I love freeswitch, but frankly I would not recomend to set it as SBC. I personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS. 2016-12-12 5:17 GMT+06:00 Stanislav Sinyagin <ssinyagin@gmail.com>:

I hope this will help you to wrap your brain around FS and let you start easily: https://freeswitch.org/confluence/display/FREESWITCH/ FreeSWITCH+PBX+Example

In general, your SIP profiles don't have to be "internal/external", and your dialplan contexts don't have to be "public" or anything else. In general, you can design the whole configuration to serve the exact purpose. For example, right now I'm setting up a configuration with "inbound" and "outbound" SIP profiles and correspondingly named dialplan contexts.

For an SBC, it's quite logical to name your profiles as "inside" and "outside", and remove all unneeded parts of the configuration, such as IVR menus. If you want your inside SIP clients to register on your box, you set up a directory and enforce authentication on the corresponding SIP profile.

Also in the example above, you can find a proposed design for multiple ITSPs and a simple selection rule based on the country code.

Also it's good to read the book first. You would spend about a day to grasp the basic concepts, and it will streamline your further work.

On Sat, Dec 10, 2016 at 2:38 PM, Valter Nogueira <valter@fastway.com.br> wrote:

...

Its a little hard to change the mind from asterisk to fs.

I will try it tomorrow when users are away and the mice can play.

Thanks

Em 10 de dez de 2016 11:11 AM, "David Villasmil" < david.villasmil.work@gmail.com> escreveu:

...

Hello,

You don't HAVE to, but it's good practice. Configure your provider anywhere you want, internal or external. The names are not relevant, really. They are just names indicating that the internal profile will authenticate registers/call (auth_calls parameter) whereas by default external doesn't, though you can auth via acl.xml.conf. Once registered with your provider, you just send the call out with, i.e.:

{origination_caller_id_number=INCOMING_CALLER_ID}sofia/gatew ay/your-provider/$1

hope this helps

David

On Sat, Dec 10, 2016 at 1:39 PM Valter Nogueira <valter@fastway.com.br> wrote:

...

Yes, I want to use FS as a registar.

I already have this working in an asterisk server and want to test FS as a replacement.

18 servers share a single sip provider and FS will act as a gateway.

I have seen example.com.xml which is a user and have a gateway inside its definition.

What I don't get is why it is in external profile.

By the way, if I won't register in a sip provider, should I declare it as a gateway?

Thanks

Em 9 de dez de 2016 20:47, "Vladyslav Zakhozhai" <v.zakhozhai@gmail.com> escreveu:

Hi Valter,

You are right that you need to use directory rather than sip_profiles. Gateways in sip profiles are gateways which freeswitch is registered against.

By the way do I correctly understand you that you want Asterisk servers to register against freeswitch, i.e. freeswitch is registrar? And also you always can see exact problem in freeswitch console and logs.

2016-12-09 20:01 GMT+02:00 Valter Nogueira <valter@fastway.com.br>:

I would like to set up FS to run as a small SBC.

Profile "internal" (nic em1) would be source for N asterisks that will register in FS. Some Asterisks should be trusted by IP (acl)

Profile "external" (nic em2) would connect in an SIP Provider.

So call coming from internal would routed to external gateway and vice-versa in dialplan.

To mimic external profile I added in internal

<gateways> <X-PRE-PROCESS cmd="include" data="internal/*.xml"/> </gateways>

Asterisks are unable to register. I guess that the problem is internal gateway should be in directory instead of in sip_profile.

Thanks,

Valter

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

-- С уважением, Владислав Захожай

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

ᐧ

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 Skype: kamil.nigmatullin

On Mon, Dec 12, 2016 at 08:17:57AM +0600, Kamil Nigmatullin wrote:

I love freeswitch, but frankly I would not recomend to set it as SBC. I personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

Strongly agree. -- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 (direct) / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/

You do realize all of these things can be chexked in freeswitch. However no amount of checking various things the user is sending will stop such fraud. This is where your cdr's and pattern analysis come into play. Theres a reason large providers have rooms full of fraud prevention people Sent from my iPhone

On Dec 11, 2016, at 21:43, Kamil Nigmatullin <kamil.nigmatullin@gmail.com> wrote:

The first was the problem, where attacker somehow got login and password (i think they broke thier ATA) from clinet and used it. But for this client there was a limit of one line. I used limit module with local database. What attacker actially did, is that they used REFER attack, where they put their own number as a referrer, and opened unlimited lines to PSTN. So the, solution was - to replace limit functunality to opensips.

