September 2016 - FreeSWITCH-users - FreeSWITCH Mailing Lists

Re: [Freeswitch-users] Getting fail2ban working properly
by Angel Elena 08 Sep '16

08 Sep '16

fail2ban (only) is a bad idea to protect a freeswitch / sip server. If you have the server with 5060 NATed or published directly to internet, is better or add a layer 7 security. The SIP-boot networks are managed by SipVicious / SipVAx / Ozeeki softs...... fail2ban + iptables layer 7 security is best option.... who ? # Generated by iptables-save *filter :INPUT ACCEPT [541:131352] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [528:125051] :SIPDOS - [0:0] -A INPUT -p udp -m udp --dport 5060 -m string --string "VoIP v11.2.4" --algo bm --to 65535 -m comment --comment "deny sundayddr" -j SIPDOS -A INPUT -p udp -m udp --dport 5060 -m string --string "sundayddr" --algo bm --to 65535 -m comment --comment "deny sundayddr" -j SIPDOS -A INPUT -p udp -m udp --dport 5060 -m string --string "sipsak" --algo bm --to 65535 -m comment --comment "deny sipsak" -j SIPDOS -A INPUT -p udp -m udp --dport 5060 -m string --string "sipvicious" --algo bm --to 65535 -m comment --comment "deny sipvicious" -j SIPDOS -A INPUT -p udp -m udp --dport 5060 -m string --string "friendly-scanner" --algo bm --to 65535 -m comment --comment "deny friendly-scanner" -j SIPDOS -A INPUT -p udp -m udp --dport 5060 -m string --string "iWar" --algo bm --to 65535 -m comment --comment "deny iWar" -j SIPDOS -A INPUT -p udp -m udp --dport 5060 -m string --string "sip-scan" --algo bm --to 65535 -m comment --comment "deny sip-scan" -j SIPDOS -A INPUT -p tcp -m tcp --dport 5060 -m string --string "sundayddr" --algo bm --to 65535 -m comment --comment "deny sundayddr" -j SIPDOS -A INPUT -p tcp -m tcp --dport 5060 -m string --string "sipsak" --algo bm --to 65535 -m comment --comment "deny sipsak" -j SIPDOS -A INPUT -p tcp -m tcp --dport 5060 -m string --string "sipvicious" --algo bm --to 65535 -m comment --comment "deny sipvicious" -j SIPDOS -A INPUT -p tcp -m tcp --dport 5060 -m string --string "friendly-scanner" --algo bm --to 65535 -m comment --comment "deny friendly-scanner" -j SIPDOS -A INPUT -p tcp -m tcp --dport 5060 -m string --string "iWar" --algo bm --to 65535 -m comment --comment "deny iWar" -j SIPDOS -A INPUT -p tcp -m tcp --dport 5060 -m string --string "sipcli" --algo bm --to 65535 -m comment --comment "deny sipcli" -j SIPDOS -A INPUT -p udp -m udp --dport 5060 -m string --string "VaxSIPUserAgent/3.1" --algo bm --to 65535 -m comment --comment "deny VaxSip" -j SIPDOS -A SIPDOS -j LOG --log-prefix "firewall-sipdos: " --log-level 6 -A SIPDOS -j DROP COMMIT # Completed -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ -------------------------------- -----Mensaje original----- De: Mirko Brankovic <mirkobrankovic(a)gmail.com> Enviado: Jue 08-09-2016 08:56 Asunto: Re: [Freeswitch-users] Getting fail2ban working properly Para: FreeSWITCH Users Help <freeswitch-users(a)lists.freeswitch.org>; > On ubuntu it is called : > Chain fail2ban-freeswitch (1 references) > > iptables -L should give you the chain if F2B started correctly, otherwise see > the fail2ban log for errors. > > > > On Thu, Sep 8, 2016 at 7:42 AM, Jurijs Ivolga <jurijs.ivolga(a)gmail.com > <mailto:jurijs.ivolga@gmail.com> > wrote: > Hi, > > I configured fail2ban several times a while ago, but not with freeswitch... > > If you see that rules are missing, just add them and you can use SSH rules as > template. I believe it should make a trick. > > And I see from you rules, that you are allowing all traffic and this is really > bad idea... > > You should drop everything and allow only needed traffic. > > With kind regards, > > Jurijs > > On Thu, Sep 8, 2016 at 12:15 AM, Don Hawkins <hawkins(a)hawkinsegroup.com > <mailto:hawkins@hawkinsegroup.com> > wrote: > Thanks for the reply! > > Fail2Ban is running: > root@sip:/etc/fail2ban# fail2ban-client start > ERROR Server already running > > > I added everything in /etc/fail2ban/jail.conf > > [ssh] > enabled = true > port = 22 > filter = sshd > logpath = /var/log/auth.log > maxretry = 6 > > [freeswitch] > enabled = true > port = 5060,5061,5080,5081 > filter = freeswitch > logpath = /var/log/freeswitch/freeswitch.log > maxretry = 10 > > > I also created /etc/fail2ban/filter.d/freeswitch.conf as shown on > https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/freeswitch… > > > root@sip:/etc/fail2ban/filter.d# iptables -S > -P INPUT ACCEPT > -P FORWARD ACCEPT > -P OUTPUT ACCEPT > -N fail2ban-ssh > -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh > > > As you can see when running iptables -S it shoes the "fail2ban-ssh" rule but > nothing about FreeSwitch. > > > Any help is appreciated. > > > > On Wed, Sep 7, 2016 at 11:01 AM, jungle Boogie <jungleboogie0(a)gmail.com > <mailto:jungleboogie0@gmail.com> > wrote: > On 7 September 2016 at 08:33, Don Hawkins <hawkins(a)hawkinsegroup.com > <mailto:hawkins@hawkinsegroup.com> > wrote: > > It keeps saying it's not there, but I did add it, is there something I'm > > missing? > > How did you add it? Is fail2ban running? Have you restarted your > computer after setting up fail2ban? If you do iptables -S, do you see > the rules? > > > -- > ------- > inum: 883510009027723 > sip: jungleboogie(a)sip2sip.info <mailto:jungleboogie@sip2sip.info> > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting(a)freeswitch.org <mailto:consulting@freeswitch.org> > http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com> > > Official FreeSWITCH Sites > http://www.freeswitch.org <http://www.freeswitch.org> > http://confluence.freeswitch.org <http://confluence.freeswitch.org> > http://www.cluecon.com <http://www.cluecon.com> > > FreeSWITCH-users mailing list > FreeSWITCH-users(a)lists.freeswitch.org > <mailto:FreeSWITCH-users@lists.freeswitch.org> > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > <http://lists.freeswitch.org/mailman/options/freeswitch-users> > http://www.freeswitch.org <http://www.freeswitch.org> > > > > -- > Sincerely, > Don Hawkins > CEO > Hawkins Enterprise Group LLC > http://hawkinsegroup.com <http://hawkinsegroup.com> > Zello PTT <http://zello.com> : push2don > P: 469-214-5044 > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting(a)freeswitch.org <mailto:consulting@freeswitch.org> > http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com> > > Official FreeSWITCH Sites > http://www.freeswitch.org <http://www.freeswitch.org> > http://confluence.freeswitch.org <http://confluence.freeswitch.org> > http://www.cluecon.com <http://www.cluecon.com> > > FreeSWITCH-users mailing list > FreeSWITCH-users(a)lists.freeswitch.org > <mailto:FreeSWITCH-users@lists.freeswitch.org> > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > <http://lists.freeswitch.org/mailman/options/freeswitch-users> > http://www.freeswitch.org <http://www.freeswitch.org> > > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting(a)freeswitch.org <mailto:consulting@freeswitch.org> > http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com> > > Official FreeSWITCH Sites > http://www.freeswitch.org <http://www.freeswitch.org> > http://confluence.freeswitch.org <http://confluence.freeswitch.org> > http://www.cluecon.com <http://www.cluecon.com> > > FreeSWITCH-users mailing list > FreeSWITCH-users(a)lists.freeswitch.org > <mailto:FreeSWITCH-users@lists.freeswitch.org> > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > <http://lists.freeswitch.org/mailman/options/freeswitch-users> > http://www.freeswitch.org <http://www.freeswitch.org> > > > > -- > Regards, > Mirko > > _________________________________________________________________________ > > Professional FreeSWITCH Consulting Services: > > consulting(a)freeswitch.org > > http://www.freeswitchsolutions.com > > > > Official FreeSWITCH Sites > > http://www.freeswitch.org > > http://confluence.freeswitch.org > > http://www.cluecon.com > > > > FreeSWITCH-users mailing list > > FreeSWITCH-users(a)lists.freeswitch.org > > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > > http://www.freeswitch.org > >

