Asterisk attack question

[dicko]

As a side note , you can often just allow the whole network of a dhcp provided device at “home” for connections through your firewall, rather than just a host, this is due to the way DHCP is done by the big guys. So look for the CIDR or NetRange in the return from

whois (the current ip address)

that device will always be awarded address within that range, a caveate is that some cable companies will send back a /12 or something from whois, generally a /16 netmask will cover that for the likes of Comcast etc. . Softphones on Cellular networks, not so much

Previously I posted in

So many hackers?

Most of the attacks are actually from cloud server instances, my guess paid for by “Chinese Unversities” as they have directly largely disappeared, I posted a script here to locate the network from the ip and ban the whole network rather than the individual IP in a permanent fashion at the firewall rather than the phemeral gfail2ban that old versions of fail2ban use. This is the output (formatted for CSF’s /etc/csf/csf.deny (or csf.allow if you run a similar set through your wandering users) ) …

allowing is just the reverse of denying and IWFM