The second - it is not actually the FS issue. It is because Freeswitch is not flexible enouph to work at the low level where Kamailio or opensips operates. E.g, we programmed opensips to lookup for UserAgent database, we add useragent for each client manually. And only using client's IP and user-agent we allow this user to call to PSTN. We watch for blacklists of IP adresses, subnets. If it comes from Gaza, Panama, China we block it. And a lot of other things. Most of them is not out-of-box in opensips, but it is not hard to implement. All this functionality is very important. We lost about $10k last time. This is very serious.

2016-12-12 8:56 GMT+06:00 Alex Balashov <abalashov@evaristesys.com>:

...

On Mon, Dec 12, 2016 at 08:17:57AM +0600, Kamil Nigmatullin wrote:

...

I love freeswitch, but frankly I would not recomend to set it as SBC. I personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

Strongly agree.

-- Alex Balashov | Principal | Evariste Systems LLC

Tel: +1-706-510-6800 (direct) / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 Skype: kamil.nigmatullin _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

You miss my point entirely… its not just CDR reporting, but its network traffic monitoring in general. There are things in FreeSWITCH specifically made to address this sort of attack. Limits can be applied in various ways, certain SIP features can be completely disable or handling in ways that allow for more stringent checks… for instance, why would you blindly follow a refer? That in and of itself is just asking to get owned. From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Kamil Nigmatullin Sent: Sunday, December 11, 2016 10:49 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] SBC I understand that. But CDR comes after the call is done. Sometimes one minute costs 10$ and I understand this after 20 minutes. I agree that this things doest't guarantee anything but it is funcionality of so called SBC. And it helps almost in any case except attackers broke sip device and sends traffic from this devices where monitoring and various limitations are really important. And about REFFER attack it is really very dangerous thing that is not fixes yet. 2016-12-12 10:00 GMT+06:00 Ken Rice <krice@freeswitch.org <mailto:krice@freeswitch.org> >: You do realize all of these things can be chexked in freeswitch. However no amount of checking various things the user is sending will stop such fraud. This is where your cdr's and pattern analysis come into play. Theres a reason large providers have rooms full of fraud prevention people Sent from my iPhone On Dec 11, 2016, at 21:43, Kamil Nigmatullin <kamil.nigmatullin@gmail.com <mailto:kamil.nigmatullin@gmail.com> > wrote: The first was the problem, where attacker somehow got login and password (i think they broke thier ATA) from clinet and used it. But for this client there was a limit of one line. I used limit module with local database. What attacker actially did, is that they used REFER attack, where they put their own number as a referrer, and opened unlimited lines to PSTN. So the, solution was - to replace limit functunality to opensips. The second - it is not actually the FS issue. It is because Freeswitch is not flexible enouph to work at the low level where Kamailio or opensips operates. E.g, we programmed opensips to lookup for UserAgent database, we add useragent for each client manually. And only using client's IP and user-agent we allow this user to call to PSTN. We watch for blacklists of IP adresses, subnets. If it comes from Gaza, Panama, China we block it. And a lot of other things. Most of them is not out-of-box in opensips, but it is not hard to implement. All this functionality is very important. We lost about $10k last time. This is very serious. 2016-12-12 8:56 GMT+06:00 Alex Balashov <abalashov@evaristesys.com <mailto:abalashov@evaristesys.com> >: On Mon, Dec 12, 2016 at 08:17:57AM +0600, Kamil Nigmatullin wrote:

I love freeswitch, but frankly I would not recomend to set it as SBC. I personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

Strongly agree. -- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 <tel:%2B1-706-510-6800> (direct) / +1-800-250-5920 <tel:%2B1-800-250-5920> (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 <tel:(707)%20251-7003> Skype: kamil.nigmatullin _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 Skype: kamil.nigmatullin

Well, I didn't know about that traffic monitoring tools. Is it some sort of software that works via ESL or it is built-in modules? At that moment when I asked about the problem with sip reffer atack I was asked not to share this information in open forum. So there were no recomendation on how to handle that. To disable reffer completly - means not to give clients an ability to make attxfer. How could I know that limit module may be broken that way? The only thing I thought of making an aditional handler of limitaton where SIP refer packets just cannot get. (put second FS or do it on B-LEG of kamailio/opensips) 2016-12-12 11:21 GMT+06:00 Ken Rice <krice@freeswitch.org>:

You miss my point entirely… its not just CDR reporting, but its network traffic monitoring in general. There are things in FreeSWITCH specifically made to address this sort of attack. Limits can be applied in various ways, certain SIP features can be completely disable or handling in ways that allow for more stringent checks… for instance, why would you blindly follow a refer? That in and of itself is just asking to get owned.

