OK, here is what I use. In the sip interface profile of FS I have <param name="nat-options-ping" value="true"/> <param name="ext-sip-ip" value="auto-nat"/> <param name="ext-rtp-ip" value="auto-nat"/> I just downloaded xlite and used defaults plus account credentials fine. Did you address the problem with their router? Sean From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Manish Khilwani Sent: Tuesday, April 23, 2013 3:24 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] ERROR 404 BAD HEADER Hello Sean, Thanks for replying. My FS in installed on server and phone is trying to register from other network. I'm using xlite softphone to register in FS. What shoud I do now then? Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079 On Wed, Apr 24, 2013 at 12:44 AM, Sean Devoy <sdevoy@bizfocused.com> wrote: I had this error last night! The problem is with the router/nat at your customers. It is not including its IP/Domain in the header. I had to set my particular router's ALG to ignore/passthrough SIP ALG. Many routers only allow ALG on or off. You want off. But, you need to configure for NAT on your clients and FS. If your FS server is LOCAL to where you "setup extensions in FreeSwitch" there is a lot still to configure. Let me know I will tell you what I know about that. Also, what is the phone or ata brand being used? Sean -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of pratham2013 Sent: Tuesday, April 23, 2013 1:29 PM To: freeswitch-users@lists.freeswitch.org Subject: [Freeswitch-users] ERROR 404 BAD HEADER Hello, I'm facing very strange issue. I has setup extensions in FreeSwitch and I can login and make calls but on of my customer can not register with same extension and they are getting error 400 bad contact header so I could not understand how to solve this issue. Please anyone can help? Thanks Manish Khilwani -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040 <http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp759004 0.html> .html Sent from the freeswitch-users mailing list archive at Nabble.com. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

What he is saying is that the router at the customer's site is messing up the SIP contact header, possibly by putting the wrong IP address in it. You best bet is to have the customer log in to his router and disable any SIP ALG. Alternatively you can try some of the NAT settings in the SIP profile. For example you can set "aggressive-nat-detection" to true and see if that helps, although you may need to test your other customers to make sure that setting doesn't break their connections! Don't you just love broken NAT devices? :) -MC On Tue, Apr 23, 2013 at 8:51 PM, Manish Khilwani <manish.khilwani@gmail.com>wrote:

Hello Sean,

I'm using Amazon cloud server so I have to assign elastic ip in ext-rtp-ip and ext-sip-ip. and what excatly I need to to do with router?

*Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079*

On Wed, Apr 24, 2013 at 2:14 AM, Sean Devoy <sdevoy@bizfocused.com> wrote:

...

OK, here is what I use.****

** **

In the sip interface profile of FS I have****

<param name="nat-options-ping" value="true"/>****

<param name="ext-sip-ip" value="auto-nat"/>****

<param name="ext-rtp-ip" value="auto-nat"/>****

** **

I just downloaded xlite and used defaults plus account credentials fine.* ***

** **

Did you address the problem with their router?****

** **

Sean****

** **

*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Manish Khilwani *Sent:* Tuesday, April 23, 2013 3:24 PM *To:* FreeSWITCH Users Help *Subject:* Re: [Freeswitch-users] ERROR 404 BAD HEADER****

** **

Hello Sean,****

Thanks for replying.****

My FS in installed on server and phone is trying to register from other network. I'm using xlite softphone to register in FS.****

What shoud I do now then?****

****

*Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079*****

** **

On Wed, Apr 24, 2013 at 12:44 AM, Sean Devoy <sdevoy@bizfocused.com> wrote:****

I had this error last night! The problem is with the router/nat at your customers. It is not including its IP/Domain in the header. I had to set my particular router's ALG to ignore/passthrough SIP ALG. Many routers only allow ALG on or off. You want off.

But, you need to configure for NAT on your clients and FS. If your FS server is LOCAL to where you "setup extensions in FreeSwitch" there is a lot still to configure. Let me know I will tell you what I know about that. Also, what is the phone or ata brand being used?

Sean

-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of pratham2013 Sent: Tuesday, April 23, 2013 1:29 PM To: freeswitch-users@lists.freeswitch.org Subject: [Freeswitch-users] ERROR 404 BAD HEADER

Hello, I'm facing very strange issue. I has setup extensions in FreeSwitch and I can login and make calls but on of my customer can not register with same extension and they are getting error 400 bad contact header so I could not understand how to solve this issue. Please anyone can help? Thanks Manish Khilwani

-- View this message in context:

http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040 .html<http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040.html> Sent from the freeswitch-users mailing list archive at Nabble.com.

