Hello, Since last few days my freeswitch server receives SPAM calls. 25 to 30 calls at the same time. It makes my mod_managed program crash. Unlike regular phone numbers in US, these seem to come from sip IP addresses. When I see location of these IP addresses, most of them seem to be from China. Sample from CDR: <caller_profile> <username>sip</username> <dialplan>XML</dialplan> <caller_id_name>sip</caller_id_name> <ani></ani> <aniii></aniii> <caller_id_number>sip</caller_id_number> <network_addr>113.105.152.220</network_addr> <rdnis>1442073479999</rdnis> <destination_number>1056</destination_number> <uuid>bef84579-d25a-ab4b-aa52-dbcf9d7509be</uuid> <source>mod_sofia</source> <context>default</context> <chan_name>sofia/sipinterface_1/sip@113.105.152.220</chan_name> </caller_profile> I am only expecting call from regular phone lines from USA. I use Vitelity and I have secured my Vitelity configuration (SOFIA) with secret code provided by them. How do I stop these anonymous SIP callers from crashing my system? Please help. Thank you.
Well you're using FreePBX right? The only corse of action you have is to find out why its crashing and reporting the issue on our Jira. Without any more info to go on you're SOL. http://www.google.com/search?hl=en&client=safari&rls=en&defl=en&q=define:Vis... /b On Aug 23, 2010, at 2:19 PM, Malay Thakershi wrote:
Hello,
Since last few days my freeswitch server receives SPAM calls. 25 to 30 calls at the same time. It makes my mod_managed program crash.
Unlike regular phone numbers in US, these seem to come from sip IP addresses. When I see location of these IP addresses, most of them seem to be from China.
Sample from CDR: <caller_profile> <username>sip</username> <dialplan>XML</dialplan> <caller_id_name>sip</caller_id_name> <ani></ani> <aniii></aniii> <caller_id_number>sip</caller_id_number> <network_addr>113.105.152.220</network_addr> <rdnis>1442073479999</rdnis> <destination_number>1056</destination_number> <uuid>bef84579-d25a-ab4b-aa52-dbcf9d7509be</uuid> <source>mod_sofia</source> <context>default</context> <chan_name>sofia/sipinterface_1/sip@113.105.152.220</chan_name> </caller_profile>
I am only expecting call from regular phone lines from USA. I use Vitelity and I have secured my Vitelity configuration (SOFIA) with secret code provided by them.
How do I stop these anonymous SIP callers from crashing my system?
Please help.
Thank you.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Brian he can't add an ACL with FreePBX ? David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34 Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur. Le 23/08/2010 à 21:26, Brian West a écrit :
Well you're using FreePBX right? The only corse of action you have is to find out why its crashing and reporting the issue on our Jira. Without any more info to go on you're SOL.
http://www.google.com/search?hl=en&client=safari&rls=en&defl=en&q=define:Vis...
/b
On Aug 23, 2010, at 2:19 PM, Malay Thakershi wrote:
Hello,
Since last few days my freeswitch server receives SPAM calls. 25 to 30 calls at the same time. It makes my mod_managed program crash.
Unlike regular phone numbers in US, these seem to come from sip IP addresses. When I see location of these IP addresses, most of them seem to be from China.
Sample from CDR: <caller_profile> <username>sip</username> <dialplan>XML</dialplan> <caller_id_name>sip</caller_id_name> <ani></ani> <aniii></aniii> <caller_id_number>sip</caller_id_number> <network_addr>113.105.152.220</network_addr> <rdnis>1442073479999</rdnis> <destination_number>1056</destination_number> <uuid>bef84579-d25a-ab4b-aa52-dbcf9d7509be</uuid> <source>mod_sofia</source> <context>default</context> <chan_name>sofia/sipinterface_1/sip@113.105.152.220</chan_name> </caller_profile>
I am only expecting call from regular phone lines from USA. I use Vitelity and I have secured my Vitelity configuration (SOFIA) with secret code provided by them.
How do I stop these anonymous SIP callers from crashing my system?
Please help.
Thank you.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
David, No Clue, Never Used It, Can't Say... /b On Aug 23, 2010, at 2:32 PM, David Ponzone wrote:
Brian
he can't add an ACL with FreePBX ?
David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34
Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com
Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.