*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Kamil Nigmatullin *Sent:* Sunday, December 11, 2016 10:49 PM *To:* FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> *Subject:* Re: [Freeswitch-users] SBC

I understand that. But CDR comes after the call is done. Sometimes one minute costs 10$ and I understand this after 20 minutes. I agree that this things doest't guarantee anything but it is funcionality of so called SBC. And it helps almost in any case except attackers broke sip device and sends traffic from this devices where monitoring and various limitations are really important. And about REFFER attack it is really very dangerous thing that is not fixes yet.

2016-12-12 10:00 GMT+06:00 Ken Rice <krice@freeswitch.org>:

You do realize all of these things can be chexked in freeswitch. However no amount of checking various things the user is sending will stop such fraud. This is where your cdr's and pattern analysis come into play. Theres a reason large providers have rooms full of fraud prevention people

Sent from my iPhone

On Dec 11, 2016, at 21:43, Kamil Nigmatullin <kamil.nigmatullin@gmail.com> wrote:

The first was the problem, where attacker somehow got login and password (i think they broke thier ATA) from clinet and used it. But for this client there was a limit of one line. I used limit module with local database. What attacker actially did, is that they used REFER attack, where they put their own number as a referrer, and opened unlimited lines to PSTN. So the, solution was - to replace limit functunality to opensips.

The second - it is not actually the FS issue. It is because Freeswitch is not flexible enouph to work at the low level where Kamailio or opensips operates. E.g, we programmed opensips to lookup for UserAgent database, we add useragent for each client manually. And only using client's IP and user-agent we allow this user to call to PSTN. We watch for blacklists of IP adresses, subnets. If it comes from Gaza, Panama, China we block it. And a lot of other things. Most of them is not out-of-box in opensips, but it is not hard to implement. All this functionality is very important. We lost about $10k last time. This is very serious.

2016-12-12 8:56 GMT+06:00 Alex Balashov <abalashov@evaristesys.com>:

On Mon, Dec 12, 2016 at 08:17:57AM +0600, Kamil Nigmatullin wrote:

...

I love freeswitch, but frankly I would not recomend to set it as SBC. I personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

Strongly agree.

-- Alex Balashov | Principal | Evariste Systems LLC

Tel: +1-706-510-6800 (direct) / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 <(707)%20251-7003> Skype: kamil.nigmatullin

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 <(707)%20251-7003> Skype: kamil.nigmatullin

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 Skype: kamil.nigmatullin

but that's part of a job for an end-to-end system designer, it's not something specific to a particular piece of software. For the scenario that Valter has described, FreeSWITCH (or two servers in a cluster) will do the job just fine. But of course it needs to be designed, configured and tested properly, with security in mind. I would agree, it's good to place Kamailio as the first-hop Internet gateway if you need to process INVITEs from unknown sources in Internet. It has nice features that minimize the impact of various DOS attacks or hacking. Also if you need to scale up, Kamailio will serve nicely as a load-balancer. But there's nothing wrong in placing FreeSWITCH alone in the Internet if you know what you're doing. On Mon, Dec 12, 2016 at 4:43 AM, Kamil Nigmatullin <kamil.nigmatullin@gmail.com> wrote:

The first was the problem, where attacker somehow got login and password (i think they broke thier ATA) from clinet and used it. But for this client there was a limit of one line. I used limit module with local database. What attacker actially did, is that they used REFER attack, where they put their own number as a referrer, and opened unlimited lines to PSTN. So the, solution was - to replace limit functunality to opensips.

The second - it is not actually the FS issue. It is because Freeswitch is not flexible enouph to work at the low level where Kamailio or opensips operates. E.g, we programmed opensips to lookup for UserAgent database, we add useragent for each client manually. And only using client's IP and user-agent we allow this user to call to PSTN. We watch for blacklists of IP adresses, subnets. If it comes from Gaza, Panama, China we block it. And a lot of other things. Most of them is not out-of-box in opensips, but it is not hard to implement. All this functionality is very important. We lost about $10k last time. This is very serious.

2016-12-12 8:56 GMT+06:00 Alex Balashov <abalashov@evaristesys.com>:

...

On Mon, Dec 12, 2016 at 08:17:57AM +0600, Kamil Nigmatullin wrote:

...

I love freeswitch, but frankly I would not recomend to set it as SBC. I personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

Strongly agree.

