connexion attempts behing a firewall (wtf?)
Hi, I just setup an FS svr w/ fusionpbx (only ext.+users created), and I found THAT in the FS log: 2012-03-11 16:51:30.795812 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:30.795812 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [88775950945170@86.68.18.226] from ip 72.55.156.56 2012-03-11 16:51:31.115813 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:31.115813 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [011441212790583@86.68.18.226] from ip 72.55.156.56 2012-03-11 16:51:31.985813 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:31.985813 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [00441212790587@86.68.18.226] from ip 72.55.156.56 2012-03-11 16:51:33.015828 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:33.015828 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [000441212790581@86.68.18.226] from ip 72.55.156.56 How can this freak reach my svr as I'm in my LAN and my modem box integrates a firewall. Oook (but not): just checked my box and found that there are 4 uPNP new rules: 0 UDP 5060 192.168.1.25 5060 1 TCP 5060 192.168.1.25 5060 2 UDP 5080 192.168.1.25 5080 3 TCP 5080 192.168.1.25 5080 I understand FS is opening these ports to be reached by external subscribers, but where can I stop it to do so until I made my internal tests, change these ports and limited VoIP to TLS only? JY -- masturbation, n.: Coming unscrewed.
This happens all the time. You need fail2ban set up properly. There are articles on both the freeswitch and fusionpbx wikis. I run a public server and I get people doing scans all the time. Does it worry me? No. Of course not. That's what fail2ban and other measures are for. Don't need to get all tinfoil hat about this. On Mar 11, 2012 7:09 PM, "Bzzz" <lazyvirus@gmx.com> wrote:
Hi,
I just setup an FS svr w/ fusionpbx (only ext.+users created), and I found THAT in the FS log:
2012-03-11 16:51:30.795812 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:30.795812 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [88775950945170@86.68.18.226] from ip 72.55.156.56 2012-03-11 16:51:31.115813 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:31.115813 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [011441212790583@86.68.18.226] from ip 72.55.156.56 2012-03-11 16:51:31.985813 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:31.985813 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [00441212790587@86.68.18.226] from ip 72.55.156.56 2012-03-11 16:51:33.015828 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:33.015828 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [000441212790581@86.68.18.226] from ip 72.55.156.56
How can this freak reach my svr as I'm in my LAN and my modem box integrates a firewall.
Oook (but not): just checked my box and found that there are 4 uPNP new rules: 0 UDP 5060 192.168.1.25 5060 1 TCP 5060 192.168.1.25 5060 2 UDP 5080 192.168.1.25 5080 3 TCP 5080 192.168.1.25 5080
I understand FS is opening these ports to be reached by external subscribers, but where can I stop it to do so until I made my internal tests, change these ports and limited VoIP to TLS only?
JY -- masturbation, n.: Coming unscrewed.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On Sun, 11 Mar 2012 19:21:01 -0400 Brian Foster <bdfoster@endigotech.com> wrote:
This happens all the time. You need fail2ban set up properly. There are articles on both the freeswitch and fusionpbx wikis.
It is, and tested as the wiki says:) but attacker isn't banned. This show me this is also linked to my previous post: softphones & fusionpbx say they're registered, but when I try to make a call between them FS throw me USER_NOT_REGISTERED errors, this is why the attacker's not jettisoned: FS don't seem to answer to a correct registration:(
I run a public server and I get people doing scans all the time. Does it worry me? No. Of course not. That's what fail2ban and other measures are for.
Interesting, could you describe "other measures", PLS? -- Draft beer, not boys!
On 11-03-12 17:11, Bzzz wrote: [snip]
I understand FS is opening these ports to be reached by external subscribers, but where can I stop it to do so until I made my internal tests, change these ports and limited VoIP to TLS only?
http://wiki.freeswitch.org/wiki/Auto_NAT Regards, Patrick
On Mon, 12 Mar 2012 01:25:35 +0100 Patrick Lists <freeswitch-list@puzzled.xs4all.nl> wrote:
Ah, ok, thanks Patrick (this will be very interesting in a near future:) -- Q: What is the difference between snow-men and snow-women? A: Snowballs!
participants (3)
-
Brian Foster
-
Bzzz
-
Patrick Lists