Brian, thanks for the input, I have researched this exhaustively to be sure I don’t.  We ran an extensive search on the system and could not find this IP address anywhere on the system, but yet they could make calls.  This is an IP address from russia, they hit the network for around $20k in October then out of the blue they started being blocked, I am really worried they will find another hole in the system, if there is indeed one.
 
Darcy
 
From: Brian West
Sent: Friday, December 02, 2011 5:06 PM
Subject: Re: [Freeswitch-users] acl validation
 
do you have a cidr=91.212.226.30 tag on a user in your directory?
 
/b
 
On Dec 2, 2011, at 4:01 PM, Darcy wrote:

Looking through my call log, I see the following item in the log,   this IP is not in the acl Domain List, it is not a profile and it is not registered on the switch, Is there something I am missing on this that needs to be set.  These guys are attempting calls to Jamaica.

2011-10-31 09:11:31.801420 [DEBUG] sofia.c:5798 IP 91.212.226.30 Approved by acl "domains[]". Access Granted.

<list name="domains" default="deny">
           <node type="allow" cidr="xxx.xxx.xx.xx/32"/>
I have 5 more entries like so in this switch.
           etc.
       </list>
 

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org