how to block requests with From Ip equal to server interface IP?
Good afternoon everyone I get a new query regarding a type of attack that our freeswitch servers receive constantly in case someone knows how to block them. These are INVITE or REGISTER requests in which the FROM: field arrives with the ip and port equal to the public interface of the server, so the different protection options that I have tried have not blocked these requests: - IpTables can not filter by the information From the INVITE message. - Fail2Ban is equally limited than IpTables. - ACLs have not resolved to filter these requests. Does anyone know any way to block these requests? I send here a trace with an INVITE message where you can see a request of this type. Thanks and best regards. U 2017/12/14 18:32:55.156886 185.107.94.121:11120 -> 182.30.1.194:5060 INVITE sip:390239297988@ 182.30.1.194:5060;transport=UDP SIP/2.0. Via: SIP/2.0/UDP 122.221.117.131:5060;branch=z9hG4bK-524287-1---xi3qy2kz737ni404. Max-Forwards: 70. Contact: <sip:15714000000@122.221.117.131:5060;transport=UDP>. To: <sip:390239297988@ 182.30.1.194;transport=UDP>. From: <sip:15714000000@ 182.30.1.194;transport=UDP>;tag=hlzg2jcv. Call-ID: KaQqH51mAcFv34qN8cGyv3... CSeq: 1 INVITE. Content-Type: application/sdp. User-Agent: Z 3.14.38765 rv2.8.3. Allow-Events: presence, kpml, talk. Content-Length: 0. . --- El software de antivirus Avast ha analizado este correo electrónico en busca de virus. https://www.avast.com/antivirus
Hello Miguel, see here http://lists.freeswitch.org/pipermail/freeswitch-users/2011-April/071796.htm... You will need to change the line search="friendly-scanner" to search="Z 3.14.38765 rv2.8.3" This worked for me. Best regards Peter On 12/15/17 18:32, Miguel Jesús López Valverde wrote:
Good afternoon everyone
I get a new query regarding a type of attack that our freeswitch servers receive constantly in case someone knows how to block them.
These are INVITE or REGISTER requests in which the FROM: field arrives with the ip and port equal to the public interface of the server, so the different protection options that I have tried have not blocked these requests:
- IpTables can not filter by the information From the INVITE message.
- Fail2Ban is equally limited than IpTables.
- ACLs have not resolved to filter these requests.
Does anyone know any way to block these requests?
I send here a trace with an INVITE message where you can see a request of this type.
Thanks and best regards.
U 2017/12/14 18:32:55.156886 185.107.94.121:11120 -> 182.30.1.194:5060
INVITE sip:390239297988@ 182.30.1.194:5060;transport=UDP SIP/2.0.
Via: SIP/2.0/UDP 122.221.117.131:5060;branch=z9hG4bK-524287-1---xi3qy2kz737ni404.
Max-Forwards: 70.
Contact: <sip:15714000000@122.221.117.131:5060;transport=UDP>.
To: <sip:390239297988@ 182.30.1.194;transport=UDP>.
From: <sip:15714000000@ 182.30.1.194;transport=UDP>;tag=hlzg2jcv.
Call-ID: KaQqH51mAcFv34qN8cGyv3...
CSeq: 1 INVITE.
Content-Type: application/sdp.
User-Agent: Z 3.14.38765 rv2.8.3.
Allow-Events: presence, kpml, talk.
Content-Length: 0.
.
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> Libre de virus. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- With kind regards Peter Steinbach Telefaks Services GmbH mailto:lists (att) telefaks.de Internet: www.telefaks.de
if you use domain names, then you can place FreeSwitch behind Kamailio and implement filter on Kamailio side. Filter logic: 1) if To header like \d+\.\d+\.\d+\.\d+ then drop packet; 2) if From header like \d+\.\d+\.\d+\.\d+ then drop packet; Example of such filter logic you can find here https://github.com/2600hz/kazoo-configs-kamailio/blob/master/kamailio/traffi... пт, 15 дек. 2017 г. в 20:46, Peter Steinbach <lists@telefaks.de>:
Hello Miguel,
see here
http://lists.freeswitch.org/pipermail/freeswitch-users/2011-April/071796.htm... You will need to change the line search="friendly-scanner" to search="Z 3.14.38765 rv2.8.3"
This worked for me. Best regards Peter
On 12/15/17 18:32, Miguel Jesús López Valverde wrote:
Good afternoon everyone
I get a new query regarding a type of attack that our freeswitch servers receive constantly in case someone knows how to block them.
