ACLs control registrations and calls, not options requests.

You'd be best off blocking sipvicious with this iptables entry:
iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm

-Steve


On 8 June 2011 20:11, Eric Beard <eric@loopfx.com> wrote:

It seems I misunderstand the purpose of the acl.conf.xml file.

 

What I want to do is create an IP whitelist, so only the IPs I designate get a response from FreeSwitch.  I’d like to do this with FreeSwitch rather than a firewall.

 

I have this in acl.conf.xml:

 

    <list name="domains" default="deny">

      <!-- domain= is special it scans the domain from the directory to build the ACL -->

      <node type="allow" domain="$${domain}"/>

      <!-- use cidr= if you wish to allow ip ranges to this domains acl. -->

      <node type="allow" cidr="10.1.0.0/24"/>

 

      <!-- Broadvox DID -->

      <node type="allow" cidr="209.249.3.74/32"/>

    </list>

 

I was assuming that this would only allow traffic from my local network, 10.1.0.0, and from the single IP 209.249.3.74

 

But while watching sip traffic, I saw an OPTIONS request from a different IP (sipvicious scan).  Freeswitch happily responded to the OPTIONS with an OK.

 

How can I configure it so that it ignores requests that are not on my whitelist?

 

Thanks!

 

-----------------------

Eric Z. Beard, CTO

Loop LLC

w (877) 850-2010 x9249

m (727) 776-2768

eric@loopfx.com

 


_______________________________________________
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org