Re: [Freeswitch-users] connexion attempts behing a firewall (wtf?)
If you get USER_NOT_REGISTERED, that means that the user is not registered. Please do a "show registrations", and you will see who is registered to your server. Also - if you want to disable NAT for now (and don't let FS punch holes in your fw) you can also start FS using the "-nonat" switch. /Peter -----Ursprungligt meddelande----- Från: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] För Bzzz Skickat: den 12 mars 2012 00:39 Till: freeswitch-users@lists.freeswitch.org Ämne: Re: [Freeswitch-users] connexion attempts behing a firewall (wtf?) On Sun, 11 Mar 2012 19:21:01 -0400 Brian Foster <bdfoster@endigotech.com> wrote:
This happens all the time. You need fail2ban set up properly. There are articles on both the freeswitch and fusionpbx wikis.
It is, and tested as the wiki says:) but attacker isn't banned. This show me this is also linked to my previous post: softphones & fusionpbx say they're registered, but when I try to make a call between them FS throw me USER_NOT_REGISTERED errors, this is why the attacker's not jettisoned: FS don't seem to answer to a correct registration:(
I run a public server and I get people doing scans all the time. Does it worry me? No. Of course not. That's what fail2ban and other measures are for.
Interesting, could you describe "other measures", PLS? -- Draft beer, not boys! _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org !DSPAM:4f5da5e232761141321256!
On Mon, 12 Mar 2012 13:52:54 +0000 Peter Olsson <peter.olsson@visionutveckling.se> wrote: Hi Peter,
If you get USER_NOT_REGISTERED, that means that the user is not registered. Please do a "show registrations", and you will see who is registered to your server.
Thanks, that's exactly the command I was looking after! (but I missed the final 's'). show registrations reg_user,realm,token,url,expires,network_ip,network_port,network_proto,hostname 01,192.168.1.25,yeveyyihyxqvepr@anubis.defcon1,sofia/internal/sip:01@192.168.1.25:5000,1331565571,192.168.1.25,5000,udp,anubis 02,192.168.1.25,tufsyqgvkshuonx@osiris.defcon1,sofia/internal/sip:02@192.168.1.50:5100,1331565589,192.168.1.50,5100,udp,anubis 2 total. So, it seems that my 2 softphone are correctly registered, which is in accordance w/ what fusionpbx and the phones says; I guess the strange string before machines' names is normal. Raaaaaaaahhhhhhhh!
Also - if you want to disable NAT for now (and don't let FS punch holes in your fw) you can also start FS using the "-nonat" switch.
Yeah, Patrick sent me a useful link about Auto_NAT. As a matter of fact my PB is coming from the box itself: once some uPNP forwards have been set, I can't get rid about them, even disabling uPNP don't work; I'm obliged to disable uPNP AND reboot the box to do that, thanks to sagem:(( (after disabling, it tells that Nb of rules is 0, though) So, this is my solution: keep ADSL box non-uPNP until FS conf is cooked "aux petits oignons":) But the most "interesting" thing is those forwards lead to someone in Brazil trying to authenticate, but fail2ban failed to ban him because there was no "auth failure" answer from FS - However, when I tested it from my LAN, I was forbidden access after 3 unsuccessful registration attempts. I'm a bit lost at this point: both phone registered and still no communication possible (forgot to say: I fall directly to the VM message when trying that.) Jean-Yves -- Q: What's meaner than a pit bull with AIDS? A: The guy that gave it to him.
On Mon, 12 Mar 2012 15:37:54 +0100 Bzzz <lazyvirus@gmx.com> wrote: Sorry for the off-topic, but I experience something strange: I sent this one @ 15:37 local (+0100) and just received it from the mailing list - does anybody have the same delay, or is it gmx.com that play it slooow? JY -- Losing your faith is a lot like losing your virginity you don't realise how irritating it was 'til it's gone.
On Mon, 12 Mar 2012 15:37:54 +0100 Bzzz <lazyvirus@gmx.com> wrote: The chair/keyboard interface had a flaw: some FusionPBX xmls were missing as the installation was manual. JY -- I'd like to meet the man who invented sex and see what he's working on now.
participants (2)
-
Bzzz
-
Peter Olsson