These are INVITE or REGISTER requests in which the FROM: field arrives with the ip and port equal to the public interface of the server, so the different protection options that I have tried have not blocked these requests:
- IpTables can not filter by the information From the INVITE message.
- Fail2Ban is equally limited than IpTables.
- ACLs have not resolved to filter these requests.
Does anyone know any way to block these requests?
I send here a trace with an INVITE message where you can see a request of this type.
Thanks and best regards.
U 2017/12/14 18:32:55.156886 185.107.94.121:11120 -> 182.30.1.194:5060
INVITE sip:390239297988@ 182.30.1.194:5060;transport=UDP SIP/2.0.
Via: SIP/2.0/UDP 122.221.117.131:5060 ;branch=z9hG4bK-524287-1---xi3qy2kz737ni404.
Max-Forwards: 70.
Contact: <sip:15714000000@122.221.117.131:5060;transport=UDP> <sip:15714000000@122.221.117.131:5060;transport=UDP>.
To: <sip:390239297988@ 182.30.1.194;transport=UDP>.
From: <sip:15714000000@ 182.30.1.194;transport=UDP> <sip:15714000000@182.30.1.194;transport=UDP>;tag=hlzg2jcv.
Call-ID: KaQqH51mAcFv34qN8cGyv3...
CSeq: 1 INVITE.
Content-Type: application/sdp.
User-Agent: Z 3.14.38765 rv2.8.3.
Allow-Events: presence, kpml, talk.
Content-Length: 0.
.
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> Libre de virus. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> <#m_-1760520282224978735_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com
Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://confluence.freeswitch.orghttp://www.cluecon....
FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...
-- With kind regards Peter Steinbach
Telefaks Services GmbHmailto:lists <lists> (att) telefaks.de Internet: www.telefaks.de
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thank you very much, Peter!. De: FreeSWITCH-users [mailto:freeswitch-users-bounces@lists.freeswitch.org] En nombre de Peter Steinbach Enviado el: viernes, 15 de diciembre de 2017 18:46 Para: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Asunto: Re: [Freeswitch-users] how to block requests with From Ip equal to server interface IP? Hello Miguel, see here http://lists.freeswitch.org/pipermail/freeswitch-users/2011-April/071796.htm... You will need to change the line search="friendly-scanner" to search="Z 3.14.38765 rv2.8.3" This worked for me. Best regards Peter On 12/15/17 18:32, Miguel Jesús López Valverde wrote: Good afternoon everyone I get a new query regarding a type of attack that our freeswitch servers receive constantly in case someone knows how to block them. These are INVITE or REGISTER requests in which the FROM: field arrives with the ip and port equal to the public interface of the server, so the different protection options that I have tried have not blocked these requests: - IpTables can not filter by the information From the INVITE message. - Fail2Ban is equally limited than IpTables. - ACLs have not resolved to filter these requests. Does anyone know any way to block these requests? I send here a trace with an INVITE message where you can see a request of this type. Thanks and best regards. U 2017/12/14 18:32:55.156886 185.107.94.121:11120 -> 182.30.1.194:5060 INVITE sip:390239297988@ 182.30.1.194:5060;transport=UDP SIP/2.0. Via: SIP/2.0/UDP 122.221.117.131:5060;branch=z9hG4bK-524287-1---xi3qy2kz737ni404. Max-Forwards: 70. Contact: <mailto:sip:15714000000@122.221.117.131:5060;transport=UDP> <sip:15714000000@122.221.117.131:5060;transport=UDP>. To: <sip:390239297988@ 182.30.1.194;transport=UDP <sip:390239297988@%20182.30.1.194;transport=UDP> >. From: <mailto:sip:15714000000@182.30.1.194;transport=UDP> <sip:15714000000@ 182.30.1.194;transport=UDP>;tag=hlzg2jcv. Call-ID: KaQqH51mAcFv34qN8cGyv3... CSeq: 1 INVITE. Content-Type: application/sdp. User-Agent: Z 3.14.38765 rv2.8.3. Allow-Events: presence, kpml, talk. Content-Length: 0. . <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> Libre de virus. <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> www.avast.com _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- With kind regards Peter Steinbach Telefaks Services GmbH mailto:lists (att) telefaks.de Internet: www.telefaks.de <http://www.telefaks.de> --- El software de antivirus Avast ha analizado este correo electrónico en busca de virus. https://www.avast.com/antivirus
Having your server IP in the From header is not necessarily incorrect. They aren't necessarily saying that they are sending from that IP, it could be them saying they are a user registered on your server. I'd block it based on something else such as user-agent or fail2ban. On 15 December 2017 at 17:32, Miguel Jesús López Valverde < mjlopez@smartic.es> wrote:
Good afternoon everyone
I get a new query regarding a type of attack that our freeswitch servers receive constantly in case someone knows how to block them.
