The IPs seems not to be failing that’s why he’s able to receive calls. I am not sure if fail2ban would help much except to look into the logs what dial plan and context and from where the calls are coming in. Maybe there is a profile where auth-calls is false and calls are coming in from that profile. But again, without the log file, it’s not easy to help.

-- 
Muhammad Naseer Bhatti

From: David Villasmil Govea <david.villasmil@gmail.com>
Reply: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org>>
Date: December 24, 2014 at 1:51:32 PM
To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org>>
Subject:  Re: [Freeswitch-users] Receives call From Unknown Extensions

Hello,

At the very least I would say need to install and configure fail2ban urgently,  it block ips which try to authenticate and fail. This saves you from brute - force attacks.

Regards,

David

On Dec 24, 2014 2:19 AM, "Luis Daniel Lucio Quiroz" <luis.daniel.lucio@gmail.com> wrote:
Dont worry, your are a target of a kiddy script. As you dont use
numeric extensions, they wont authenticate.  And as you are using
multitenant, they should be targering the IP (as domain, for example
100@1.1.1.1) instead 100@yourdomain.  So they wont be able to
authenticate (if multidomain is on).

CDR will still show the failled call. Its normal, FS is reporting a
failed attempt.

2014-12-22 17:55 GMT-05:00 Thomas Auge <auge@virtues.net>:
> To eliminate the guessing, check the logs which route the calls took through the system. It should contain the clues you
> need. You might need to up the log level a bit ...
>
>
> On 22.12.2014 19:44, Lloyd Aloysius wrote:
>> Fail2Ban is running in the system
>>
>> I do not have any default dial plans or extensions.
>>
>>
>>
>>
>>
>> On Mon, Dec 22, 2014 at 5:35 PM, Thomas Auge <auge@virtues.net <mailto:auge@virtues.net>> wrote:
>>
>>     Do you still have the external domain enabled? I think it routes external calls matching a specific number theme (
>>     ^(10[01][0-9])$ ) to the internal users through the pre-installed dialplan. It listens on different ports (5080/1).
>>     Config is in sip_profiles/external.xml and dialplan/public.xml.
>>
>>     I see an insane amount of brute force attempts against our PBX', so if there is a way to get anywhere, you can expect
>>     people to try it - over and over and over ... I can recommend fail2ban. :-)
>>
>>     Just guessing though, if I'm wrong, someone more knowledgeable will probably chime in. :)
>>
>>
>>     On 22.12.2014 19:16, Lloyd Aloysius wrote:
>>      > Hi All
>>      >
>>      > I have a  multi domain setup. We receive calls from unknown extensions (eg: 100 , 101,1000,1007 etc ).But there is no
>>      >  voice in it.
>>      >
>>      > We do not have any default extensions in the system and all default extensions removed from the system.
>>      >
>>      > Users are authenticated by alphanumeric (like an email username) Eg: mike@mydomain.com <mailto:mike@mydomain.com>
>>     and passwords are very
>>      > complicated.
>>      >
>>      > How someone can call a user without authentication from these extensions?
>>      >
>>      > Please let me know how to solve this issue.
>>      >
>>      > Thanks Lloyd
>>      >
>>      >
>>      >
>>      >
>>      >
>>      > _________________________________________________________________________ Professional FreeSWITCH Consulting
>>      > Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
>>      >
>>      > Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
>>      >
>>      > FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>
>>      > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>      > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
>>      >
>>
>>
>>     _________________________________________________________________________
>>     Professional FreeSWITCH Consulting Services:
>>     consulting@freeswitch.org <mailto:consulting@freeswitch.org>
>>     http://www.freeswitchsolutions.com
>>
>>     Official FreeSWITCH Sites
>>     http://www.freeswitch.org
>>     http://confluence.freeswitch.org
>>     http://www.cluecon.com
>>
>>     FreeSWITCH-users mailing list
>>     FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>
>>     http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>     UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>>     http://www.freeswitch.org
>>
>>
>>
>>
>> _________________________________________________________________________
>> Professional FreeSWITCH Consulting Services:
>> consulting@freeswitch.org
>> http://www.freeswitchsolutions.com
>>
>> Official FreeSWITCH Sites
>> http://www.freeswitch.org
>> http://confluence.freeswitch.org
>> http://www.cluecon.com
>>
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users@lists.freeswitch.org
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
>>
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting@freeswitch.org
> http://www.freeswitchsolutions.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://confluence.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users@lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org