Brian, thanks for the input, I have researched this exhaustively to be sure I don’t. We ran an extensive search on the system and could not find this IP address anywhere on the system, but yet they could make calls. This is an IP address from russia, they hit the network for around $20k in October then out of the blue they started being blocked, I am really worried they will find another hole in the system, if there is indeed one. Darcy From: Brian West Sent: Friday, December 02, 2011 5:06 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] acl validation do you have a cidr=91.212.226.30 tag on a user in your directory? /b On Dec 2, 2011, at 4:01 PM, Darcy wrote: Looking through my call log, I see the following item in the log, this IP is not in the acl Domain List, it is not a profile and it is not registered on the switch, Is there something I am missing on this that needs to be set. These guys are attempting calls to Jamaica. 2011-10-31 09:11:31.801420 [DEBUG] sofia.c:5798 IP 91.212.226.30 Approved by acl "domains[]". Access Granted. <list name="domains" default="deny"> <node type="allow" cidr="xxx.xxx.xx.xx/32"/> I have 5 more entries like so in this switch. etc. </list> -------------------------------------------------------------------------------- _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

That is a nice offer, but most likely for you, not us. What I have done is build a front to the dial plan that basically duplicates the acl list, it inspects all calls made to the freeswitch and looks at our version of the acl list, discards what it does not like, took a little work but I have not been able to bust it, gives us a little overhead, would like it to be done automatically in the freeswitch, however, this is a good work around. We use the freeswitch as a tandem between pbxnsip hosted servers and the pstn, that is why someone could generate a lot of traffic before we were alerted, now it is secure. Thanks in any case. Darcy From: Brian West Sent: Friday, December 02, 2011 10:58 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] acl validation Well if you paypal me 5k I can help ya! :P /b On Dec 2, 2011, at 8:41 PM, Darcy wrote: Brian, thanks for the input, I have researched this exhaustively to be sure I don’t. We ran an extensive search on the system and could not find this IP address anywhere on the system, but yet they could make calls. This is an IP address from russia, they hit the network for around $20k in October then out of the blue they started being blocked, I am really worried they will find another hole in the system, if there is indeed one. Darcy From: Brian West Sent: Friday, December 02, 2011 5:06 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] acl validation do you have a cidr=91.212.226.30 tag on a user in your directory? / -------------------------------------------------------------------------------- _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org