3 2

How to find destination IP address of b-leg in "show calls" or alike?
by Victor Chukalovskiy 07 Sep '16

07 Sep '16

Good day, I've been studying output of "show calls", "show detailed calls", and "show channels" for quite some time. Surprisingly, I can't find a value of ${network_address} variable or anything similar that will tell me for each outgoing leg SIP IP address on the far end. In other words, how do I find IP address of SIP UAS FreeSWITCH is communicating with on every outgoing call leg? I managed to get it in CDRs by dumping ${network_address}, but can't get it for active calls dump. Is there truly nothing in "show calls" or equivalent that will help me? Should I submit a feature request then? Few cents on my call scenario: SIP call coming in (a-leg) --> multiple sip calls going out (b-legs). I'm originating my b-legs via sofia gateways (so IP address of the far-end is picked up from gateway config, and not mentioned in the dial-plan in any way or form). Many thanks, -Victor

5 12

Getting destination number
by Allan Kristensen 07 Sep '16

07 Sep '16

Hello, I've just setup a sip trunk with a new provider, however there are some issues receiving calls. The INVITE looks like this: INVITE sip:NCdWXsdSsaF2B@192.168.0.190:52284 SIP/2.0 .... From: <sip:+XXXXXXXXXX@x.x.x.x>;tag=Ud8ghaXg01821203 To: <sip:+YYYYYYYYYY@x.x.x.x> ... The invite has my account name, instead of the destination number and the real destination number is in the "To:" field (which it normally is I guess ;-) Then Freeswitch does this of cause: [INFO] mod_dialplan_xml.c:637 Processing +XXXXXXXXXX <+XXXXXXXXXX>->NCdWXsdSsaF2B in context inbound That is undesirable, so Is there any way for Freeswitch to grab the destination number from the to field instead of the INVITE string ? I could make a special sip profile for that provider with it's own dialplan and then set destination_number from the "sip_to_user" variable and transfer to the real dialplan, but it just seems so messy... Or is it my provider that is doing it wrong? Best regards, Allan

5 5

Hangup cause translation issues?
by Allan Kristensen 07 Sep '16

07 Sep '16

Hello, Why am I getting a (q850) NO_USER_RESPONSE (18) hangup cause from a SIP 480 Temp. unavail. When the RFC 4497 says (pick one): 19 No answer from the user 480 Temporarily unavailable 20 Subscriber absent 480 Temporarily unavailable I looked in the source (sofia_glue.c) and it says: /* map sip responses to QSIG cause codes ala RFC4497 section 8.4.4 */ switch_call_cause_t sofia_glue_sip_cause_to_freeswitch(int status) { switch (status) { ... ... case 480: return SWITCH_CAUSE_NO_USER_RESPONSE; Which is code 18, it seems incorrect.. is it just me? /Allan

2 2

playback start position
by Anonim Stefan 07 Sep '16

07 Sep '16

Hi, I am trying to playback a file from a given position. I am setting this in my extension, however the file always plays from the beginning: " <action application="playback" data="/usr/share/freeswitch/sounds/en/us/callie/voicemail/48000/vm-tutorial_change_pin.wav@ @5000"/> " I am using FreeSWITCH Version 1.6.10-17-726448d~64bit. Any idea how to make it work? Also, I am curious if shout cast playback from a given start position is possible; something like this: " <action application="playback" data="shout:// www.soundjay.com/human/applause-01.mp3@@2000"/> " Thanks, Stefan