-- Alex Balashov | Principal | Evariste Systems LLC

Tel: +1-706-510-6800 (direct) / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 Skype: kamil.nigmatullin

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

I am studying opensips and kamailio, but to be honest, I am a little affraid of them - just because I am not sure if I can figure out every situation in route. My environment is strictly controlled with iptables drop policy and just friendly traffic is allowed. What I understood by now is that I must have a profile for every NIC used to route traffic. What I don't get yet is how directory relates to profiles. In file directory/default/example.com.xml there is a user "joe" which have a gateway defined inside it and that sofia shows in every gateway availble (expect in internal) Just to make me more confused: https://wiki.freeswitch.org/wiki/SBC_Setup In which internal and external are binded to the same ip+port but to different vlans. How vlans tags are binded to internatl and external profiles? Atenciosamente, 2016-12-12 9:09 GMT-02:00 David Villasmil <david.villasmil.work@gmail.com>:

At the very least start by looking at Homer (http://sipcapture.org/) which works beautifully with kamailio (i assume also openSIPS) and freeswitch. and it generates by default some nice graphs and alarms.

Regards,

David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 <+34%20669%2044%2083%2037>

On Mon, Dec 12, 2016 at 10:19 AM, Stanislav Sinyagin <ssinyagin@gmail.com> wrote:

...

but that's part of a job for an end-to-end system designer, it's not something specific to a particular piece of software.

For the scenario that Valter has described, FreeSWITCH (or two servers in a cluster) will do the job just fine. But of course it needs to be designed, configured and tested properly, with security in mind.

I would agree, it's good to place Kamailio as the first-hop Internet gateway if you need to process INVITEs from unknown sources in Internet. It has nice features that minimize the impact of various DOS attacks or hacking. Also if you need to scale up, Kamailio will serve nicely as a load-balancer. But there's nothing wrong in placing FreeSWITCH alone in the Internet if you know what you're doing.

On Mon, Dec 12, 2016 at 4:43 AM, Kamil Nigmatullin <kamil.nigmatullin@gmail.com> wrote:

...

The first was the problem, where attacker somehow got login and password (i think they broke thier ATA) from clinet and used it. But for this client there was a limit of one line. I used limit module with local database. What attacker actially did, is that they used REFER attack, where they put their own number as a referrer, and opened unlimited lines to PSTN. So the, solution was - to replace limit functunality to opensips.

The second - it is not actually the FS issue. It is because Freeswitch is not flexible enouph to work at the low level where Kamailio or opensips operates. E.g, we programmed opensips to lookup for UserAgent database, we add useragent for each client manually. And only using client's IP and user-agent we allow this user to call to PSTN. We watch for blacklists of IP adresses, subnets. If it comes from Gaza, Panama, China we block it. And a lot of other things. Most of them is not out-of-box in opensips, but it is not hard to implement. All this functionality is very important. We lost about $10k last time. This is very serious.

2016-12-12 8:56 GMT+06:00 Alex Balashov <abalashov@evaristesys.com>:

...

On Mon, Dec 12, 2016 at 08:17:57AM +0600, Kamil Nigmatullin wrote:

...

I love freeswitch, but frankly I would not recomend to set it as

SBC. I

...

...

personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

Strongly agree.

-- Alex Balashov | Principal | Evariste Systems LLC

Tel: +1-706-510-6800 (direct) / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/

____________________________________________________________

---

...

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/ freeswitch-users http://www.freeswitch.org

-- Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 Skype: kamil.nigmatullin

____________________________________________________________

---

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/ freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Which parameter I use to enable a profile to registration? <param name="force-register-domain" value="$${domain}"/> Atenciosamente, 2016-12-12 23:30 GMT-02:00 David Villasmil <david.villasmil.work@gmail.com>:

Hello,

Every time fs receives a REGISTER it will look up the user trying to register (if the profile is configured to authenticate) in the directory path. You can register via any profile if configured. You can control what user may register where by enabling multi-domain as per https://wiki.freeswitch.org/wiki/Multiple_Companies.

By default, the directory.xml is as follows:

<include> <!--the domain or ip (the right hand side of the @ in the addr--> <domain name="$${domain}"> ... <groups> <group name="default"> <users> <X-PRE-PROCESS cmd="include" data="default/*.xml"/> </users> </group> ...

So, as you can see, there's only one domain directory ($${domain} which is the ip address of your server) which has only one group called "users" which *includes* any xml in "default/"

hope this helps.

David ᐧ

Regards,

David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 <+34%20669%2044%2083%2037>

On Mon, Dec 12, 2016 at 9:42 PM, Valter Nogueira <valter@fastway.com.br> wrote:

...

