Is it actually supposed to prevent calls from any IP’s not in acl.conf.xml? With the settings I listed below, I can still make calls from different IP’s to any number, which effectively makes my server an open relay. Do those settings only work if you are authenticating callers?

It seems like I’m going to have to set up IP-specific firewall rules for each SIP port, to allow only traffic from my gateways.

-----------------------

Eric Z. Beard, CTO

Loop LLC

w (877) 850-2010 x9249

m (727) 776-2768

eric@loopfx.com

From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Steven Ayre
Sent: Wednesday, June 08, 2011 3:44 PM
To: FreeSWITCH Users Help
Subject: Re: [Freeswitch-users] IP Whitelist

ACLs control registrations and calls, not options requests.

You'd be best off blocking sipvicious with this iptables entry:

iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm

-Steve

On 8 June 2011 20:11, Eric Beard <eric@loopfx.com> wrote:

It seems I misunderstand the purpose of the acl.conf.xml file.

What I want to do is create an IP whitelist, so only the IPs I designate get a response from FreeSwitch. I’d like to do this with FreeSwitch rather than a firewall.

I have this in acl.conf.xml:

</list>

I was assuming that this would only allow traffic from my local network, 10.1.0.0, and from the single IP 209.249.3.74

But while watching sip traffic, I saw an OPTIONS request from a different IP (sipvicious scan). Freeswitch happily responded to the OPTIONS with an OK.

How can I configure it so that it ignores requests that are not on my whitelist?