3 3

Does nibble execute sql queries in single transaction ?
by Mohd Kamal Mustafa 06 Sep '16

06 Sep '16

If not, is there a possibilities of reach condition where updates from multiple channels override each other. For example, 2 incoming calls at the same time to 2 different numbers, but owned by single user - that mean nibble will be updating the same record in database. I'm planning to add "FOR UPDATE" clause to the custom_sql_lookup:- SELECT cash AS nibble_balance FROM accounts WHERE account_code='${nibble_account} FOR UPDATE But if each query run inside their own transaction, that would be no use. Thank you.

2 1

Re: [Freeswitch-users] play sound file before hangup for non-ip phone ring group
by Stanislav Sinyagin 06 Sep '16

06 Sep '16

You can create an ESL application and handle the calls and race conditions from it. Then you're in the full control of who hears what. In this case, it would be a bunch of open channels which you need to control yourself, instead of using group call. On 6 Sep 2016 17:37, "John.Nowlin(a)tresta.com" <John.Nowlin(a)tresta.com> wrote: I have been given the following acceptance criteria. I do not see a hook in freeswitch that will let me accomplish this… As a user who is receiving a user group call I want to hear a notification when another user accepts the call or the caller is transferred to voicemail So that I can understand why I was unable to speak to the caller. Acceptance Criteria: § When multiple users answer a call, the system will play a prompt to each user instructing them to press 1 to accept the call. § When one of the users presses 1 and accepts the call, other users will hear a prompt "Sorry, this call has been answered by another group member and is no longer available to accept. " and then the calls to other users will hang up. § When the caller is transferred to voicemail because none of the users have accepted the call, then the users will hear a prompt indicating "Sorry, this call has been transferred to voicemail and is no longer available to accept." I have tried setHangupHook in a lua script, but that appears to be too late. Is there another hook that I am missing? *john nowlin* Senior Software Developer *Tresta* office: 850.383.7756 mobile: 850.294.5635 www.tresta.com — A Better Phone Experience _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting(a)freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

1 0

play sound file before hangup for non-ip phone ring group
by John.Nowlin＠tresta.com 06 Sep '16

06 Sep '16

I have been given the following acceptance criteria. I do not see a hook in freeswitch that will let me accomplish this... As a user who is receiving a user group call I want to hear a notification when another user accepts the call or the caller is transferred to voicemail So that I can understand why I was unable to speak to the caller. Acceptance Criteria: § When multiple users answer a call, the system will play a prompt to each user instructing them to press 1 to accept the call. § When one of the users presses 1 and accepts the call, other users will hear a prompt "Sorry, this call has been answered by another group member and is no longer available to accept. " and then the calls to other users will hang up. § When the caller is transferred to voicemail because none of the users have accepted the call, then the users will hear a prompt indicating "Sorry, this call has been transferred to voicemail and is no longer available to accept." I have tried setHangupHook in a lua script, but that appears to be too late. Is there another hook that I am missing? john nowlin Senior Software Developer Tresta office: 850.383.7756 mobile: 850.294.5635 www.tresta.com - A Better Phone Experience

1 0

Fax receive stopped working on 1.6.10
by Yehavi Bourvine 06 Sep '16

06 Sep '16

Hi, After upgrading from 1.6.9 to 1.6.10 fax receive stopped; worse: it informs the other side that the fax has been received, but no file is created. I've filed a JIRA FS-9481 <https://freeswitch.org/jira/browse/FS-9481> about it. I think I've located the problematic line (mentioned in that ticket). So, if you need fax receive, don't go to 1.6.10... Regards, __Yehavi:

3 5

mod_amqp publish question
by Anonim Stefan 06 Sep '16

06 Sep '16

Hi, I have a question related to Freeswitch's mod_amqp. I can see that one can specify the types of events to be published. For example I would need Freeswitch to publish in celery format [1]. Is there a way to manipulate the published format? Thanks, Stefan [1] http://docs.celeryproject.org/en/latest/internals/protocol.html#example-mes…

1 0