I am studying opensips and kamailio, but to be honest, I am a little affraid of them - just because I am not sure if I can figure out every situation in route.

My environment is strictly controlled with iptables drop policy and just friendly traffic is allowed.

What I understood by now is that I must have a profile for every NIC used to route traffic.

What I don't get yet is how directory relates to profiles. In file directory/default/example.com.xml there is a user "joe" which have a gateway defined inside it and that sofia shows in every gateway availble (expect in internal)

Just to make me more confused: https://wiki.freeswitch.org/wiki/SBC_Setup

In which internal and external are binded to the same ip+port but to different vlans. How vlans tags are binded to internatl and external profiles?

Atenciosamente,

2016-12-12 9:09 GMT-02:00 David Villasmil <david.villasmil.work@gmail.com

...

:

...

At the very least start by looking at Homer (http://sipcapture.org/) which works beautifully with kamailio (i assume also openSIPS) and freeswitch. and it generates by default some nice graphs and alarms.

Regards,

David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 <+34%20669%2044%2083%2037>

On Mon, Dec 12, 2016 at 10:19 AM, Stanislav Sinyagin < ssinyagin@gmail.com> wrote:

...

but that's part of a job for an end-to-end system designer, it's not something specific to a particular piece of software.

For the scenario that Valter has described, FreeSWITCH (or two servers in a cluster) will do the job just fine. But of course it needs to be designed, configured and tested properly, with security in mind.

I would agree, it's good to place Kamailio as the first-hop Internet gateway if you need to process INVITEs from unknown sources in Internet. It has nice features that minimize the impact of various DOS attacks or hacking. Also if you need to scale up, Kamailio will serve nicely as a load-balancer. But there's nothing wrong in placing FreeSWITCH alone in the Internet if you know what you're doing.

On Mon, Dec 12, 2016 at 4:43 AM, Kamil Nigmatullin <kamil.nigmatullin@gmail.com> wrote:

...

The first was the problem, where attacker somehow got login and password (i think they broke thier ATA) from clinet and used it. But for this client there was a limit of one line. I used limit module with local database. What attacker actially did, is that they used REFER attack, where they put their own number as a referrer, and opened unlimited lines to PSTN. So the, solution was - to replace limit functunality to opensips.

The second - it is not actually the FS issue. It is because Freeswitch is not flexible enouph to work at the low level where Kamailio or opensips operates. E.g, we programmed opensips to lookup for UserAgent database, we add useragent for each client manually. And only using client's IP and user-agent we allow this user to call to PSTN. We watch for blacklists of IP adresses, subnets. If it comes from Gaza, Panama, China we block it. And a lot of other things. Most of them is not out-of-box in opensips, but it is not hard to implement. All this functionality is very important. We lost about $10k last time. This is very serious.

2016-12-12 8:56 GMT+06:00 Alex Balashov <abalashov@evaristesys.com>:

...

On Mon, Dec 12, 2016 at 08:17:57AM +0600, Kamil Nigmatullin wrote:

> I love freeswitch, but frankly I would not recomend to set it as

SBC. I

...

> personally faced two attacks where FS was not good at. And we lost a lot > of > money. It works perfectly as NAT between internal and extenal networks, > actually in everything but it is weak as a firewall. Stanislav knows > that, > he helped me to resolve the problem first time when it happend. I cannot > go > into details as this is open forum. You need to put either kamailio or > opensips in front of FS.

Strongly agree.

-- Alex Balashov | Principal | Evariste Systems LLC

Tel: +1-706-510-6800 (direct) / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/

____________________________________________________________

---

...

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

-- Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 Skype: kamil.nigmatullin

____________________________________________________________

---

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

So "inside" profile should not have gateways at all. I should declare asterisks as users like asterisk-1, asterisk-2 and soon. And bridge calls to them using user/asterisk-1. On "outside" profile I should have gateways but not users and bridge calls to sofia/gateway/myistsp.com Atenciosamente, 2016-12-13 0:25 GMT-02:00 David Villasmil <david.villasmil.work@gmail.com>:

I also enable auth-calls and auth-all-packets.

On Tue, Dec 13, 2016 at 3:19 AM Valter Nogueira <valter@fastway.com.br> wrote:

...

Which parameter I use to enable a profile to registration?

<param name="force-register-domain" value="$${domain}"/>

Atenciosamente,

2016-12-12 23:30 GMT-02:00 David Villasmil <david.villasmil.work@gmail. com>:

Hello,

Every time fs receives a REGISTER it will look up the user trying to register (if the profile is configured to authenticate) in the directory path. You can register via any profile if configured. You can control what user may register where by enabling multi-domain as per https://wiki.freeswitch.org/wiki/Multiple_Companies.