Le 23/08/2010 à 21:26, Brian West a écrit :
Well you're using FreePBX right? The only corse of action you have is to find out why its crashing and reporting the issue on our Jira. Without any more info to go on you're SOL.
http://www.google.com/search?hl=en&client=safari&rls=en&defl=en&q=define:Vis...
/b
I am going through documentation but seems iptables can eliminate calls being made on ports other than required ones. But my server is Windows. How do I run iptables command? Also, could you tell me if I block all incoming ports other than 5060 and 5061, will my regular inbound calls work? Thank you. 2010/8/23 Brian West <brian@freeswitch.org>
David, No Clue, Never Used It, Can't Say...
/b
On Aug 23, 2010, at 2:32 PM, David Ponzone wrote:
Brian
he can't add an ACL with FreePBX ?
David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34
Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com
Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.
Le 23/08/2010 à 21:26, Brian West a écrit :
Well you're using FreePBX right? The only corse of action you have is to find out why its crashing and reporting the issue on our Jira. Without any more info to go on you're SOL.
http://www.google.com/search?hl=en&client=safari&rls=en&defl=en&q=define:Vis...
/b
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
If I understand correctly, you expect calls form PSTN, so only from the known IPs of your provider ? You can then filter all other IPs going to your port X (5060, 5080, your mileage may vary). Also, a call coming to a port you don't use (so not opened) should not have ANY impact. It should not even hit the dialplan. it should be rejected with ICMP port unreachable by the Windows TCP/IP stack. David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34 Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur. Le 23/08/2010 à 21:47, Malay Thakershi a écrit :
I am going through documentation but seems iptables can eliminate calls being made on ports other than required ones.
But my server is Windows. How do I run iptables command?
Also, could you tell me if I block all incoming ports other than 5060 and 5061, will my regular inbound calls work?
Thank you.
2010/8/23 Brian West <brian@freeswitch.org> David, No Clue, Never Used It, Can't Say...
/b
On Aug 23, 2010, at 2:32 PM, David Ponzone wrote:
Brian
he can't add an ACL with FreePBX ?
David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34
Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com
Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.
Le 23/08/2010 à 21:26, Brian West a écrit :
Well you're using FreePBX right? The only corse of action you have is to find out why its crashing and reporting the issue on our Jira. Without any more info to go on you're SOL.
http://www.google.com/search?hl=en&client=safari&rls=en&defl=en&q=define:Vis...
/b
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
That is true. So do I block all other IP in my firewall? Or do I configure that in FreeSwitch? Also, How can be sure my provider's IP to remain same? (I use vitelity) Please let me know. On Mon, Aug 23, 2010 at 3:03 PM, David Ponzone <david.ponzone@ipeva.fr>wrote:
If I understand correctly, you expect calls form PSTN, so only from the known IPs of your provider ? You can then filter all other IPs going to your port X (5060, 5080, your mileage may vary).
Also, a call coming to a port you don't use (so not opened) should not have ANY impact. It should not even hit the dialplan. it should be rejected with ICMP port unreachable by the Windows TCP/IP stack.
David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34
Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com
*Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. **IPeva** décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.* * *
Le 23/08/2010 à 21:47, Malay Thakershi a écrit :
I am going through documentation but seems iptables can eliminate calls being made on ports other than required ones.
But my server is Windows. How do I run iptables command?
Also, could you tell me if I block all incoming ports other than 5060 and 5061, will my regular inbound calls work?
Thank you.
2010/8/23 Brian West <brian@freeswitch.org>
David, No Clue, Never Used It, Can't Say...
/b
On Aug 23, 2010, at 2:32 PM, David Ponzone wrote:
Brian
he can't add an ACL with FreePBX ?
David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34
Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com
Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.
Le 23/08/2010 à 21:26, Brian West a écrit :
Well you're using FreePBX right? The only corse of action you have is to find out why its crashing and reporting the issue on our Jira. Without any more info to go on you're SOL.
http://www.google.com/search?hl=en&client=safari&rls=en&defl=en&q=define:Vis...
/b
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
You should do that in your firewall. The quicker you filter, the better. I would not care much about the RTP traffic. So you need to filter SIP. And I would really don't think Vitelity is going to change the IP of their softswitch/SBC very often, and if they do, they should tell you. If Vitelity's IP is X and your SIP port is 5060, what you should do as filters is: allow UDP from X to yourIP:5060 (this will match SIP packets coming from Vitelity) deny UDP from all to yourIP:5060 (this will match malicious SIP packets) allow UDP from all to all (this will match the RTP traffic and other UDP traffic) and then add your other usual filters David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34 Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur. Le 23/08/2010 à 23:11, Malay Thakershi a écrit :
That is true. So do I block all other IP in my firewall? Or do I configure that in FreeSwitch? Also, How can be sure my provider's IP to remain same? (I use vitelity)
Please let me know.