-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org

You could also collect a packet trace to see what exactly about the Contact header is broken. Some NDLB settings might help, but it sounds like the header could be so badly wrong the Sofia parser is failing to decode the packet at all. Sent from my iPad On 24 Apr 2013, at 05:48, Manish Khilwani <manish.khilwani@gmail.com> wrote:

Hello Michael,

Thanks for your support I will try all the things which you and Sean has suggested. Once again Thank you very much.

Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079

On Wed, Apr 24, 2013 at 10:03 AM, Michael Collins <msc@freeswitch.org> wrote:

...

What he is saying is that the router at the customer's site is messing up the SIP contact header, possibly by putting the wrong IP address in it. You best bet is to have the customer log in to his router and disable any SIP ALG. Alternatively you can try some of the NAT settings in the SIP profile. For example you can set "aggressive-nat-detection" to true and see if that helps, although you may need to test your other customers to make sure that setting doesn't break their connections!

Don't you just love broken NAT devices? :)

-MC

On Tue, Apr 23, 2013 at 8:51 PM, Manish Khilwani <manish.khilwani@gmail.com> wrote:

...

Hello Sean,

I'm using Amazon cloud server so I have to assign elastic ip in ext-rtp-ip and ext-sip-ip. and what excatly I need to to do with router?

Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079

On Wed, Apr 24, 2013 at 2:14 AM, Sean Devoy <sdevoy@bizfocused.com> wrote:

...

OK, here is what I use.

In the sip interface profile of FS I have

<param name="nat-options-ping" value="true"/>

<param name="ext-sip-ip" value="auto-nat"/>

<param name="ext-rtp-ip" value="auto-nat"/>

I just downloaded xlite and used defaults plus account credentials fine.

Did you address the problem with their router?

Sean

From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Manish Khilwani Sent: Tuesday, April 23, 2013 3:24 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] ERROR 404 BAD HEADER

Hello Sean,

Thanks for replying.

My FS in installed on server and phone is trying to register from other network. I'm using xlite softphone to register in FS.

What shoud I do now then?

Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079

On Wed, Apr 24, 2013 at 12:44 AM, Sean Devoy <sdevoy@bizfocused.com> wrote:

I had this error last night! The problem is with the router/nat at your customers. It is not including its IP/Domain in the header. I had to set my particular router's ALG to ignore/passthrough SIP ALG. Many routers only allow ALG on or off. You want off.

But, you need to configure for NAT on your clients and FS. If your FS server is LOCAL to where you "setup extensions in FreeSwitch" there is a lot still to configure. Let me know I will tell you what I know about that. Also, what is the phone or ata brand being used?

Sean

-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of pratham2013 Sent: Tuesday, April 23, 2013 1:29 PM To: freeswitch-users@lists.freeswitch.org Subject: [Freeswitch-users] ERROR 404 BAD HEADER

Hello, I'm facing very strange issue. I has setup extensions in FreeSwitch and I can login and make calls but on of my customer can not register with same extension and they are getting error 400 bad contact header so I could not understand how to solve this issue. Please anyone can help? Thanks Manish Khilwani

-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040 .html Sent from the freeswitch-users mailing list archive at Nabble.com.

-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Hello Sean,Thanks for replying.My FS in installed on server and phone is trying to register from other network. I'm using xlite softphone to register in FS.What shoud I do now then? -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040... Sent from the freeswitch-users mailing list archive at Nabble.com.

I don't know what else to tell you, sorry. When I had this problem is was because the router at the other end was not sending the ETERNAL IP Address in the SIP headers. I turned off ALG for sip on that router and everything was fine. Did you try the NDLB settings as others recommended? From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of pratham2013 Sent: Thursday, April 25, 2013 2:38 PM To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] ERROR 404 BAD HEADER Hello Sean, I'm still having this issue as I tried everything. When I try to register with voip.ms account then its working well. I'm not getting 400 bad header but in plae of voip.ms domain if I put my server ip then its giving 400 bad header. I can not debug this so please help me. Thanks Manish Khilwani _____ View this message in context: Re: ERROR 404 BAD HEADER <http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp759004 0p7590127.html> Sent from the freeswitch-users mailing list archive <http://freeswitch-users.2379917.n2.nabble.com/> at Nabble.com.

