Hi,all) I have the freeswitch on public ip with set up fail2ban. However, there is an external invites which proceed to dialplan's context public. How can I defend my freeswitch from such attaks? The log of such attack is in the attachment. Bets Regards, Nikolay Zaytsev
1) Output network_ip of received INVITE with appropriate comment like "Block for one day ip x.x.x.x" 2) Add fail2ban rule to search strings like "Block for one day ip x.x.x.x" and block ip On Sat, Aug 15, 2015 at 12:18 PM, Nikolay Zaytsev <nzaytsevc@gmail.com> wrote:
Hi,all) I have the freeswitch on public ip with set up fail2ban. However, there is an external invites which proceed to dialplan's context public. How can I defend my freeswitch from such attaks? The log of such attack is in the attachment. Bets Regards, Nikolay Zaytsev
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
The public context is unauthentecared that is why its called public. Only public facing extensions should be defined there. The example configs are only a suggestion on how to run your server. The best approach is to learn how the sofia profiles and contexts work to configure it to your needs. On Saturday, August 15, 2015, Sergey Safarov <s.safarov@gmail.com> wrote:
1) Output network_ip of received INVITE with appropriate comment like "Block for one day ip x.x.x.x" 2) Add fail2ban rule to search strings like "Block for one day ip x.x.x.x" and block ip
On Sat, Aug 15, 2015 at 12:18 PM, Nikolay Zaytsev <nzaytsevc@gmail.com <javascript:_e(%7B%7D,'cvml','nzaytsevc@gmail.com');>> wrote:
Hi,all) I have the freeswitch on public ip with set up fail2ban. However, there is an external invites which proceed to dialplan's context public. How can I defend my freeswitch from such attaks? The log of such attack is in the attachment. Bets Regards, Nikolay Zaytsev
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <javascript:_e(%7B%7D,'cvml','consulting@freeswitch.org');> http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <javascript:_e(%7B%7D,'cvml','FreeSWITCH-users@lists.freeswitch.org');> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II ♬ @anthmfs ♬ @FreeSWITCH ♬ ☞ http://freeswitch.org/ ☞ http://cluecon.com/ ☞ http://twitter.com/FreeSWITCH ☞ irc.freenode.net #freeswitch ☞ *http://freeswitch.org/g+ <http://freeswitch.org/g+>* ClueCon Weekly Development Call ☎ sip:888@conference.freeswitch.org ☎ +19193869900 https://www.youtube.com/watch?v=9XXgW34t40s https://www.youtube.com/watch?v=NLaDpGQuZDA
An external invite in default config go to the public context. That is the expected and correct behavior, in default config. Eg: is where the incoming did calls would go, and then (in default config) are dispatched to local extensions (1000...1020). Obviously, you can change the config to fit your needs. -giovanni sent from my mobile, Giovanni Maruzzelli cell: +39 347 266 56 18 On Aug 15, 2015 4:14 PM, "Anthony Minessale" <anthony.minessale@gmail.com> wrote:
The public context is unauthentecared that is why its called public. Only public facing extensions should be defined there.
The example configs are only a suggestion on how to run your server. The best approach is to learn how the sofia profiles and contexts work to configure it to your needs.
On Saturday, August 15, 2015, Sergey Safarov <s.safarov@gmail.com> wrote:
1) Output network_ip of received INVITE with appropriate comment like "Block for one day ip x.x.x.x" 2) Add fail2ban rule to search strings like "Block for one day ip x.x.x.x" and block ip
On Sat, Aug 15, 2015 at 12:18 PM, Nikolay Zaytsev <nzaytsevc@gmail.com> wrote:
Hi,all) I have the freeswitch on public ip with set up fail2ban. However, there is an external invites which proceed to dialplan's context public. How can I defend my freeswitch from such attaks? The log of such attack is in the attachment. Bets Regards, Nikolay Zaytsev
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II ♬ @anthmfs ♬ @FreeSWITCH ♬
☞ http://freeswitch.org/ ☞ http://cluecon.com/ ☞ http://twitter.com/FreeSWITCH ☞ irc.freenode.net #freeswitch ☞ *http://freeswitch.org/g+ <http://freeswitch.org/g+>*
ClueCon Weekly Development Call ☎ sip:888@conference.freeswitch.org ☎ +19193869900
https://www.youtube.com/watch?v=9XXgW34t40s https://www.youtube.com/watch?v=NLaDpGQuZDA
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Nikolay Zaytsev , Very 1st thing that i will suggest is that please change the default sip ports to some other ports like 7000,5090 etc. Plus use the ipset and iptables to block the ip's. This will surely help you, https://github.com/vervelink/badguys/blob/master/ipset-blockips.sh list of common attacking IP's Regards Bilal Abbasi On Sat, Aug 15, 2015 at 2:18 PM, Nikolay Zaytsev <nzaytsevc@gmail.com> wrote:
Hi,all) I have the freeswitch on public ip with set up fail2ban. However, there is an external invites which proceed to dialplan's context public. How can I defend my freeswitch from such attaks? The log of such attack is in the attachment. Bets Regards, Nikolay Zaytsev
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (5)
-
Anthony Minessale
-
Bilal Abbasi
-
Giovanni Maruzzelli
-
Nikolay Zaytsev
-
Sergey Safarov