On Mon, Aug 23, 2010 at 3:03 PM, David Ponzone <david.ponzone@ipeva.fr> wrote: If I understand correctly, you expect calls form PSTN, so only from the known IPs of your provider ? You can then filter all other IPs going to your port X (5060, 5080, your mileage may vary).
Also, a call coming to a port you don't use (so not opened) should not have ANY impact. It should not even hit the dialplan. it should be rejected with ICMP port unreachable by the Windows TCP/ IP stack.
David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34
Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com
Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.
Le 23/08/2010 à 21:47, Malay Thakershi a écrit :
I am going through documentation but seems iptables can eliminate calls being made on ports other than required ones.
But my server is Windows. How do I run iptables command?
Also, could you tell me if I block all incoming ports other than 5060 and 5061, will my regular inbound calls work?
Thank you.
2010/8/23 Brian West <brian@freeswitch.org> David, No Clue, Never Used It, Can't Say...
/b
On Aug 23, 2010, at 2:32 PM, David Ponzone wrote:
Brian
he can't add an ACL with FreePBX ?
David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34
Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com
Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.
Le 23/08/2010 à 21:26, Brian West a écrit :
Well you're using FreePBX right? The only corse of action you have is to find out why its crashing and reporting the issue on our Jira. Without any more info to go on you're SOL.
http://www.google.com/search?hl=en&client=safari&rls=en&defl=en&q=define:Vis...
/b
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thank you. Could you please share your configuration section from the two files? I tried what you suggested. I put another IP as my ACL (which should be rejected) but it goes through. So 41.XXX is not the IP I am calling from but it connects me anyway. acl.conf.xml ----------------- <configuration name="acl.conf" description="Network Lists"> <network-lists> <!-- These ACL's are automatically created on startup. --> <list name="lan" default="allow"> <node type="deny" cidr="192.168.42.0/24"/> <node type="allow" cidr="192.168.42.42/32"/> </list> <!-- 08232010 Allow only inbound from vitelity IP --> <list name="localnet.auto" default="allow"> <node type="allow" cidr="41.XXX.XXX.XXX/29"/> </list> <!-- This will traverse the directory adding all users with the cidr= tag to this ACL, when this ACL matches the users variables and params apply as if they digest authenticated. --> <list name="domains" default="deny"> <node type="allow" domain="$${domain}"/> </list> </network-lists> </configuration> ------------- Base_Settings.xml file under sip_profiles folder: <include> <profile name="sipinterface_1"> <domains> <domain name="all" alias="true" parse="true"/> </domains> <settings> <param name="rtp-ip" value="XY.XY.XY.XY"/> <param name="sip-ip" value="XY.XY.XY.XY"/> <param name="ext-rtp-ip" value="XY.XY.XY.XY"/> <param name="ext-sip-ip" value="XY.XY.XY.XY"/> <param name="sip-port" value="5060"/> <param name="auth-calls" value="false"/> <param name="context" value="inbound"/> <!-- 08232010 Allow only inbound from vitelity IP --> <param name="local-network-acl" value="localnet.auto"/> <param name="apply-inbound-acl" value="localnet.auto"/> </settings> </profile> </include> ----------------- Please let me know what am I doing wrong or missing? Thank you. On Mon, Aug 23, 2010 at 6:00 PM, Victor Chukalovskiy <Victor@isptelecom.net>wrote:
Malay,
I use apply-inbound-acl="providers" in my sip profile. Then I define my providers IP addresses in ACL "providers" (within acl.conf.xml) This way all other IPs are forced to authorize in order to place calls through. Why bother with firewall if freeswitch has built-in ACL functionality?
Regards, Victor
On -10/01/37 02:59 PM, David Ponzone wrote:
You should do that in your firewall. The quicker you filter, the better.
I would not care much about the RTP traffic. So you need to filter SIP. And I would really don't think Vitelity is going to change the IP of their softswitch/SBC very often, and if they do, they should tell you.