FYI, you've never supplied SIP traces of the traffic in question. Perhaps there are clues in there. Use pastebin.freeswitch.org and put the pastebin link in this thread. -MC On Thu, Apr 25, 2013 at 12:05 PM, Manish Khilwani <manish.khilwani@gmail.com

wrote:

Hello Sean,

I have tried "aggressive-nat-detection" to true as suggested but no luck. which other NDLB setting required to configure?

*Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079*

On Fri, Apr 26, 2013 at 12:29 AM, Sean Devoy <sdevoy@bizfocused.com>wrote:

...

I don’t know what else to tell you, sorry. When I had this problem is was because the router at the other end was not sending the ETERNAL IP Address in the SIP headers. I turned off ALG for sip on that router and everything was fine.****

** **

Did you try the NDLB settings as others recommended?****

** **

*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *pratham2013 *Sent:* Thursday, April 25, 2013 2:38 PM *To:* freeswitch-users@lists.freeswitch.org *Subject:* Re: [Freeswitch-users] ERROR 404 BAD HEADER****

** **

Hello Sean, I'm still having this issue as I tried everything. When I try to register with voip.ms account then its working well. I'm not getting 400 bad header but in plae of voip.ms domain if I put my server ip then its giving 400 bad header. I can not debug this so please help me. Thanks Manish Khilwani **** ------------------------------

View this message in context: Re: ERROR 404 BAD HEADER<http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040p7590127.html>

Sent from the freeswitch-users mailing list archive<http://freeswitch-users.2379917.n2.nabble.com/>at Nabble.com. ****

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org

I think below is the issue. Contact: <sip:1000@189.234.223.22:10858 :10858;transport=udp;rinstance=44ce69919a41a158> sip:1000@189.234.223.22:10858:10858 => 2 times 10858 port is coming with contact. Still I'm not sure. If you have any idea then please let me know. *Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079* On Fri, Apr 26, 2013 at 1:05 AM, Manish Khilwani <manish.khilwani@gmail.com>wrote:

Hello Michale,

Please below find the link of pastebin.

http://pastebin.freeswitch.org/20834

*Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079*

On Fri, Apr 26, 2013 at 12:43 AM, Michael Collins <msc@freeswitch.org>wrote:

...

FYI, you've never supplied SIP traces of the traffic in question. Perhaps there are clues in there. Use pastebin.freeswitch.org and put the pastebin link in this thread. -MC

On Thu, Apr 25, 2013 at 12:05 PM, Manish Khilwani < manish.khilwani@gmail.com> wrote:

...

Hello Sean,

I have tried "aggressive-nat-detection" to true as suggested but no luck. which other NDLB setting required to configure?

*Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079*

On Fri, Apr 26, 2013 at 12:29 AM, Sean Devoy <sdevoy@bizfocused.com>wrote:

...

I don’t know what else to tell you, sorry. When I had this problem is was because the router at the other end was not sending the ETERNAL IP Address in the SIP headers. I turned off ALG for sip on that router and everything was fine.****

** **

Did you try the NDLB settings as others recommended?****

** **

*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of * pratham2013 *Sent:* Thursday, April 25, 2013 2:38 PM *To:* freeswitch-users@lists.freeswitch.org *Subject:* Re: [Freeswitch-users] ERROR 404 BAD HEADER****

** **

Hello Sean, I'm still having this issue as I tried everything. When I try to register with voip.ms account then its working well. I'm not getting 400 bad header but in plae of voip.ms domain if I put my server ip then its giving 400 bad header. I can not debug this so please help me. Thanks Manish Khilwani **** ------------------------------

View this message in context: Re: ERROR 404 BAD HEADER<http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040p7590127.html>

Sent from the freeswitch-users mailing list archive<http://freeswitch-users.2379917.n2.nabble.com/>at Nabble.com. ****

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Is this our pastebin you're speaking of? If so can you provide me some proof of this? On Apr 25, 2013, at 8:30 PM, Sean Devoy <sdevoy@bizfocused.com> wrote:

I will see if I can contribute. First, if you have not yet, change the default passwords. I get port scans everytime I post addresses in pastebin.