These are INVITE or REGISTER requests in which the FROM: field arrives with the ip and port equal to the public interface of the server, so the different protection options that I have tried have not blocked these requests:
- IpTables can not filter by the information From the INVITE message.
- Fail2Ban is equally limited than IpTables.
- ACLs have not resolved to filter these requests.
Does anyone know any way to block these requests?
I send here a trace with an INVITE message where you can see a request of this type.
Thanks and best regards.
U 2017/12/14 18:32:55.156886 185.107.94.121:11120 -> 182.30.1.194:5060
INVITE sip:390239297988@ 182.30.1.194:5060;transport=UDP SIP/2.0.
Via: SIP/2.0/UDP 122.221.117.131:5060;branch=z9hG4bK-524287-1--- xi3qy2kz737ni404.
Max-Forwards: 70.
Contact: <sip:15714000000 <(571)%20400-0000>@122.221.117. 131:5060;transport=UDP>.
To: <sip:390239297988@ 182.30.1.194;transport=UDP>.
From: <sip:15714000000 <(571)%20400-0000>@ 182.30.1.194;transport=UDP>; tag=hlzg2jcv.
Call-ID: KaQqH51mAcFv34qN8cGyv3...
CSeq: 1 INVITE.
Content-Type: application/sdp.
User-Agent: Z 3.14.38765 rv2.8.3.
Allow-Events: presence, kpml, talk.
Content-Length: 0.
.
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> Libre de virus. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> <#m_-8919491363007729199_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hello, We are going to have Brian West answer your question on the ClueCon weekly call this week in our community corner. If you would like to join us live on Wednesday at noon central time you can dial 888 at https://conference.freeswitch.org/vc/ or watch it live on Youtube here: https://youtu.be/F4OkiQ_okQI Please let me know if you have any other questions. [image: freeswitch logo giant.jpg] <https://freeswitch.com> Kathleen King | Public Relations / Administrative Assistant FreeSWITCH Solutions | 17345 Civic Drive #2531 Brookfield, WI 53045 Email: Kathleen@freeswitch.com Mobile: 703-859-3757 Website: https://www.FreeSWITCH.com <https://www.freeswitch.com> [image: color-facebook-96.png] <https://www.facebook.com/freeswitch/> [image: color-twitter-96.png] <https://twitter.com/freeswitch?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor> On Fri, Dec 15, 2017 at 9:32 AM, Miguel Jesús López Valverde < mjlopez@smartic.es> wrote:
Good afternoon everyone
I get a new query regarding a type of attack that our freeswitch servers receive constantly in case someone knows how to block them.
These are INVITE or REGISTER requests in which the FROM: field arrives with the ip and port equal to the public interface of the server, so the different protection options that I have tried have not blocked these requests:
- IpTables can not filter by the information From the INVITE message.
- Fail2Ban is equally limited than IpTables.
- ACLs have not resolved to filter these requests.
Does anyone know any way to block these requests?
I send here a trace with an INVITE message where you can see a request of this type.
Thanks and best regards.
U 2017/12/14 18:32:55.156886 185.107.94.121:11120 -> 182.30.1.194:5060
INVITE sip:390239297988@ 182.30.1.194:5060;transport=UDP SIP/2.0.
Via: SIP/2.0/UDP 122.221.117.131:5060;branch=z9hG4bK-524287-1--- xi3qy2kz737ni404.
Max-Forwards: 70.
Contact: <sip:15714000000 <(571)%20400-0000>@122.221.117. 131:5060;transport=UDP>.
To: <sip:390239297988@ 182.30.1.194;transport=UDP>.
From: <sip:15714000000 <(571)%20400-0000>@ 182.30.1.194;transport=UDP>; tag=hlzg2jcv.
Call-ID: KaQqH51mAcFv34qN8cGyv3...
CSeq: 1 INVITE.
Content-Type: application/sdp.
User-Agent: Z 3.14.38765 rv2.8.3.
Allow-Events: presence, kpml, talk.
Content-Length: 0.
.
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> Libre de virus. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> <#m_-638193062881438373_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (5)
-
Kathleen King
-
Miguel Jesús López Valverde
-
Peter Steinbach
-
Sergey Safarov
-
Steven Ayre