Re: [Freeswitch-users] Question about SIP security
I also see a lot of attempts to connect to 5060, but it looks like a botnet since I never have more than 1 form 1 IP - Here fail2ban is helpless since attempts per IP limit is never reached.
-------- Оригинално писмо -------- От: Patrick Lists Относно: Re: [Freeswitch-users] Question about SIP security До: FreeSWITCH Users Help Изпратено на: Петък, 2010, Юли 30 20:54:49 EEST
On 07/30/2010 05:56 PM, Mike van Lammeren wrote: [snip]
This is probably not the forum for it, but anyone reading this might want to check their traffic for this IP: 61.164.41.144
Hi Mike,
I see something similar although not from the same IP address. For weeks now I get a lot of SIP connections all from China. The easiest solution (for me) was to install fail2ban, configure, fire and forget. Kinda fun to watch them get blocked if y're bored :)
Regards, Patrick
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On 07/31/2010 01:54 PM, Hristo Benev wrote:
I also see a lot of attempts to connect to 5060, but it looks like a botnet since I never have more than 1 form 1 IP - Here fail2ban is helpless since attempts per IP limit is never reached.
Unless you set the number of failed attempts to 1. If it fits your application you can also use something like http://www.ipdeny.com/ to block port 5060 for certain countries. Regards, Patrick
Thank you, everyone, for your suggestions. Both Fail2Ban.org and IPDeny.com are good solutions. Mike van Lammeren On Sat, Jul 31, 2010 at 9:42 AM, Patrick Lists < freeswitch-list@puzzled.xs4all.nl> wrote:
On 07/31/2010 01:54 PM, Hristo Benev wrote:
I also see a lot of attempts to connect to 5060, but it looks like a
botnet since I never have more than 1 form 1 IP - Here fail2ban is helpless since attempts per IP limit is never reached.
Unless you set the number of failed attempts to 1.
If it fits your application you can also use something like http://www.ipdeny.com/ to block port 5060 for certain countries.
Regards, Patrick
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (3)
-
Hristo Benev
-
Mike van Lammeren
-
Patrick Lists