[Freeswitch-users] Outgoing calls from unknown users

Fri Feb 22 18:48:26 MSK 2013

PB 20618

Everytime, it is a 0 billsec. For now, international calls are not 
authorized. But in a near future, I want to authorized them.

I verified what Ken wrote:

A) make sure you are not using the default username and passwords for
registered sip users *(not using default username and password. All 
default users/extensions have been removed)*
B) don't allow unauthenticated calls to go back out to the PSTN *(I 
don't have PSTN lines)*
C) Use appropriate firewall rules to only allow places you should be getting
calls from *(Already done)*
D) use something like Fail2Ban to block people attempting to make repeated
failed calls/registration attempts in a short period of time...

Actually, I have fail2ban that blocks registration attemps. I don't know 
how to block failed calls. Can you guide me to a web site or help me to 
ban failed calls?

Thank you for your quick replies!

Fred

Le 2013-02-22 09:01, Christian Benke a écrit :
> Do you have a logfile of these calls? Can you please paste it to
> http://pastebin.freeswitch.org/. Otherwise, please paste your
> dialplans to pastebin so we can figure out what's really happening
> with your calls, the csv has too little information. Do all of these
> calls have 0 billsec?
>
> If possible, you should turn off FreeSWITCH till you know the reason
> for this calls, it looks very much like your system is not safe.
>
> Best regards,
> Christian
>
> --
> Central Asia by bike, starting May 2013 - http://poab.org
>
>
> On 22 February 2013 14:26, Frederick Pruneau
> <frederick at targointernet.com> wrote:
>> Hi everyone!
>>
>> I have found in the log files some international calls from unknown
>> extensions. These extensions don't exist in my configuration. I tried to
>> block them in my firewall (iptables on my freeswitch server) but they
>> always use random IP adresses. Here is a short part of my Master.csv:
>>
>> "1001","1001","0015972595646444","2013-02-22 02:05:27","","2013-02-22
>> 02:05:27","0","NORMAL_CLEARING","3c876eae-7cbe-11e2-877f-b791adff5763","","","",""
>> "1001","1001","9011972595646444","2013-02-22 02:05:28","","2013-02-22
>> 02:05:28","0","NORMAL_CLEARING","3d0d058c-7cbe-11e2-8783-b791adff5763","","","",""
>> "1001","1001","2011972595646444","2013-02-22 02:05:29","","2013-02-22
>> 02:05:29","0","NORMAL_CLEARING","3da55576-7cbe-11e2-8787-b791adff5763","","","",""
>> "1001","1001","3011972595646444","2013-02-22 02:05:30","","2013-02-22
>> 02:05:30","0","NORMAL_CLEARING","3e4727ca-7cbe-11e2-878b-b791adff5763","","","",""
>> "1001","1001","4011972595646444","2013-02-22 02:05:31","","2013-02-22
>> 02:05:31","0","NORMAL_CLEARING","3eecc2e8-7cbe-11e2-878f-b791adff5763","","","",""
>> "1001","1001","5011972595646444","2013-02-22 02:05:32","","2013-02-22
>> 02:05:32","0","NORMAL_CLEARING","3f633b94-7cbe-11e2-8793-b791adff5763","","","",""
>> "1001","1001","6011972595646444","2013-02-22 02:05:33","","2013-02-22
>> 02:05:33","0","NORMAL_CLEARING","3fc49902-7cbe-11e2-8797-b791adff5763","","","",""
>> "1001","1001","7011972595646444","2013-02-22 02:05:33","","2013-02-22
>> 02:05:33","0","NORMAL_CLEARING","403c0622-7cbe-11e2-879b-b791adff5763","","","",""
>> "1001","1001","8011972595646444","2013-02-22 02:05:34","","2013-02-22
>> 02:05:34","0","NORMAL_CLEARING","40e61ef0-7cbe-11e2-879f-b791adff5763","","","",""
>>
>> With my configuration, I need to be registered to make a call. I tried
>> to call with an unregistered phone and I was not able to make a call. I
>> don't know how they are able to do this but I need to block them. Is
>> there something that I am missing in my configuration to block unwanted
>> extensions to make calls?
>>
>> Thanks in advance!
>>
>>
>> Fred
>>
>> _________________________________________________________________________
>> Professional FreeSWITCH Consulting Services:
>> consulting at freeswitch.org
>> http://www.freeswitchsolutions.com
>>
>> 
>> 
>>
>> Official FreeSWITCH Sites
>> http://www.freeswitch.org
>> http://wiki.freeswitch.org
>> http://www.cluecon.com
>>
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users at lists.freeswitch.org
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> 
> 
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org

-- 
Frédérick Pruneau
Administrateur réseau | Network administrator
Targo Communications
Ste-Clotilde : (450) 826-0031
Montréal : (514) 448-0773

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20130222/22908711/attachment.html 