Ok thanks, i will try your dialplan. My actuals voip productions servers ( still running asterisk ) don't use fail2ban but i have restrictive firewall rules to allow only a predetermined list of IP and subnets but is not a reason to not use fail2ban on future servers. I also think about filtering by sip domains -A PREROUTING -i eth+ -p tcp --dport 5060:5082 -m string --string "sip:YOUR_HOSTNAME.no-ip.com" --algo bm --icase -j NEWSIP http://blog.ls20.com/securing-your-asterisk-voip-server-with-iptables/ nibblebil will be very useful for me, because i was looking since a long time a lightweight software ( not like astpp or a2billing ) for disabling a extension in case of probable fraud. On 20/09/2015 11:26, Sergey Safarov wrote:
On Fri, Sep 18, 2015 at 8:23 PM, Tanguy <phenix@vfemail.net <mailto:phenix@vfemail.net>> wrote:
Hello Sergey
I am agree with you that my dial plan can be risky I used ACL but this can be not sufficient. I want to be able to call any internal sip extension, but i don't want that this piece dialplan to be usable reach external numbers.
For extra protection, add into dialplan
<extensionname="blockCallToNonExistenDomain"> <conditionregex="any"> <regexfield="${sip_to_host}"expression="^[\d\.]+$"/> <regexfield="${domain_exists(${sip_to_host})}"expression="^false$"/> <actionapplication="info"/> <actionapplication="log" data="ERR Unauthorised call with uuid "${uuid}" is processed in context "${context}"! Source IP: ${network_addr}"/> <actionapplication="hangup"data="INCOMING_CALL_BARRED"/> </condition> </extension>
<extensionname="checkUserExist"> <conditionfield="${user_exists(id ${destination_number} ${sip_to_host})}" expression="^false$"> <actionapplication="hangup"data="UNALLOCATED_NUMBER"/> </condition> </extension>
I probably need to protect theses variables ( sip_to_user must be only a locally registered sip extension ) or avoid using them ( maybe using multiple conditions field for each domain ? )
"user_exists" function allow you block call to non existed destination. On my FS host created personal dialplan for each domain. Most of domain related checks related located in this dialplans.
I don't fully understand your initial example:
<action application="bridge" data="{sip_invite_to_uri=<sip:${destination_number}@mydomain.org <mailto:destination_number%7D@mydomain.org>>}user/reg_user@mydomain.org <mailto:reg_user@mydomain.org>"/>
It is copied from http://lists.freeswitch.org/pipermail/freeswitch-users/2015-August/115047.ht... message Is is response I write via my mobile phone and cannot edit correctly.
What is *reg_user* for freeswitch1?
reg_user related to message http://lists.freeswitch.org/pipermail/freeswitch-users/2015-August/115047.ht...
What should i use on freeswitch2 dialplan to recognize the inbound call ?
What is I may recommend to block unauthorised calls and fraud control I write above. Also I can recommend configure 1) fail2ban 2) nibblebill 3) destination_number format checks
Thanks
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org