stop unwanted registration attempts
Hi All, How do people stop bad registration attempts to freeswitch? Is it pretty much impossible so don't worry about it as long as you have fail2ban? Using sngrep, I see lots of registration attempts like this: My actual IP has been replaced with 1.2.3.4. 2016/08/02 21:35:33.397073 195.154.48.130:5080 -> 192.168.0.137:5060 REGISTER sip:1.2.3.4:5060 SIP/2.0 Via: SIP/2.0/UDP 195.154.48.130:5080;branch=z9hG4bK23552ce85a146013577b3912;rport From: "7612" <sip:7612@1.2.3.4:5060>;tag=23552ce8ba27 To: "7612" <sip:7612@1.2.3.4:5060> Call-ID: ce85a14-4c0e6013-577b3912@1.2.3.4 CSeq: 1 REGISTER Contact: "7612" <sip:7612@195.154.48.130:5080> User-Agent: VaxSIPUserAgent/3.1 Expires: 1800 Max-Forwards: 70 Content-Length: 0 I have these iptables rules: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N f2b-freeswitch -A INPUT -j f2b-freeswitch -A INPUT -p tcp -m string --string "VaxSIPUserAgent/3.1" --algo bm --to 65535 -j DROP -A INPUT -p udp -m string --string "VaxSIPUserAgent/3.1" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5080 -m string --string "sipcli" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5080 -m string --string "friendly-scanner" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5080 -m string --string "VaxSIPUserAgent" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5060 -m string --string "sipcli" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5060 -m string --string "friendly-scanner" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5060 -m string --string "VaxSIPUserAgent" --algo bm --to 65535 -j DROP -A INPUT -j f2b-freeswitch -A f2b-freeswitch -j RETURN Are my rules not stopping this registration because it's not being recorded in any logs? How do you stop (or prevent) unwanted registration attempts, even if it's a sip scanner? Thanks!
Hi, There is several options: 1) Close your server to outside world with iptables, so only you from secure location can register. 2) Fail2ban 3) You can put in front Kamailio sip proxy which will handle security(like allowing registration from specific User-Agent, pike module and etc) 4) You can use iptables to block unwanted traffic from specific user-agent: http://ithelpblog.com/voice/prevent-or-deny-sip-dos-attack-sip-scanner-by-ip... 5) You can use iptables hashlimit to stop flood: https://wiki.freeswitch.org/wiki/QoS#DoS_REGISTER_Attack_Prevention Maybe there some other options, this is what I now remember. With kind regards, Jurijs On Wed, Aug 3, 2016 at 7:57 AM, Jungle Boogie <jungleboogie0@gmail.com> wrote:
Hi All,
How do people stop bad registration attempts to freeswitch? Is it pretty much impossible so don't worry about it as long as you have fail2ban?
Using sngrep, I see lots of registration attempts like this:
My actual IP has been replaced with 1.2.3.4.
2016/08/02 21:35:33.397073 195.154.48.130:5080 -> 192.168.0.137:5060 REGISTER sip:1.2.3.4:5060 SIP/2.0 Via: SIP/2.0/UDP 195.154.48.130:5080;branch=z9hG4bK23552ce85a146013577b3912;rport From: "7612" <sip:7612@1.2.3.4:5060>;tag=23552ce8ba27 To: "7612" <sip:7612@1.2.3.4:5060> Call-ID: ce85a14-4c0e6013-577b3912@1.2.3.4 CSeq: 1 REGISTER Contact: "7612" <sip:7612@195.154.48.130:5080> User-Agent: VaxSIPUserAgent/3.1 Expires: 1800 Max-Forwards: 70 Content-Length: 0
I have these iptables rules: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N f2b-freeswitch -A INPUT -j f2b-freeswitch -A INPUT -p tcp -m string --string "VaxSIPUserAgent/3.1" --algo bm --to 65535 -j DROP -A INPUT -p udp -m string --string "VaxSIPUserAgent/3.1" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5080 -m string --string "sipcli" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5080 -m string --string "friendly-scanner" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5080 -m string --string "VaxSIPUserAgent" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5060 -m string --string "sipcli" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5060 -m string --string "friendly-scanner" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5060 -m string --string "VaxSIPUserAgent" --algo bm --to 65535 -j DROP -A INPUT -j f2b-freeswitch -A f2b-freeswitch -j RETURN
Are my rules not stopping this registration because it's not being recorded in any logs?
How do you stop (or prevent) unwanted registration attempts, even if it's a sip scanner?
Thanks!
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi, I guess you can set this to true on your profile: https://wiki.freeswitch.org/wiki/Sofia.conf.xml#log-auth-failures and than fail2ban can pick it up from the log. Mirko On Wed, Aug 3, 2016 at 6:57 AM, Jungle Boogie <jungleboogie0@gmail.com> wrote:
Hi All,
How do people stop bad registration attempts to freeswitch? Is it pretty much impossible so don't worry about it as long as you have fail2ban?
Using sngrep, I see lots of registration attempts like this:
My actual IP has been replaced with 1.2.3.4.