By default, the directory.xml is as follows:

<include> <!--the domain or ip (the right hand side of the @ in the addr--> <domain name="$${domain}"> ... <groups> <group name="default"> <users> <X-PRE-PROCESS cmd="include" data="default/*.xml"/> </users> </group> ...

So, as you can see, there's only one domain directory ($${domain} which is the ip address of your server) which has only one group called "users" which *includes* any xml in "default/"

hope this helps.

David ᐧ

Regards,

David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 <+34%20669%2044%2083%2037>

On Mon, Dec 12, 2016 at 9:42 PM, Valter Nogueira <valter@fastway.com.br> wrote:

I am studying opensips and kamailio, but to be honest, I am a little affraid of them - just because I am not sure if I can figure out every situation in route.

My environment is strictly controlled with iptables drop policy and just friendly traffic is allowed.

What I understood by now is that I must have a profile for every NIC used to route traffic.

What I don't get yet is how directory relates to profiles. In file directory/default/example.com.xml there is a user "joe" which have a gateway defined inside it and that sofia shows in every gateway availble (expect in internal)

Just to make me more confused: https://wiki.freeswitch.org/wiki/SBC_Setup

In which internal and external are binded to the same ip+port but to different vlans. How vlans tags are binded to internatl and external profiles?

Atenciosamente,

2016-12-12 9:09 GMT-02:00 David Villasmil <david.villasmil.work@gmail.com

...

:

At the very least start by looking at Homer (http://sipcapture.org/) which works beautifully with kamailio (i assume also openSIPS) and freeswitch. and it generates by default some nice graphs and alarms.

Regards,

David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 <+34%20669%2044%2083%2037>

On Mon, Dec 12, 2016 at 10:19 AM, Stanislav Sinyagin <ssinyagin@gmail.com

...

wrote:

but that's part of a job for an end-to-end system designer, it's not something specific to a particular piece of software.

For the scenario that Valter has described, FreeSWITCH (or two servers in a cluster) will do the job just fine. But of course it needs to be designed, configured and tested properly, with security in mind.

I would agree, it's good to place Kamailio as the first-hop Internet gateway if you need to process INVITEs from unknown sources in Internet. It has nice features that minimize the impact of various DOS attacks or hacking. Also if you need to scale up, Kamailio will serve nicely as a load-balancer. But there's nothing wrong in placing FreeSWITCH alone in the Internet if you know what you're doing.

On Mon, Dec 12, 2016 at 4:43 AM, Kamil Nigmatullin <kamil.nigmatullin@gmail.com> wrote:

...

The first was the problem, where attacker somehow got login and password (i think they broke thier ATA) from clinet and used it. But for this client there was a limit of one line. I used limit module with local database. What attacker actially did, is that they used REFER attack, where they put their own number as a referrer, and opened unlimited lines to PSTN. So the, solution was - to replace limit functunality to opensips.

The second - it is not actually the FS issue. It is because Freeswitch is not flexible enouph to work at the low level where Kamailio or opensips operates. E.g, we programmed opensips to lookup for UserAgent database, we add useragent for each client manually. And only using client's IP and user-agent we allow this user to call to PSTN. We watch for blacklists of IP adresses, subnets. If it comes from Gaza, Panama, China we block it. And a lot of other things. Most of them is not out-of-box in opensips, but it is not hard to implement. All this functionality is very important. We lost about $10k last time. This is very serious.

2016-12-12 8:56 GMT+06:00 Alex Balashov <abalashov@evaristesys.com>:

...

On Mon, Dec 12, 2016 at 08:17:57AM +0600, Kamil Nigmatullin wrote:

...

I love freeswitch, but frankly I would not recomend to set it as

SBC. I

...

...

personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

Strongly agree.

-- Alex Balashov | Principal | Evariste Systems LLC

Tel: +1-706-510-6800 (direct) / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/

____________________________________________________________

---

...

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/ options/freeswitch-users http://www.freeswitch.org

-- Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 Skype: kamil.nigmatullin

____________________________________________________________

---

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/ options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

On 12.12.2016 04:17, Kamil Nigmatullin wrote:

I love freeswitch, but frankly I would not recomend to set it as SBC. I personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

Hello. I have a FS for almost 4 year opened to the Internet for non-authenticated call to local extensions only and authenticated calls to external and local. Yes I've had attacks, some did a DDOS with packet spoofing. But using iptables and log I am clean now. The only attack I see is sending incorrect SIP packet. Which I see on my second monitor and block the IP. Just following wiki to use iptables, fail2ban, acls and so on. -- Mimiko desu.

