Roman,

My point of view is the following.

Fail2ban bans requests based on logs output. Right? You can keep kamailio's config as simple as possible but add logging of failed auth attempts. I.e.

reply_route[FROM_BACKEND] {

if(status == 403) {

xlog("L_WARN", "Frobidden from $si:$sp blah...\n");

}

And then you just need make appropriate filter.

This is just my opinion.

In the case of FreeSWITCH I do not know is it possible to show original IP address due failed auth attempts. sorry.

2016-11-29 15:08 GMT+02:00 Roman Dissauer <roman@dissauer.net>:

Thanks guys,

I’m sure that it is best practice to prevent brute force attacks on Kamailio. I also do that on another system where Kamailio handles full registration/authentication. Due to the fact that my SIP Proxy is as basic as possible forwarding all packets to the backend Freeswitch (just for load balancing), I thought it would be easier to solve that on Freeswitch side.

I’ll try to get that done in the reply route and will post the results here.

Roman

> Am 29.11.2016 um 10:40 schrieb Alex Balashov <abalashov@evaristesys.com>:
>
> On Tue, Nov 29, 2016 at 11:22:25AM +0200, Vladyslav Zakhozhai wrote:
>
>> I think that more elegant solution for your task is cut off bruteforce on
>> Kamailio side rather than on FreeSWITCH. You do not need (and must not)
>> pass malicious traffic to backends. It is best practice.
>
> I would agree with that. Kamailio makes a far better "condom" than Freeswitch.
>
> I just assumed there was something in his use-case that compelled relaying traffic forward uncritically.
>
> --
> Alex Balashov | Principal | Evariste Systems LLC
>
> Tel: +1-706-510-6800 (direct) / +1-800-250-5920 (toll-free)
> Web: http://www.evaristesys.com/, http://www.csrpswitch.com/
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting@freeswitch.org
> http://www.freeswitchsolutions.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://confluence.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users@lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org

С уважением,
Владислав Захожай