is because Freeswitch is not flexible enouph to work at the low level where Kamailio or opensips operates. E.g, we programmed opensips to lookup for UserAgent database, we add useragent for each client manually. And only using client's IP and user-agent we allow this user to call to PSTN. We watch for blacklists of IP adresses, subnets. If it comes from Gaza, Panama, China we block it. And a lot of other things. Most of them is not out-of-box in opensips, but it is not hard to implement. All this functionality is very important. We lost about $10k last time. This is very serious.</div></div><div class="gmail_extra gmail_msg"></div><div class="gmail_extra gmail_msg"><br class="gmail_msg"><div class="gmail_quote gmail_msg">2016-12-12 8:56 GMT+06:00 Alex Balashov <span dir="ltr" class="gmail_msg"><<a href="mailto:abalashov@evaristesys.com" class="gmail_msg" target="_blank">abalashov@evaristesys.com</a>></span>:<br class="gmail_msg"><blockquote class="gmail_quote gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="gmail_msg">On Mon, Dec 12, 2016 at 08:17:57AM +0600, Kamil Nigmatullin wrote:<br class="gmail_msg">
<br class="gmail_msg">
> I love freeswitch, but frankly I would not recomend to set it as SBC. I<br class="gmail_msg">
> personally faced two attacks where FS was not good at. And we lost a lot of<br class="gmail_msg">
> money. It works perfectly as NAT between internal and extenal networks,<br class="gmail_msg">
> actually in everything but it is weak as a firewall. Stanislav knows that,<br class="gmail_msg">
> he helped me to resolve the problem first time when it happend. I cannot go<br class="gmail_msg">
> into details as this is open forum. You need to put either kamailio or<br class="gmail_msg">
> opensips in front of FS.<br class="gmail_msg">
<br class="gmail_msg">
</span>Strongly agree.<br class="gmail_msg">
<span class="m_-5365714841297694315m_-8456854717419448688HOEnZb gmail_msg"><font color="#888888" class="gmail_msg"><br class="gmail_msg">
--<br class="gmail_msg">
Alex Balashov | Principal | Evariste Systems LLC<br class="gmail_msg">
<br class="gmail_msg">
Tel: <a href="tel:%2B1-706-510-6800" value="+17065106800" class="gmail_msg" target="_blank">+1-706-510-6800</a> (direct) / <a href="tel:%2B1-800-250-5920" value="+18002505920" class="gmail_msg" target="_blank">+1-800-250-5920</a> (toll-free)<br class="gmail_msg">
Web: <a href="http://www.evaristesys.com/" rel="noreferrer" class="gmail_msg" target="_blank">http://www.evaristesys.com/</a>, <a href="http://www.csrpswitch.com/" rel="noreferrer" class="gmail_msg" target="_blank">http://www.csrpswitch.com/</a><br class="gmail_msg">
</font></span><div class="m_-5365714841297694315m_-8456854717419448688HOEnZb gmail_msg"><div class="m_-5365714841297694315m_-8456854717419448688h5 gmail_msg"><br class="gmail_msg">
_________________________________________________________________________<br class="gmail_msg">
Professional FreeSWITCH Consulting Services:<br class="gmail_msg">
<a href="mailto:consulting@freeswitch.org" class="gmail_msg" target="_blank">consulting@freeswitch.org</a><br class="gmail_msg">
<a href="http://www.freeswitchsolutions.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitchsolutions.com</a><br class="gmail_msg">
<br class="gmail_msg">
Official FreeSWITCH Sites<br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a><br class="gmail_msg">
<a href="http://confluence.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://confluence.freeswitch.org</a><br class="gmail_msg">
<a href="http://www.cluecon.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.cluecon.com</a><br class="gmail_msg">
<br class="gmail_msg">
FreeSWITCH-users mailing list<br class="gmail_msg">
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" class="gmail_msg" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br class="gmail_msg">
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br class="gmail_msg">
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a><br class="gmail_msg">
</div></div></blockquote></div><br class="gmail_msg"><br clear="all" class="gmail_msg"><div class="gmail_msg"><br class="gmail_msg"></div></div><div class="gmail_extra gmail_msg">-- <br class="gmail_msg"><div class="m_-5365714841297694315m_-8456854717419448688gmail_signature gmail_msg" data-smartmail="gmail_signature"><div dir="ltr" class="gmail_msg">Kamil Nigmatullin<br class="gmail_msg">Tel: 77272323748<br class="gmail_msg">mob: 7 (707) 2517003<br class="gmail_msg">Skype: kamil.nigmatullin</div></div>
</div>
_________________________________________________________________________<br class="gmail_msg">
Professional FreeSWITCH Consulting Services:<br class="gmail_msg">
<a href="mailto:consulting@freeswitch.org" class="gmail_msg" target="_blank">consulting@freeswitch.org</a><br class="gmail_msg">
<a href="http://www.freeswitchsolutions.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitchsolutions.com</a><br class="gmail_msg">
<br class="gmail_msg">
Official FreeSWITCH Sites<br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a><br class="gmail_msg">
<a href="http://confluence.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://confluence.freeswitch.org</a><br class="gmail_msg">
<a href="http://www.cluecon.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.cluecon.com</a><br class="gmail_msg">
<br class="gmail_msg">
FreeSWITCH-users mailing list<br class="gmail_msg">
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" class="gmail_msg" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br class="gmail_msg">
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br class="gmail_msg">
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a></blockquote></div>