Hi,

There is several options:

1) Close your server to outside world with iptables, so only you from secure location can register.
2) Fail2ban
3) You can put in front Kamailio sip proxy which will handle security(like allowing registration from specific User-Agent, pike module and etc)
4) You can use iptables to block unwanted traffic from specific user-agent:
http://ithelpblog.com/voice/prevent-or-deny-sip-dos-attack-sip-scanner-by-iptables-firewall/
5) You can use iptables hashlimit to stop flood:
https://wiki.freeswitch.org/wiki/QoS#DoS_REGISTER_Attack_Prevention

Maybe there some other options, this is what I now remember.

With kind regards,

Jurijs

On Wed, Aug 3, 2016 at 7:57 AM, Jungle Boogie <jungleboogie0@gmail.com> wrote:
Hi All,

How do people stop bad registration attempts to freeswitch? Is it pretty
much impossible so don't worry about it as long as you have fail2ban?

Using sngrep, I see lots of registration attempts like this:

My actual IP has been replaced with 1.2.3.4.

2016/08/02 21:35:33.397073 195.154.48.130:5080 -> 192.168.0.137:5060
REGISTER sip:1.2.3.4:5060 SIP/2.0
Via: SIP/2.0/UDP
195.154.48.130:5080;branch=z9hG4bK23552ce85a146013577b3912;rport
From: "7612" <sip:7612@1.2.3.4:5060>;tag=23552ce8ba27
To: "7612" <sip:7612@1.2.3.4:5060>
Call-ID: ce85a14-4c0e6013-577b3912@1.2.3.4
CSeq: 1 REGISTER
Contact: "7612" <sip:7612@195.154.48.130:5080>
User-Agent: VaxSIPUserAgent/3.1
Expires: 1800
Max-Forwards: 70
Content-Length: 0

I have these iptables rules:
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N f2b-freeswitch
-A INPUT -j f2b-freeswitch
-A INPUT -p tcp -m string --string "VaxSIPUserAgent/3.1" --algo bm --to
65535 -j DROP
-A INPUT -p udp -m string --string "VaxSIPUserAgent/3.1" --algo bm --to
65535 -j DROP
-A INPUT -p udp -m udp --dport 5080 -m string --string "sipcli" --algo
bm --to 65535 -j DROP
-A INPUT -p udp -m udp --dport 5080 -m string --string
"friendly-scanner" --algo bm --to 65535 -j DROP
-A INPUT -p udp -m udp --dport 5080 -m string --string "VaxSIPUserAgent"
--algo bm --to 65535 -j DROP
-A INPUT -p udp -m udp --dport 5060 -m string --string "sipcli" --algo
bm --to 65535 -j DROP
-A INPUT -p udp -m udp --dport 5060 -m string --string
"friendly-scanner" --algo bm --to 65535 -j DROP
-A INPUT -p udp -m udp --dport 5060 -m string --string "VaxSIPUserAgent"
--algo bm --to 65535 -j DROP
-A INPUT -j f2b-freeswitch
-A f2b-freeswitch -j RETURN

Are my rules not stopping this registration because it's not being
recorded in any logs?

How do you stop (or prevent) unwanted registration attempts, even if
it's a sip scanner?

Thanks!


_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org