You can create and tweak another fail2ban rule specifically for this:
https://wiki.freeswitch.org/wiki/Fail2ban#SIP_DOS_Attack

      On 14-06-04 01:59 PM, Neo Haux wrote:

    

    

      
      Hi all,

      

      I am receiving hundreds of INVITE/minute and in the log I can see:

      

      2014-06-04 13:52:30.189371 [WARNING] sofia_reg.c:1532
          SIP auth challenge (REGISTER) on sofia profile 'internal' for
          [340@MyExternalIP] from ip 62.210.142.39

        2014-06-04 13:52:42.789530 [WARNING] sofia_reg.c:1532 SIP
          auth challenge (REGISTER) on sofia profile 'internal' for
          [341@MyExternalIP] from ip 62.210.142.39

        2014-06-04 13:52:55.479999 [WARNING] sofia_reg.c:1532 SIP
          auth challenge (REGISTER) on sofia profile 'internal' for
          [341@MyExternalIP] from ip 62.210.142.39

        2014-06-04 13:53:08.289660 [WARNING] sofia_reg.c:1532 SIP
          auth challenge (REGISTER) on sofia profile 'internal' for
          [342@MyExternalIP] from ip 62.210.142.39

        2014-06-04 13:53:21.679512 [WARNING] sofia_reg.c:1532 SIP
          auth challenge (REGISTER) on sofia profile 'internal' for
          [342@MyExternalIP] from ip 62.210.142.39

      

      

      In the /etc/fail2ban/filter.d/freeswitch.conf file I have these
      lines:

      

      failregex = \[WARNING\] sofia_reg.c:\d+ SIP auth failure
          \(REGISTER\) on sofia profile \'\w+\' for \[.*\] from ip
          <HOST>

                      \[WARNING\] sofia_reg.c:\d+ SIP auth failure
          \(INVITE\) on sofia profile \'\w+\' for \[.*\] from ip
          <HOST>

      

      

      You can see clearly that my logs contain failure word not "auth
      challange".

      

      My question is : If I put "auth challange" in my
      /etc/fail2ban/filter.d/freeswitch.conf  will I block regular known
      and authenticated SIP clients ? If yes, could you help find the
      right regex to stop this kind of spammers ?

      

      Thank you very much in advance.

      

      

      

      

      

      
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org