If Vitelity's IP is X and your SIP port is 5060, what you should do as filters is: allow UDP from X to yourIP:5060 (this will match SIP packets coming from Vitelity) deny UDP from all to yourIP:5060 (this will match malicious SIP packets) allow UDP from all to all (this will match the RTP traffic and other UDP traffic) and then add your other usual filters
David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34
Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com
*Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. **IPeva** décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.* * *
Le 23/08/2010 à 23:11, Malay Thakershi a écrit :
That is true. So do I block all other IP in my firewall? Or do I configure that in FreeSwitch? Also, How can be sure my provider's IP to remain same? (I use vitelity)
Please let me know.
On Mon, Aug 23, 2010 at 3:03 PM, David Ponzone <david.ponzone@ipeva.fr>wrote:
If I understand correctly, you expect calls form PSTN, so only from the known IPs of your provider ? You can then filter all other IPs going to your port X (5060, 5080, your mileage may vary).
Also, a call coming to a port you don't use (so not opened) should not have ANY impact. It should not even hit the dialplan. it should be rejected with ICMP port unreachable by the Windows TCP/IP stack.
David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34
Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com
*Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. **IPeva** décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.* * *
Le 23/08/2010 à 21:47, Malay Thakershi a écrit :
I am going through documentation but seems iptables can eliminate calls being made on ports other than required ones.
But my server is Windows. How do I run iptables command?
Also, could you tell me if I block all incoming ports other than 5060 and 5061, will my regular inbound calls work?
Thank you.
2010/8/23 Brian West <brian@freeswitch.org>
David, No Clue, Never Used It, Can't Say...
/b
On Aug 23, 2010, at 2:32 PM, David Ponzone wrote:
Brian
he can't add an ACL with FreePBX ?
David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34
Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com
Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.
Le 23/08/2010 à 21:26, Brian West a écrit :
Well you're using FreePBX right? The only corse of action you have is to find out why its crashing and reporting the issue on our Jira. Without any more info to go on you're SOL.
http://www.google.com/search?hl=en&client=safari&rls=en&defl=en&q=define:Vis...
/b
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Not a problem. Thanks for help. Will test as you've suggested. On Aug 23, 2010 8:33 PM, "Victor Chukalovskiy" <Victor@isptelecom.net> wrote: Malay, I believe full configuration is too big to be posted here, however my sip profile has following relevant lines: <param name="auth-calls" value="true"/> <param name="apply-inbound-acl" value="providers"/> My acl.conf.xml has following lines: <list name="providers" default="deny"> <node type="allow" cidr="A.B.C.D/24 <http://192.168.42.0/24>"/> </list> As you see, this creates a simple ACL that will "deny" everything but address range defined by A.B.C.D/24 My sip profile makes use of this ACL. In your configuration you seem to miss a couple things: 1) You use reserved ACL name acl.auto. Please use something else and non-default. 2) If your ACL is "deny" by default, all nodes should be "allow". And vice verse, if your ACL is "allow" by default then nodes only make sence if they are set to "deny". This depends on what your want to do :-) In your case try: <list name="Malay_ACL" default="allow"> <node type="allow" cidr="41.XXX.XXX.XXX/29"/> </list> And then point apply-inbound-acl to this new "Malay_ACL". It could be useful to consult following pages: http://wiki.freeswitch.org/wiki/Acl http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing -Victor On -10/01/37 02:59 PM, Malay Thakershi wrote:
Thank you. Could you please share your configura...
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Victor, your solution seems to be working. Thank you and thank you all for help. I did the following: acl.conf.xml <list name="Malay_ACL" default="deny"> <node type="allow" cidr="A.B.C.D/24 <http://192.168.42.0/24>"/> </list> In my sip profile file: <param name="auth-calls" value="true"/> <param name="apply-inbound-acl" value="Malay_ACL"/> Thank you. On Tue, Aug 24, 2010 at 9:39 AM, Malay Thakershi <mthakershi@gmail.com>wrote:
Not a problem. Thanks for help.
Will test as you've suggested.
On Aug 23, 2010 8:33 PM, "Victor Chukalovskiy" <Victor@isptelecom.net> wrote:
Malay,
I believe full configuration is too big to be posted here, however my sip profile has following relevant lines:
<param name="auth-calls" value="true"/> <param name="apply-inbound-acl" value="providers"/>
My acl.conf.xml has following lines:
<list name="providers" default="deny"> <node type="allow" cidr="A.B.C.D/24 <http://192.168.42.0/24>"/> </list>
As you see, this creates a simple ACL that will "deny" everything but address range defined by A.B.C.D/24 My sip profile makes use of this ACL.
