<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hello Miguel,<br>
<br>
see here<br>
<a class="moz-txt-link-freetext" href="http://lists.freeswitch.org/pipermail/freeswitch-users/2011-April/071796.html">http://lists.freeswitch.org/pipermail/freeswitch-users/2011-April/071796.html</a><br>
You will need to change the line <br>
search="friendly-scanner"<br>
to<br>
search="<span lang="EN-US">Z 3.14.38765 rv2.8.3</span>"<br>
<br>
This worked for me.<br>
Best regards Peter<br>
<br>
<br>
On 12/15/17 18:32, Miguel Jesús López Valverde wrote:<br>
</div>
<blockquote cite="mid:054601d375ca$b1af84f0$150e8ed0$@smartic.es"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EstiloCorreo17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Good afternoon everyone<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I get a new query
regarding a type of attack that our freeswitch servers
receive constantly in case someone knows how to block them.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">These are INVITE or
REGISTER requests in which the FROM: field arrives with the
ip and port equal to the public interface of the server, so
the different protection options that I have tried have not
blocked these requests:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">- IpTables can not
filter by the information From the INVITE message.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">- Fail2Ban is equally
limited than IpTables.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">- ACLs have not resolved
to filter these requests.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Does anyone know any way
to block these requests?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I send here a trace with
an INVITE message where you can see a request of this type.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal">Thanks and best regards.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">U 2017/12/14 18:32:55.156886
185.107.94.121:11120 -> 182.30.1.194:5060<o:p></o:p></p>
<p class="MsoNormal">INVITE sip:390239297988@
182.30.1.194:5060;transport=UDP SIP/2.0.<o:p></o:p></p>
<p class="MsoNormal">Via: SIP/2.0/UDP
122.221.117.131:5060;branch=z9hG4bK-524287-1---xi3qy2kz737ni404.<o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Max-Forwards: 70.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Contact:
<a class="moz-txt-link-rfc2396E" href="mailto:sip:15714000000@122.221.117.131:5060;transport=UDP"><sip:15714000000@122.221.117.131:5060;transport=UDP></a>.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">To:
<sip:390239297988@ 182.30.1.194;transport=UDP>.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">From:
<a class="moz-txt-link-rfc2396E" href="mailto:sip:15714000000@182.30.1.194;transport=UDP"><sip:15714000000@
182.30.1.194;transport=UDP></a>;tag=hlzg2jcv.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Call-ID:
KaQqH51mAcFv34qN8cGyv3...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">CSeq: 1 INVITE.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Content-Type:
application/sdp.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">User-Agent: Z 3.14.38765
rv2.8.3.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Allow-Events: presence,
kpml, talk.<o:p></o:p></span></p>
<p class="MsoNormal">Content-Length: 0.<o:p></o:p></p>
<p class="MsoNormal">.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br>
<table style="border-top: 1px solid #D3D4DE;">
<tbody>
<tr>
<td style="width: 55px; padding-top: 18px;"><a
moz-do-not-send="true"
href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient"
target="_blank"><img moz-do-not-send="true"
src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif"
alt="" style="width: 46px; height: 29px;"
height="29" width="46"></a></td>
<td style="width: 470px; padding-top: 17px; color:
#41424e; font-size: 13px; font-family: Arial, Helvetica,
sans-serif; line-height: 18px;">Libre de virus. <a
moz-do-not-send="true"
href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient"
target="_blank" style="color: #4453ea;">www.avast.com</a>
</td>
</tr>
</tbody>
</table>
<a moz-do-not-send="true"
href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1"
height="1"> </a></div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
<a class="moz-txt-link-abbreviated" href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://www.freeswitchsolutions.com">http://www.freeswitchsolutions.com</a>
Official FreeSWITCH Sites
<a class="moz-txt-link-freetext" href="http://www.freeswitch.org">http://www.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://confluence.freeswitch.org">http://confluence.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://www.cluecon.com">http://www.cluecon.com</a>
FreeSWITCH-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a>
UNSUBSCRIBE:<a class="moz-txt-link-freetext" href="http://lists.freeswitch.org/mailman/options/freeswitch-users">http://lists.freeswitch.org/mailman/options/freeswitch-users</a>
<a class="moz-txt-link-freetext" href="http://www.freeswitch.org">http://www.freeswitch.org</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
With kind regards
Peter Steinbach
Telefaks Services GmbH
<a class="moz-txt-link-freetext" href="mailto:lists">mailto:lists</a> (att) telefaks.de
Internet: <a class="moz-txt-link-abbreviated" href="http://www.telefaks.de">www.telefaks.de</a>
</pre>
</body>
</html>