1

I am running Asterisk with FreePBX. I would like to log all failed attempts and after a while ban them. Ideally after 3 failed attempts in 1 minute, ban for 1 hour. Is it possible to see if this attempt is repeated, then ban for 1 week.

Is it possible to set that up in iptables?

Even though I have an SSH key, I am concerned about security. Ports I am using are, some are changed: ssh (22), rtp (10000-20000), http (88), sip (5070).

At the moment, I do have GeoIP that allows only the countries that I want and block the rest. That does not cover me, since i could get hit from own country's users.

Also, I would like to allow the established connections. The main issue is that I have remote users that get dynamic IPs from their smartphones, so I can not use static IPs/dynamic dns. This is the reason for ban after so many requests.

Improve this question

2 Answers 2

Reset to default
1

Use fail2ban project for that

More info you can see at http://www.fail2ban.org/wiki/index.php/Asterisk

Improve this answer
0

Fail2Ban is not fool proof since it only looks at register attempts. It does not look at random calls coming in (though you can tweak i to). There are a few other options.

  • Use TCP only. Most of the scanners out there only use UDP.
  • Switch the SIP port. Instead of using 5060 try using something like 5999. Most scanners only target the popular ones such as 5060 (SIP) and 5080 (used by FreeSwitch for SIP).
  • Consider using a VPN for all phones. Yealink (and possibly Polycom) have built in OpenVPN clients. You can then set your Asterisk box to only accept traffic from your OpenVPN IP's.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .