Hello Philippe, The idea I am currently working towards implementing is : - SIP Origination / Inbound SIP = IP range ACL with carrier - User Origination / Devlivery = OpenVPN + SNOM Handsets (they have a built-in OpenVPN client, quite cool !) You can lock down OpenVPN quite tight so it hardly reponds at all to unauthorised requests. I have only just started my testing, but other than some issues with inbound calls and multiple profiles that I'm trying to iron out at the moment, everything seems to be working ok. Bob
wow! Not sure I understood all I am afraid. - SIP Origination / Inbound SIP = IP range ACL with carrier Does the above mean to find out the ip of the SIP provider I use and only authorising these ones? /Philippe On 7 February 2012 09:47, Bob Smith <gb10hkzo-freeswitch@yahoo.co.uk> wrote:
Hello Philippe,
The idea I am currently working towards implementing is :
- SIP Origination / Inbound SIP = IP range ACL with carrier - User Origination / Devlivery = OpenVPN + SNOM Handsets (they have a built-in OpenVPN client, quite cool !)
You can lock down OpenVPN quite tight so it hardly reponds at all to unauthorised requests.
I have only just started my testing, but other than some issues with inbound calls and multiple profiles that I'm trying to iron out at the moment, everything seems to be working ok.
Bob
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Just check out the FS wiki for Fail2Ban... What many of you are probably seeing is a SipVicious brute force attack... Fail2Ban will greatly reduce those problems K On 2/7/12 8:54 AM, "Philippe Le Toquin" <philippe@ppmt.org> wrote:
wow!
Not sure I understood all I am afraid.
- SIP Origination / Inbound SIP = IP range ACL with carrier
Does the above mean to find out the ip of the SIP provider I use and only authorising these ones?
/Philippe
On 7 February 2012 09:47, Bob Smith <gb10hkzo-freeswitch@yahoo.co.uk> wrote:
Hello Philippe,
The idea I am currently working towards implementing is :
- SIP Origination / Inbound SIP = IP range ACL with carrier - User Origination / Devlivery = OpenVPN + SNOM Handsets (they have a built-in OpenVPN client, quite cool !)
You can lock down OpenVPN quite tight so it hardly reponds at all to unauthorised requests.
I have only just started my testing, but other than some issues with inbound calls and multiple profiles that I'm trying to iron out at the moment, everything seems to be working ok.
Bob
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Actually I already have fail2ban installed and it does block the IP correctly but my main issue is that in Canada we don't have unlimited internet and this is eating 6Gig per day out of my 50Gig monthly :( I am going to change the IP of my router so that the request will no longer reach me but eventually he will find me back unless I can make myself more invisible. On 7 February 2012 09:58, Ken Rice <krice@freeswitch.org> wrote:
Just check out the FS wiki for Fail2Ban...
What many of you are probably seeing is a SipVicious brute force attack... Fail2Ban will greatly reduce those problems
K
On 2/7/12 8:54 AM, "Philippe Le Toquin" <philippe@ppmt.org> wrote:
wow!
Not sure I understood all I am afraid.
- SIP Origination / Inbound SIP = IP range ACL with carrier
Does the above mean to find out the ip of the SIP provider I use and only authorising these ones?
/Philippe
On 7 February 2012 09:47, Bob Smith <gb10hkzo-freeswitch@yahoo.co.uk> wrote:
Hello Philippe,
The idea I am currently working towards implementing is :
- SIP Origination / Inbound SIP = IP range ACL with carrier - User Origination / Devlivery = OpenVPN + SNOM Handsets (they have a built-in OpenVPN client, quite cool !)
You can lock down OpenVPN quite tight so it hardly reponds at all to unauthorised requests.
I have only just started my testing, but other than some issues with inbound calls and multiple profiles that I'm trying to iron out at the moment, everything seems to be working ok.
Bob
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
1) Only open ports that are needed, see a list here: http://wiki.freeswitch.org/wiki/Firewall 2) For linux, fail2ban is.. necessary? http://wiki.freeswitch.org/wiki/Fail2ban The DOS filter would have banned those registrations in just a few seconds... If you're on *bsd, you can certainly manually block that IP with whatever firewall is there. If you're on windows.. there isn't anything like fail2ban as far as I know.. -Avi On Tue, Feb 7, 2012 at 4:54 PM, Philippe Le Toquin <philippe@ppmt.org>wrote:
wow!
Not sure I understood all I am afraid.
- SIP Origination / Inbound SIP = IP range ACL with carrier
Does the above mean to find out the ip of the SIP provider I use and only authorising these ones?
/Philippe
On 7 February 2012 09:47, Bob Smith <gb10hkzo-freeswitch@yahoo.co.uk>wrote:
Hello Philippe,
The idea I am currently working towards implementing is :
- SIP Origination / Inbound SIP = IP range ACL with carrier - User Origination / Devlivery = OpenVPN + SNOM Handsets (they have a built-in OpenVPN client, quite cool !)
You can lock down OpenVPN quite tight so it hardly reponds at all to unauthorised requests.
I have only just started my testing, but other than some issues with inbound calls and multiple profiles that I'm trying to iron out at the moment, everything seems to be working ok.
Bob
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks Marcus I will have a look at all these links I really appreciate everyone trying to help and not being dismissive of my amateur status! /Philippe On 7 February 2012 10:00, Avi Marcus <avi@avimarcus.net> wrote:
1) Only open ports that are needed, see a list here: http://wiki.freeswitch.org/wiki/Firewall 2) For linux, fail2ban is.. necessary? http://wiki.freeswitch.org/wiki/Fail2ban The DOS filter would have banned those registrations in just a few seconds...
If you're on *bsd, you can certainly manually block that IP with whatever firewall is there.
If you're on windows.. there isn't anything like fail2ban as far as I know..
-Avi
On Tue, Feb 7, 2012 at 4:54 PM, Philippe Le Toquin <philippe@ppmt.org>wrote:
wow!
Not sure I understood all I am afraid.
- SIP Origination / Inbound SIP = IP range ACL with carrier
Does the above mean to find out the ip of the SIP provider I use and only authorising these ones?
/Philippe
On 7 February 2012 09:47, Bob Smith <gb10hkzo-freeswitch@yahoo.co.uk>wrote:
Hello Philippe,
The idea I am currently working towards implementing is :
- SIP Origination / Inbound SIP = IP range ACL with carrier - User Origination / Devlivery = OpenVPN + SNOM Handsets (they have a built-in OpenVPN client, quite cool !)
You can lock down OpenVPN quite tight so it hardly reponds at all to unauthorised requests.
I have only just started my testing, but other than some issues with inbound calls and multiple profiles that I'm trying to iron out at the moment, everything seems to be working ok.
Bob
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (4)
-
Avi Marcus
-
Bob Smith
-
Ken Rice
-
Philippe Le Toquin