In your configuration you seem to miss a couple things: 1) You use reserved ACL name acl.auto. Please use something else and non-default. 2) If your ACL is "deny" by default, all nodes should be "allow". And vice verse, if your ACL is "allow" by default then nodes only make sence if they are set to "deny". This depends on what your want to do :-)
In your case try:
<list name="Malay_ACL" default="allow">
<node type="allow" cidr="41.XXX.XXX.XXX/29"/> </list> And then point apply-inbound-acl to this new "Malay_ACL".
It could be useful to consult following pages: http://wiki.freeswitch.org/wiki/Acl http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing
-Victor
On -10/01/37 02:59 PM, Malay Thakershi wrote:
Thank you. Could you please share your configura...
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org on behalf of Malay Thakershi Sent: Mon 8/23/2010 3:19 PM To: freeswitch-users@lists.freeswitch.org Subject: [Freeswitch-users] How to stop SPAM calls? Hello, Since last few days my freeswitch server receives SPAM calls. 25 to 30 calls at the same time. It makes my mod_managed program crash. Unlike regular phone numbers in US, these seem to come from sip IP addresses. When I see location of these IP addresses, most of them seem to be from China. Sample from CDR: <caller_profile> <username>sip</username> <dialplan>XML</dialplan> <caller_id_name>sip</caller_id_name> <ani></ani> <aniii></aniii> <caller_id_number>sip</caller_id_number> <network_addr>113.105.152.220</network_addr> <rdnis>1442073479999</rdnis> <destination_number>1056</destination_number> <uuid>bef84579-d25a-ab4b-aa52-dbcf9d7509be</uuid> <source>mod_sofia</source> <context>default</context> <chan_name>sofia/sipinterface_1/sip@113.105.152.220</chan_name> </caller_profile> I am only expecting call from regular phone lines from USA. I use Vitelity and I have secured my Vitelity configuration (SOFIA) with secret code provided by them. How do I stop these anonymous SIP callers from crashing my system? Please help. Thank you. google for sipvisious. they also have a (python 25) based program that might intercept these and block them (crashing THEIR system) ______________________________________________________________________ This email has been scanned and certified safe by SpammerTrap(r). For Information please see http://www.secnap.com/products/spammertrap/ ______________________________________________________________________
I am checking sipvisious. A correction: freeswitch doesn't crash. Program I have written in mod_managed on receiving calls does crash (probably due to issue with my code). 1. I would like to stop calls from being answered. That would be ideal. May be sipvisious can help. I am checking. 2. If in short term I can do something from my code, such as checking port/caller id, and then not going through the prompt (my app) process. How can I do that? Thank you. On Mon, Aug 23, 2010 at 2:53 PM, Brian West <brian@freeswitch.org> wrote:
Lets not land the lad in prison mmmkay. Things like this sound highly illegal.
/b
On Aug 23, 2010, at 2:30 PM, Michael Scheidell wrote:
google for sipvisious. they also have a (python 25) based program that might intercept these and block them (crashing THEIR system)
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Le Mon, 23 Aug 2010 14:19:29 -0500, Malay Thakershi <mthakershi@gmail.com> a écrit :
Unlike regular phone numbers in US, these seem to come from sip IP addresses. When I see location of these IP addresses, most of them seem to be from China. ... I am only expecting call from regular phone lines from USA. I use Vitelity and I have secured my Vitelity configuration (SOFIA) with secret code provided by them.
How do I stop these anonymous SIP callers from crashing my system?
The crash isn't normal, file a bug. There are some ways to do what you want. First: you could refuse anonymous calls (but it might be a no-no in your job.) Faster: forbid (drop, not reject) the whole IP adresses range that bothers you to at the firewall level (113.96.0.0 - 113.111.255.255) Other: may be there's another possibility into FS but the former is still faster as it instantly refuse the connexion instead sending it to FS thus eating CPU to do that. Last: Crack defense computers and nuke China. --
participants (6)
-
Brian West
-
David Ponzone
-
Jean-Yves F. Barbier
-
Malay Thakershi
-
Michael Scheidell
-
Victor Chukalovskiy