Project

General

Profile

Forums » GOautodial Help »

Unauthorize Traffic

Added by Rumman Khan almost 11 years ago

Hello Team,

Few month ago ,i noticed unfair uses of minutes/Voip in my vicidial server . I saw some unauthorized traffic from asterisk CLI .

we decided to go for Autodial 3.0 as it has "Fail to Ban" application and hoping for better security.

But again I saw hacking attempt and unfair uses of Voip Minutes.

Below are few message ....

Called testcarrier3/15125773061
[Jun 10 19:19:44] NOTICE4698: chan_sip.c:15566 handle_request_invite: Call from '6019' to extension '813146198203' rejected because extension not found.
[Jun 10 19:19:44] NOTICE4698: chan_sip.c:15566 handle_request_invite: Call from '6019' to extension '813147127761' rejected because extension not found.
[Jun 10 19:19:44] NOTICE4698: chan_sip.c:15566 handle_request_invite: Call from '6019' to extension '813145026062' rejected because extension not found.
[Jun 10 19:19:44] NOTICE4698: chan_sip.c:15566 handle_request_invite: Call from '6019' to extension '813146087974' rejected because extension not found.

Please help me to fix this issue.

regards


Replies (7)

RE: Unauthorize Traffic - Added by Levy Ryan Nolasco almost 11 years ago

Hi,

You can block the IP address on IPTABLES on which the extension 6019 is registered from. Try to change also your dial prefix.

RE: Unauthorize Traffic - Added by Rumman Khan almost 11 years ago

Hello

Please guide me to Block IP address.

There is heavy traffic resulting in voice breakage. I have to block this IP -62.141.45.182.

[Jun 27 13:42:18] NOTICE5547: chan_sip.c:16835 handle_request_register: Registration from '"604" <sip:>' failed for '62.141.45.182' - Wrong password
[Jun 27 13:42:18] NOTICE5547: chan_sip.c:16835 handle_request_register: Registration from '"605" <sip:>' failed for '62.141.45.182' - Wrong password
[Jun 27 13:42:18] NOTICE5547: chan_sip.c:16835 handle_request_register: Registration from '"605" <sip:>' failed for '62.141.45.182' - Wrong password
[Jun 27 13:42:18] NOTICE5547: chan_sip.c:16835 handle_request_register: Registration from '"604" <sip:>' failed for '62.141.45.182' - Wrong password

regards,

RE: Unauthorize Traffic - Added by Rumman Khan almost 11 years ago

Md Rumman Khan wrote:

Hello

Please guide me to Block IP address.

There is heavy traffic resulting in voice breakage. I have to block this IP -62.141.45.182.

[Jun 27 13:42:18] NOTICE5547: chan_sip.c:16835 handle_request_register: Registration from '"604" <sip:>' failed for '62.141.45.182' - Wrong password
[Jun 27 13:42:18] NOTICE5547: chan_sip.c:16835 handle_request_register: Registration from '"605" <sip:>' failed for '62.141.45.182' - Wrong password
[Jun 27 13:42:18] NOTICE5547: chan_sip.c:16835 handle_request_register: Registration from '"605" <sip:>' failed for '62.141.45.182' - Wrong password
[Jun 27 13:42:18] NOTICE5547: chan_sip.c:16835 handle_request_register: Registration from '"604" <sip:>' failed for '62.141.45.182' - Wrong password

regards,

I have used this command now:

#iptables -A INPUT -s 62.141.45.182 -j DROP
#service iptables save
#service iptables restart

but this is not working ,I am getting same traffic

[Jun 27 19:10:17] NOTICE4307: chan_sip.c:16835 handle_request_register: Registration from '"6002" <sip:>' failed for '62.141.45.182' - Wrong password

Please help me with this. A lot of congestion ocuring because of this.

RE: Unauthorize Traffic - Added by Levy Ryan Nolasco almost 11 years ago

Hi,

Try command below instead. After saving don't forget to reload/restart your iptables.

-A RH-Firewall-1-INPUT -s IPAddressYouWantToBlock -j DROP

Regards,
Ryan

RE: Unauthorize Traffic - Added by Rumman Khan almost 11 years ago

Hi ,

I tried this at command prompt. it says command not found.

-A RH-Firewall-1-INPUT -s 62.141.45.182 -j DROP
-bash: -A: command not found

Vicidial version
VERSION: 2.4-309a
BUILD: 110430-1642

regards,

RE: Unauthorize Traffic - Added by striker 247 almost 11 years ago

try
iptables -I INPUT -s 62.141.45.182 -j DROP
iptables-save

br
striker
www.striker24x7.blogspot.com

RE: Unauthorize Traffic - Added by Rumman Khan almost 11 years ago

Hello striker24x7,

Thank You for your help , iptables helped me a lot .It works fine. I used to block the unauthorized IP address with help of IPtables.

but there is one problem everyday hackers keep changing the IP Address and I have to block everyday.

Is there any automated method/script to do this.

My Goautodial Version is 3.0 and I don't know why Fail2Bain fails in blocking these IP address.

regards,

    (1-7/7)     Go to top