OMG, let me be the first to point out that "SCUM can read too" has nothing to do with the Middle East, only the hackers hitting my system. If anyone interpreted that as a bash on the Middle East I apologize, none was intended. -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Sean Devoy Sent: Friday, April 26, 2013 10:28 AM To: 'FreeSWITCH Users Help' Subject: Re: [Freeswitch-users] ERROR 404 BAD HEADER What kind of proof do you want? I am sure I have some freeswitch logs showing authentication errors. FAILTOBAN was well worth learning about and installing. I even had an earlier post to discuss this. Several people commented about the need to "sanitize" your posts and the name of the program frequently used to attempt the hack ins. Within 24 hours of pasting to your pastebin, I get 3 to 10 hackers trying to login to my switch with common usernames and passwords as well as generated ones. Granted that is not a true "port scan", but it conveys the seriousness of the problem. I now have Class A 3 ip domains in the middle east complete blocked in my iptables because I have no customers there. I am not saying your pastebin is at fault, only that SCUM can read too and this is a good source of targets to attack. -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: Thursday, April 25, 2013 10:15 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] ERROR 404 BAD HEADER Is this our pastebin you're speaking of? If so can you provide me some proof of this? On Apr 25, 2013, at 8:30 PM, Sean Devoy <sdevoy@bizfocused.com> wrote:

I will see if I can contribute. First, if you have not yet, change the default passwords. I get port scans everytime I post addresses in pastebin.

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Within 24 hours of pasting to your pastebin, I get 3 to 10 hackers trying to login to my switch with common usernames and passwords as well as generated ones. Granted that is not a true "port scan", but it conveys the seriousness of the problem. I now have Class A 3 ip domains in the middle east complete blocked in my iptables because I have no customers there.

It's entirely possible (and likely) this is entirely unrelated to any pastebins you might have posted. I see such attempts every single day (which all get rejected)... it's pretty standard given the number of botnets out there scanning for insecure VoIP servers to exploit and abuse. Unless they're specifically targetting someone they're just going to be trying random IPs, not checking out a list. IPv4 address space is small enough that it's trivially easy for a botnet to just pick a random IP to start from and then walk though every possible IP from that point. CPU/bandwidth isn't an issue since it's not the attacker's own, and the botnet means it's parallel enough that it doesn't take prohibitively long either. While grabbing pastebins might get them a few IPs which serve SIP they're not automatically going to be insecure, so walking the address space is likely to be far more fruitful. Sure you can sanitise your pastebins if you want to, but if your server is insecure it's insecure and they're going to happen upon you anyway. I'd spend the time you saved replacing IPs with 'x.x.x.x' by securing your setup (never use default passwords, setup firewalls appropriately, etc) and configuring fail2bin instead (I know you said you already have Sean - that was more generic advice for anyone). -Steve On 26 April 2013 15:27, Sean Devoy <sdevoy@bizfocused.com> wrote:

What kind of proof do you want? I am sure I have some freeswitch logs showing authentication errors. FAILTOBAN was well worth learning about and installing. I even had an earlier post to discuss this. Several people commented about the need to "sanitize" your posts and the name of the program frequently used to attempt the hack ins.

Within 24 hours of pasting to your pastebin, I get 3 to 10 hackers trying to login to my switch with common usernames and passwords as well as generated ones. Granted that is not a true "port scan", but it conveys the seriousness of the problem. I now have Class A 3 ip domains in the middle east complete blocked in my iptables because I have no customers there.

I am not saying your pastebin is at fault, only that SCUM can read too and this is a good source of targets to attack.

-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: Thursday, April 25, 2013 10:15 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] ERROR 404 BAD HEADER

Is this our pastebin you're speaking of? If so can you provide me some proof of this?

On Apr 25, 2013, at 8:30 PM, Sean Devoy <sdevoy@bizfocused.com> wrote:

...

I will see if I can contribute. First, if you have not yet, change the default passwords. I get port scans everytime I post addresses in pastebin.

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Hello Sean, If it is issue with router then it also should not work for the voip.ms account. I can register extension voip.ms but not with my server. Is there anything else do you know which adding port twice in contact header? Thanks Manish Khilwani -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040... Sent from the freeswitch-users mailing list archive at Nabble.com.

This is somewhat speculative, by I think we have evidence that the final OK is received. In the past with NAT issues where the responses are not being received by the client, the CSeq does not get incremented and I get reoccurring "CSeq: 1 REGISTER" packets. Here we see CSeq 1,2,3 (all pefect) and then a CSeq 4 recv starting over that has errors. Since the CSeq increased, I have a firm hypothesis that the Cseq 3 response was received. But I agree a sip trace on the client end would be definitive. From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Michael Collins Sent: Friday, April 26, 2013 2:12 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] ERROR 404 BAD HEADER I think we've established that the device is misbehaving. The only thing I have to wonder about is if the device receives the final 200 OK in the original REG dialog. If it doesn't then I could imagine it "trying harder" by sending registrations to other IP/port combos. (I don't condone that behavior, just that I understand why a device might do that.) Can you get a SIP trace from the device that is attempting to register? It would be extremely helpful for you to see what that device is seeing. -MC On Fri, Apr 26, 2013 at 10:41 AM, pratham2013 <manish.khilwani@gmail.com> wrote: Hello Sean, If it is issue with router then it also should not work for the voip.ms account. I can register extension voip.ms but not with my server. Is there anything else do you know which adding port twice in contact header? Thanks Manish Khilwani -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040 p7590182.html Sent from the freeswitch-users mailing list archive at Nabble.com. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org

Hello Brian,Please give me your email id so I can give you login credentials.ThanksManish Khilwani -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040... Sent from the freeswitch-users mailing list archive at Nabble.com.

Well, I'm not entirely sure what's going on here other than the fact that your device keeps trying to send a REGISTER even after it has successfully registered. The first four packets in the capture look normal/good: Recv: REGISTER Send: 401 Auth Required Recv: REGISTER with auth header Send: 200 OK At that point your device should be happy, yet it continues to send REGISTER packets. This could be a broken NAT device in between FS and your SIP device (more likely) or a broken SIP device (less likely, but still possible). I would try accessing your server from a different location with a different NAT device, or even better, without NAT at all on the SIP device side, and see what happens. Do you know what kind of NAT device is at the location where the SIP device is? -MC On Thu, Apr 25, 2013 at 12:35 PM, Manish Khilwani <manish.khilwani@gmail.com

wrote:

Hello Michale,

Please below find the link of pastebin.

http://pastebin.freeswitch.org/20834

*Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079*

On Fri, Apr 26, 2013 at 12:43 AM, Michael Collins <msc@freeswitch.org>wrote:

...

FYI, you've never supplied SIP traces of the traffic in question. Perhaps there are clues in there. Use pastebin.freeswitch.org and put the pastebin link in this thread. -MC

On Thu, Apr 25, 2013 at 12:05 PM, Manish Khilwani < manish.khilwani@gmail.com> wrote:

...

Hello Sean,

I have tried "aggressive-nat-detection" to true as suggested but no luck. which other NDLB setting required to configure?

*Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: manish.khilwani@gmail.com MSN : manish.khilwani@hotmail.com Phone : 919099923079*

On Fri, Apr 26, 2013 at 12:29 AM, Sean Devoy <sdevoy@bizfocused.com>wrote:

...

I don’t know what else to tell you, sorry. When I had this problem is was because the router at the other end was not sending the ETERNAL IP Address in the SIP headers. I turned off ALG for sip on that router and everything was fine.****

** **

Did you try the NDLB settings as others recommended?****

** **

*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of * pratham2013 *Sent:* Thursday, April 25, 2013 2:38 PM *To:* freeswitch-users@lists.freeswitch.org *Subject:* Re: [Freeswitch-users] ERROR 404 BAD HEADER****

** **

Hello Sean, I'm still having this issue as I tried everything. When I try to register with voip.ms account then its working well. I'm not getting 400 bad header but in plae of voip.ms domain if I put my server ip then its giving 400 bad header. I can not debug this so please help me. Thanks Manish Khilwani **** ------------------------------

View this message in context: Re: ERROR 404 BAD HEADER<http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040p7590127.html>

Sent from the freeswitch-users mailing list archive<http://freeswitch-users.2379917.n2.nabble.com/>at Nabble.com. ****

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org

On Thu, Apr 25, 2013 at 1:20 PM, pratham2013 <manish.khilwani@gmail.com>wrote:

Hello Michael,

Thanks for replying but can you tell me how can I find which NAT device at my location?

Not without you sending me a plane ticket. :) Talk to your network admin person and see if he/she knows. -MC

* Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: [hidden email]<http://user/SendEmail.jtp?type=node&node=7590138&i=0> MSN : [hidden email]<http://user/SendEmail.jtp?type=node&node=7590138&i=1> Phone : 919099923079*

On Fri, Apr 26, 2013 at 1:46 AM, mercutioviz [via freeswitch-users] <[hidden email] <http://user/SendEmail.jtp?type=node&node=7590138&i=2>> wrote:

...

Well, I'm not entirely sure what's going on here other than the fact that your device keeps trying to send a REGISTER even after it has successfully registered. The first four packets in the capture look normal/good: Recv: REGISTER Send: 401 Auth Required Recv: REGISTER with auth header Send: 200 OK

At that point your device should be happy, yet it continues to send REGISTER packets. This could be a broken NAT device in between FS and your SIP device (more likely) or a broken SIP device (less likely, but still possible). I would try accessing your server from a different location with a different NAT device, or even better, without NAT at all on the SIP device side, and see what happens.

Do you know what kind of NAT device is at the location where the SIP device is? -MC

On Thu, Apr 25, 2013 at 12:35 PM, Manish Khilwani <[hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=0>

...

wrote:

...

Hello Michale,

Please below find the link of pastebin.

http://pastebin.freeswitch.org/20834

* Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: [hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=1> MSN : [hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=2> Phone : 919099923079*

On Fri, Apr 26, 2013 at 12:43 AM, Michael Collins <[hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=3>

...

wrote:

...

FYI, you've never supplied SIP traces of the traffic in question. Perhaps there are clues in there. Use pastebin.freeswitch.org and put the pastebin link in this thread. -MC

On Thu, Apr 25, 2013 at 12:05 PM, Manish Khilwani <[hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=4>

...

wrote:

...

Hello Sean,

I have tried "aggressive-nat-detection" to true as suggested but no luck. which other NDLB setting required to configure?

* Thanks ===================== Manish Khilwani Skype: manish_khilwani Gmail: [hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=5> MSN : [hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=6> Phone : 919099923079*

On Fri, Apr 26, 2013 at 12:29 AM, Sean Devoy <[hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=7>

...

wrote:

...

I don’t know what else to tell you, sorry. When I had this problem is was because the router at the other end was not sending the ETERNAL IP Address in the SIP headers. I turned off ALG for sip on that router and everything was fine.****

** **

Did you try the NDLB settings as others recommended?****

** **

*From:* [hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=8>[mailto:[hidden email] <http://user/SendEmail.jtp?type=node&node=7590136&i=9>] *On Behalf Of *pratham2013

*Sent:* Thursday, April 25, 2013 2:38 PM *To:* [hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=10>

*Subject:* Re: [Freeswitch-users] ERROR 404 BAD HEADER****

** **

Hello Sean, I'm still having this issue as I tried everything. When I try to register with voip.ms account then its working well. I'm not getting 400 bad header but in plae of voip.ms domain if I put my server ip then its giving 400 bad header. I can not debug this so please help me. Thanks Manish Khilwani **** ------------------------------

View this message in context: Re: ERROR 404 BAD HEADER<http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040p7590127.html>

Sent from the freeswitch-users mailing list archive<http://freeswitch-users.2379917.n2.nabble.com/>at Nabble.com. ****

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: [hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=11>

http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list [hidden email]<http://user/SendEmail.jtp?type=node&node=7590136&i=12>

http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: [hidden email] <http://user/SendEmail.jtp?type=node&node=7590136&i=13>

http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list [hidden email] <http://user/SendEmail.jtp?type=node&node=7590136&i=14>

http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: [hidden email] <http://user/SendEmail.jtp?type=node&node=7590136&i=15>

http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list [hidden email] <http://user/SendEmail.jtp?type=node&node=7590136&i=16>

http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: [hidden email] <http://user/SendEmail.jtp?type=node&node=7590136&i=17>

http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list [hidden email] <http://user/SendEmail.jtp?type=node&node=7590136&i=18>

http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: [hidden email] <http://user/SendEmail.jtp?type=node&node=7590136&i=19> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list [hidden email] <http://user/SendEmail.jtp?type=node&node=7590136&i=20> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

------------------------------ If you reply to this email, your message will be added to the discussion below:

http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040... To unsubscribe from ERROR 404 BAD HEADER, click here. NAML<http://freeswitch-users.2379917.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>

------------------------------ View this message in context: Re: ERROR 404 BAD HEADER<http://freeswitch-users.2379917.n2.nabble.com/ERROR-404-BAD-HEADER-tp7590040p7590138.html> Sent from the freeswitch-users mailing list archive<http://freeswitch-users.2379917.n2.nabble.com/>at Nabble.com.

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org