Anyone experiencing massive attack?

[vaibhav]

I have received over 100 fail2ban emails in the last 2 hours, almost all reporting attempts in 2-digit. Is it just me or anyone else is also experiencing this?

[BlazeStudios (Tom Ray)]

Just you so far

[vaibhav]

I’m getting 2 types of email
Sub: [Fail2Ban] SIP: banned xx.xx.xx.xx on {hostname}
[Fail2Ban] recidive: banned xx.xx.xx.xx on {hostname}

A large number of them… is there anything I should be worried about?

Thanks

[billsimon]

recidive tells you when an IP has been repeatedly banned and now is in the long-term jail. The SIP bans are shorter term. Should you be worried? that’s up to you If you don’t need that external traffic pestering your server, perhaps you could set up some firewall rules.

[vaibhav]

Thanks @billsimon

Long-term jail is good!!

@billsimon

If you don’t need that external traffic pestering your server, perhaps you could set up some firewall rules.

We have remote workers so the only way for me to setup firewall rules is to first have a VPN in place. A VPN would actually work like a firewall.

Are there any workarounds to avoid spam traffic?

[billsimon]

Sure… use only TLS for your remotes and block plain SIP. Scanners don’t usually bother with TLS. Or change to an unusual port. (recommended on this forum often)

[vaibhav]

Both suggestions sounds good, will get this done!!

[vaibhav]

I changed SIP port.
Did “Apply” in freepbx,
Did “fwconsole restart” in terminal
Still getting insane fail2ban email.
Is there something I missed?

[Stewart1 (Stewart)]

Are you certain that most of the fail2ban notices relate to SIP (it also monitors SSH, web, etc.)?

When you changed the SIP port (if you did it properly), all your extensions should have stopped working. To get them going again, you would have to forward the new port through your firewall, and reconfigure each extension to use the new port.

For pjsip, the port is called Port to Listen On; for chan_sip it’s called Bind Port.

[vaibhav]

@Stewart1

Are you certain that most of the fail2ban notices relate to SIP (it also monitors SSH, web, etc.)?

Yes. See attached. https://nimb.ws/xh48H7

@Stewart1

When you changed the SIP port (if you did it properly), all your extensions should have stopped working. To get them going again, you would have to forward the new port through your firewall, and reconfigure each extension to use the new port.

Yes, the extensions stoped working. I changed the configuration of a few extensions to connect to the new SIP port. Extensions connected fine. I did a few extn-to-extn test calls, all worked fine. But within minutes I started seeing Fail2Ban emails again. I waited for 30 min. Emails continued. That’s when I concluded that changing SIP port did not do anything good for me.

@Stewart1

For pjsip, the port is called Port to Listen On; for chan_sip it’s called Bind Port.

I use PJSIP.
I changed the port here → FreePBX Web GUI > Settings > Asterisk SIP Settings > SIP Settings (chan_pjsip) > Port to Listen On.

Did “Apply” in freepbx,
Did “fwconsole restart” in terminal

I think I did it right.

[vaibhav]

oh! wait, I only changed pjsip & not chansip.

[vaibhav]

Changed ports in chan_sip & chan_jpsip.
Waiting for fail2ban emails… to not come :))

[vaibhav]

fail2ban emails still coming. It did not help, what could I be doing wrong?

[franckdanard]

Hi.

If you want to use some remote extensions, the best way should be to connect the extensions through a VPN of course.
Next, configure some rules in your firewall to accept only trusted hosts, IP address and drop the others.
I did it for many years, that works fine.
Sometimes it’s not easy to know what are trusted host / ip address but you can add one any time you want.

Otherwise, you could use a SBC in front of your system.