2016/08/02 21:35:33.397073 195.154.48.130:5080 -> 192.168.0.137:5060 REGISTER sip:1.2.3.4:5060 SIP/2.0 Via: SIP/2.0/UDP 195.154.48.130:5080;branch=z9hG4bK23552ce85a146013577b3912;rport From: "7612" <sip:7612@1.2.3.4:5060>;tag=23552ce8ba27 To: "7612" <sip:7612@1.2.3.4:5060> Call-ID: ce85a14-4c0e6013-577b3912@1.2.3.4 CSeq: 1 REGISTER Contact: "7612" <sip:7612@195.154.48.130:5080> User-Agent: VaxSIPUserAgent/3.1 Expires: 1800 Max-Forwards: 70 Content-Length: 0
I have these iptables rules: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N f2b-freeswitch -A INPUT -j f2b-freeswitch -A INPUT -p tcp -m string --string "VaxSIPUserAgent/3.1" --algo bm --to 65535 -j DROP -A INPUT -p udp -m string --string "VaxSIPUserAgent/3.1" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5080 -m string --string "sipcli" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5080 -m string --string "friendly-scanner" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5080 -m string --string "VaxSIPUserAgent" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5060 -m string --string "sipcli" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5060 -m string --string "friendly-scanner" --algo bm --to 65535 -j DROP -A INPUT -p udp -m udp --dport 5060 -m string --string "VaxSIPUserAgent" --algo bm --to 65535 -j DROP -A INPUT -j f2b-freeswitch -A f2b-freeswitch -j RETURN
Are my rules not stopping this registration because it's not being recorded in any logs?
How do you stop (or prevent) unwanted registration attempts, even if it's a sip scanner?
Thanks!
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Regards, Mirko
On 3 August 2016 at 01:12, Mirko Brankovic <mirkobrankovic@gmail.com> wrote:
Hi, I guess you can set this to true on your profile: https://wiki.freeswitch.org/wiki/Sofia.conf.xml#log-auth-failures
and than fail2ban can pick it up from the log.
yes, that work's if the registration attempts are actually being picked up by freeswitch. I only see a register request and no reply from my side whatsoever. The IP address has been added to my iptables but the entries are still occurring. As seen in the original email, I have iptables to block based on the useragent but I still see the scans.
Mirko
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
For what it's worth, if you have a FS instance exposed to the world you're almost certainly better off with something in front of it. Even if you lock down your server in such a way that no unauthorized calls can be made, the traffic is still going to make it to your freeswitch instance. Generating enough bogus traffic could materially impact the quality of active calls by wasting CPU cycles, disk I/O from logs, and memory from the connections. Whether the "something" you put in front of it is a firewall with appropriate restrictions, a SIP proxy of some kind, or something else, is up to you (depending on the amount of introspection to the request you need). But I wouldn't recommend leaving it open. Best, Colin On Wed, Aug 3, 2016 at 11:44 AM jungle Boogie <jungleboogie0@gmail.com> wrote:
On 3 August 2016 at 01:12, Mirko Brankovic <mirkobrankovic@gmail.com> wrote:
Hi, I guess you can set this to true on your profile: https://wiki.freeswitch.org/wiki/Sofia.conf.xml#log-auth-failures
and than fail2ban can pick it up from the log.
yes, that work's if the registration attempts are actually being picked up by freeswitch. I only see a register request and no reply from my side whatsoever.
The IP address has been added to my iptables but the entries are still occurring. As seen in the original email, I have iptables to block based on the useragent but I still see the scans.
Mirko
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On 3 August 2016 at 08:48, Colin Morelli <colin.morelli@gmail.com> wrote:
Whether the "something" you put in front of it is a firewall with appropriate restrictions, a SIP proxy of some kind, or something else, is up to you (depending on the amount of introspection to the request you need). But I wouldn't recommend leaving it open.
Definitely sound advice that I will see what I can do. Ideally I'd like to get the apu2 and setup a firewall: http://pcengines.ch/apu2c4.htm -- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
Hi Jungle, Now I understand what issue you have. At lest I can recommend to put "string" rules on top of your rules. Not sure what is wrong, but if you can provide full rules + iptables -L -n -v I can take a look. With kind regards, Jurijs On Wed, Aug 3, 2016 at 6:41 PM, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 3 August 2016 at 01:12, Mirko Brankovic <mirkobrankovic@gmail.com> wrote:
Hi, I guess you can set this to true on your profile: https://wiki.freeswitch.org/wiki/Sofia.conf.xml#log-auth-failures
and than fail2ban can pick it up from the log.
yes, that work's if the registration attempts are actually being picked up by freeswitch. I only see a register request and no reply from my side whatsoever.
The IP address has been added to my iptables but the entries are still occurring. As seen in the original email, I have iptables to block based on the useragent but I still see the scans.
Mirko
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (5)
-
Colin Morelli
-
jungle Boogie
-
Jungle Boogie
-
Jurijs Ivolga
-
Mirko Brankovic