Banning IP address that attempt registration via IP
Hey everyone! So I have quite a few "security" features installed on the server, including custom IP banning methods using IP Tables, (fail2ban caused too many issues). All endpoints on our system register via a domain, I'm looking for suggestions on how to block IP addresses that attempt to register with the IP address only. In other words, every time the warning below is received I'd like to ban that particular IP or at least add it to a list somewhere. WARNING: "You must define a domain called 'XXX.XXX.XX.XXX' in your directory and add a user with the id" I'm thinking of a custom script that scans the logs (which logs?) Any advice is appreciated. Thanks!
You can use Kamailio proxy as the frontend of FreeSwitch. And then block registration and INVITE messages with IP address in "From", "To" and "RURI" headers. Sergey On Mon, Jul 27, 2020 at 7:17 AM Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Hey everyone!
So I have quite a few "security" features installed on the server, including custom IP banning methods using IP Tables, (fail2ban caused too many issues).
All endpoints on our system register via a domain, I'm looking for suggestions on how to block IP addresses that attempt to register with the IP address only.
In other words, every time the warning below is received I'd like to ban that particular IP or at least add it to a list somewhere.
WARNING: "You must define a domain called 'XXX.XXX.XX.XXX' in your directory and add a user with the id"
I'm thinking of a custom script that scans the logs (which logs?)
Any advice is appreciated.
Thanks!
_________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
Fail2ban should work perfectly for that. What problems did you run into? Lots and lots of people use fail2ban. On Mon, 27 Jul 2020 at 05:51, Sergey Safarov <s.safarov@gmail.com> wrote:
You can use Kamailio proxy as the frontend of FreeSwitch. And then block registration and INVITE messages with IP address in "From", "To" and "RURI" headers.
Sergey
On Mon, Jul 27, 2020 at 7:17 AM Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Hey everyone!
So I have quite a few "security" features installed on the server, including custom IP banning methods using IP Tables, (fail2ban caused too many issues).
All endpoints on our system register via a domain, I'm looking for suggestions on how to block IP addresses that attempt to register with the IP address only.
In other words, every time the warning below is received I'd like to ban that particular IP or at least add it to a list somewhere.
WARNING: "You must define a domain called 'XXX.XXX.XX.XXX' in your directory and add a user with the id"
I'm thinking of a custom script that scans the logs (which logs?)
Any advice is appreciated.
Thanks!
_________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
_________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
-- Regards, David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
I am using fail2ban with a rule to block any ip address that is trying to register to an IP address On Mon, Jul 27, 2020, 7:16 AM David Villasmil < david.villasmil.work@gmail.com> wrote:
Fail2ban should work perfectly for that. What problems did you run into? Lots and lots of people use fail2ban.
On Mon, 27 Jul 2020 at 05:51, Sergey Safarov <s.safarov@gmail.com> wrote:
You can use Kamailio proxy as the frontend of FreeSwitch. And then block registration and INVITE messages with IP address in "From", "To" and "RURI" headers.
Sergey
On Mon, Jul 27, 2020 at 7:17 AM Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Hey everyone!
So I have quite a few "security" features installed on the server, including custom IP banning methods using IP Tables, (fail2ban caused too many issues).
All endpoints on our system register via a domain, I'm looking for suggestions on how to block IP addresses that attempt to register with the IP address only.
In other words, every time the warning below is received I'd like to ban that particular IP or at least add it to a list somewhere.
WARNING: "You must define a domain called 'XXX.XXX.XX.XXX' in your directory and add a user with the id"
I'm thinking of a custom script that scans the logs (which logs?)
Any advice is appreciated.
Thanks!
_________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
_________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
-- Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 _________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
I have a patch in sofia doing that. On Mon, Jul 27, 2020 at 7:22 PM David Villasmil < david.villasmil.work@gmail.com> wrote:
Fail2ban should work perfectly for that. What problems did you run into? Lots and lots of people use fail2ban.
On Mon, 27 Jul 2020 at 05:51, Sergey Safarov <s.safarov@gmail.com> wrote:
You can use Kamailio proxy as the frontend of FreeSwitch. And then block registration and INVITE messages with IP address in "From", "To" and "RURI" headers.
Sergey
On Mon, Jul 27, 2020 at 7:17 AM Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Hey everyone!
So I have quite a few "security" features installed on the server, including custom IP banning methods using IP Tables, (fail2ban caused too many issues).
All endpoints on our system register via a domain, I'm looking for suggestions on how to block IP addresses that attempt to register with the IP address only.
In other words, every time the warning below is received I'd like to ban that particular IP or at least add it to a list somewhere.
WARNING: "You must define a domain called 'XXX.XXX.XX.XXX' in your directory and add a user with the id"
I'm thinking of a custom script that scans the logs (which logs?)
Any advice is appreciated.
Thanks!
_________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
_________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
-- Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 _________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
-- About: http://about.me/dujinfang Blog: http://www.dujinfang.com Proj: http://www.freeswitch.org.cn
This little script has been doing a great job for us. #!/bin/bash publicIP=`/sbin/ifconfig eth0 | sed -En 's/.*inet (addr:)?(([0-9]*\.){3}[0-9]*).*/\2/p'` for ip in `grep "Can't find user" /usr/local/freeswitch/var/log/freeswitch/freeswitch.log | grep $publicIP | awk '{print $10}' | sort | uniq` ; do /sbin/iptables -I INPUT -s $ip -m comment --comment "`date` $comment" -j DROP done *Jai Rangi* Cebod Technologies LLC dba DIDforSale/Cebod Telecom O 949-471-0102 | C 949-419-7634 <1-949-419-7634> | F 949-269-0449 / 949-232-1410 | jprangi@didforsale.com www.didforsale.com |2472 Chambers Rd Ste 100, Tustin, CA 92780 On Sun, Jul 26, 2020 at 8:57 PM Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Hey everyone!
So I have quite a few "security" features installed on the server, including custom IP banning methods using IP Tables, (fail2ban caused too many issues).
All endpoints on our system register via a domain, I'm looking for suggestions on how to block IP addresses that attempt to register with the IP address only.
In other words, every time the warning below is received I'd like to ban that particular IP or at least add it to a list somewhere.
WARNING: "You must define a domain called 'XXX.XXX.XX.XXX' in your directory and add a user with the id"
I'm thinking of a custom script that scans the logs (which logs?)
Any advice is appreciated.
Thanks!
_________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
participants (6)
-
David Villasmil
-
Don Hawkins
-
Jai Rangi
-
Moshe Rosenberg
-
Sergey Safarov
-
Seven Du