I'm just thinking out loud, but maybe it'd be a good idea to have 2 default configs somehow. 1 which is the current one, and the second would be a ver-very-hardened one. I usually start-off with https://github.com/voxserv/freeswitch_conf_minimal or https://github.com/mx4492/freeswitch-minimal-conf which are very basic, but it would be a great idea to have available a "hardened" one. Regards, David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 On Mon, Dec 12, 2016 at 4:22 PM, Brian West <brian@freeswitch.org> wrote:

Kamil,

The security model of FreeSWITCH can be quite complex, To blame FreeSWITCH itself for your misconfiguration is downright FUD, If you have issues or questions on how to properly configure FreeSWITCH for this specific role you can just ask, many of us will help you create a configuration that would be robust and secure. If you would have set 'disable-transfer', to true, and possibly 'disable-register' it would also help lower your attack surface, In addition you shouldn't open your system to the planet, thats irresponsible on your part for doing so.

FreeSWITCH isn't a firewall, so of course its weak because its NOT a firewall.

And these are in the configs:

<!-- disable register and transfer which may be undesirable in a public switch -->

<!--<param name="disable-transfer" value="true"/>-->

<!--<param name="disable-register" value="true"/>-->

Thanks, /b

On Sun, Dec 11, 2016 at 8:17 PM, Kamil Nigmatullin < kamil.nigmatullin@gmail.com> wrote:

...

I love freeswitch, but frankly I would not recomend to set it as SBC. I personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com (50% Discount using code FreeSwitch50) http://www.freeswitchcookbook.com (50% Discount using code FreeSwitch50) https://www.gofundme.com/freeswitch_ubuntu

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Sounds good, I'll take a look. Thanks Regards, David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 On Mon, Dec 12, 2016 at 4:56 PM, Brian West <brian@freeswitch.org> wrote:

I've given everyone the opportunity to get involved in the new 1.8 configs, So far very few people have stepped up to assist me in this task.

It should be hardened by default, or have a way to toggle the hardened configs on.

https://freeswitch.org/stash/projects/FS/repos/fs18configs/browse

If you wish to review.

/b

On Mon, Dec 12, 2016 at 9:30 AM, David Villasmil < david.villasmil.work@gmail.com> wrote:

...

I'm just thinking out loud, but maybe it'd be a good idea to have 2 default configs somehow. 1 which is the current one, and the second would be a ver-very-hardened one. I usually start-off with https://github.com/voxser v/freeswitch_conf_minimal or https://github.com/mx4492/f reeswitch-minimal-conf which are very basic, but it would be a great idea to have available a "hardened" one.

Regards,

David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337

On Mon, Dec 12, 2016 at 4:22 PM, Brian West <brian@freeswitch.org> wrote:

...

Kamil,

The security model of FreeSWITCH can be quite complex, To blame FreeSWITCH itself for your misconfiguration is downright FUD, If you have issues or questions on how to properly configure FreeSWITCH for this specific role you can just ask, many of us will help you create a configuration that would be robust and secure. If you would have set 'disable-transfer', to true, and possibly 'disable-register' it would also help lower your attack surface, In addition you shouldn't open your system to the planet, thats irresponsible on your part for doing so.

FreeSWITCH isn't a firewall, so of course its weak because its NOT a firewall.

And these are in the configs:

<!-- disable register and transfer which may be undesirable in a public switch -->

<!--<param name="disable-transfer" value="true"/>-->

<!--<param name="disable-register" value="true"/>-->

Thanks, /b

On Sun, Dec 11, 2016 at 8:17 PM, Kamil Nigmatullin < kamil.nigmatullin@gmail.com> wrote:

...

I love freeswitch, but frankly I would not recomend to set it as SBC. I personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com (50% Discount using code FreeSwitch50) http://www.freeswitchcookbook.com (50% Discount using code FreeSwitch50) https://www.gofundme.com/freeswitch_ubuntu

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com (50% Discount using code FreeSwitch50) http://www.freeswitchcookbook.com (50% Discount using code FreeSwitch50) https://www.gofundme.com/freeswitch_ubuntu

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Fork, pull request like usual, we can start a new thread for this discussion once you start reviewing it. /b On Mon, Dec 12, 2016 at 10:01 AM, David Villasmil < david.villasmil.work@gmail.com> wrote:

Is there a thread to discuss this or should I just fork and propose as always?

Regards,

David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337

On Mon, Dec 12, 2016 at 4:59 PM, David Villasmil < david.villasmil.work@gmail.com> wrote:

...

Sounds good, I'll take a look.

Thanks

Regards,

David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 <+34%20669%2044%2083%2037>

On Mon, Dec 12, 2016 at 4:56 PM, Brian West <brian@freeswitch.org> wrote:

...

I've given everyone the opportunity to get involved in the new 1.8 configs, So far very few people have stepped up to assist me in this task.

It should be hardened by default, or have a way to toggle the hardened configs on.

https://freeswitch.org/stash/projects/FS/repos/fs18configs/browse

If you wish to review.

/b

On Mon, Dec 12, 2016 at 9:30 AM, David Villasmil < david.villasmil.work@gmail.com> wrote:

...

I'm just thinking out loud, but maybe it'd be a good idea to have 2 default configs somehow. 1 which is the current one, and the second would be a ver-very-hardened one. I usually start-off with https://github.com/voxser v/freeswitch_conf_minimal or https://github.com/mx4492/f reeswitch-minimal-conf which are very basic, but it would be a great idea to have available a "hardened" one.

Regards,

David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337

On Mon, Dec 12, 2016 at 4:22 PM, Brian West <brian@freeswitch.org> wrote:

...

Kamil,

The security model of FreeSWITCH can be quite complex, To blame FreeSWITCH itself for your misconfiguration is downright FUD, If you have issues or questions on how to properly configure FreeSWITCH for this specific role you can just ask, many of us will help you create a configuration that would be robust and secure. If you would have set 'disable-transfer', to true, and possibly 'disable-register' it would also help lower your attack surface, In addition you shouldn't open your system to the planet, thats irresponsible on your part for doing so.

FreeSWITCH isn't a firewall, so of course its weak because its NOT a firewall.

And these are in the configs:

<!-- disable register and transfer which may be undesirable in a public switch -->

<!--<param name="disable-transfer" value="true"/>-->

<!--<param name="disable-register" value="true"/>-->

Thanks, /b

On Sun, Dec 11, 2016 at 8:17 PM, Kamil Nigmatullin < kamil.nigmatullin@gmail.com> wrote:

...

I love freeswitch, but frankly I would not recomend to set it as SBC. I personally faced two attacks where FS was not good at. And we lost a lot of money. It works perfectly as NAT between internal and extenal networks, actually in everything but it is weak as a firewall. Stanislav knows that, he helped me to resolve the problem first time when it happend. I cannot go into details as this is open forum. You need to put either kamailio or opensips in front of FS.

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com (50% Discount using code FreeSwitch50) http://www.freeswitchcookbook.com (50% Discount using code FreeSwitch50) https://www.gofundme.com/freeswitch_ubuntu

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com (50% Discount using code FreeSwitch50) http://www.freeswitchcookbook.com (50% Discount using code FreeSwitch50) https://www.gofundme.com/freeswitch_ubuntu

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com (50% Discount using code FreeSwitch50) http://www.freeswitchcookbook.com (50% Discount using code FreeSwitch50) https://www.gofundme.com/freeswitch_ubuntu Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest

Even if you're not placing blame you're creating FUD. And I won't tolerate that without proof. If its a problem I'd like to fix it. Send me details. /b On Mon, Dec 12, 2016 at 10:51 AM, Kamil Nigmatullin < kamil.nigmatullin@gmail.com> wrote:

2016-12-12 21:22 GMT+06:00 Brian West <brian@freeswitch.org>:

...

ur system to the planet,

I, by no means, blame freeswithch. Just tell about problems we had. And we paid quite a lot for that attack, and it is not fixed in FS. I personally need register, I need transfer, I need all features.Why should I disable it? We run cloud callcenter. That is seen from public Internet. So, with my experiance I just recomend to use something with Freeswitch, or use two freeswitch. And that will last until I can make reffer attack to FS. I had my own script, if anyone want to test I can try to break their limit.

About that features I don't know about - I belive I am not the only one. And not because I am lazy to ask or to read. I just always thought that FS is very advanced mediagateway. And Its pace not in front of the voip network. There must be load balancer, firewall, monitoring that controls all failaures and attmetmpts. Simply, FS is not level 5 of OSI.

-- Kamil Nigmatullin Tel: 77272323748 mob: 7 (707) 2517003 Skype: kamil.nigmatullin

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com (50% Discount using code FreeSwitch50) http://www.freeswitchcookbook.com (50% Discount using code FreeSwitch50) https://www.gofundme.com/freeswitch_ubuntu Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest