Thank you very much, Peter!. De: FreeSWITCH-users [mailto:freeswitch-users-bounces@lists.freeswitch.org] En nombre de Peter Steinbach Enviado el: viernes, 15 de diciembre de 2017 18:46 Para: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Asunto: Re: [Freeswitch-users] how to block requests with From Ip equal to server interface IP? Hello Miguel, see here http://lists.freeswitch.org/pipermail/freeswitch-users/2011-April/071796.htm... You will need to change the line search="friendly-scanner" to search="Z 3.14.38765 rv2.8.3" This worked for me. Best regards Peter On 12/15/17 18:32, Miguel Jesús López Valverde wrote: Good afternoon everyone I get a new query regarding a type of attack that our freeswitch servers receive constantly in case someone knows how to block them. These are INVITE or REGISTER requests in which the FROM: field arrives with the ip and port equal to the public interface of the server, so the different protection options that I have tried have not blocked these requests: - IpTables can not filter by the information From the INVITE message. - Fail2Ban is equally limited than IpTables. - ACLs have not resolved to filter these requests. Does anyone know any way to block these requests? I send here a trace with an INVITE message where you can see a request of this type. Thanks and best regards. U 2017/12/14 18:32:55.156886 185.107.94.121:11120 -> 182.30.1.194:5060 INVITE sip:390239297988@ 182.30.1.194:5060;transport=UDP SIP/2.0. Via: SIP/2.0/UDP 122.221.117.131:5060;branch=z9hG4bK-524287-1---xi3qy2kz737ni404. Max-Forwards: 70. Contact: <mailto:sip:15714000000@122.221.117.131:5060;transport=UDP> <sip:15714000000@122.221.117.131:5060;transport=UDP>. To: <sip:390239297988@ 182.30.1.194;transport=UDP <sip:390239297988@%20182.30.1.194;transport=UDP> >. From: <mailto:sip:15714000000@182.30.1.194;transport=UDP> <sip:15714000000@ 182.30.1.194;transport=UDP>;tag=hlzg2jcv. Call-ID: KaQqH51mAcFv34qN8cGyv3... CSeq: 1 INVITE. Content-Type: application/sdp. User-Agent: Z 3.14.38765 rv2.8.3. Allow-Events: presence, kpml, talk. Content-Length: 0. . <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> Libre de virus. <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> www.avast.com _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- With kind regards Peter Steinbach Telefaks Services GmbH mailto:lists (att) telefaks.de Internet: www.telefaks.de <http://www.telefaks.de> --- El software de antivirus Avast ha analizado este correo electrónico en busca de virus. https://www.avast.com/antivirus