Or better! Make all clients behind static ip addresses available, and limit the registration with those ip-addresses. Tamer Am 03.01.2012 00:26, schrieb Brian Foster:

This is just part of having a switch open to the world. We get these registration attempts on a daily, almost hourly basis. It is your responsibility to make sure your system is secured. Please look at fail2ban and iptables as ways to protect your system. If you don't, it could cost you big money.

On Jan 2, 2012 4:59 PM, "Karol" <darknesslabs@gmail.com <mailto:darknesslabs@gmail.com>> wrote:

Anyone else see this??

http://pastebin.freeswitch.com/18078

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

We force all users to register against our DNS name, then use IP Tables to reject REGISTER methods coming against our IP address: iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "REGISTER sip:a.c.d.e SIP" --algo bm iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "REGISTER sip:a.c.d.e:5060 SIP" --algo bm Where a.b.c.d is your public IP address. This will stop responses to initial SIPVicious explorations also, which means you don't get on their list in the first place and save a whole lot of useless UDP blasts which come from their brute force attacks. -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SIP-attacks-from-188-161-101-7... Sent from the freeswitch-users mailing list archive at Nabble.com.