Hello,
I have been seeing in my PBX some CDR’s like the following (CEL) that are clearly not from me:
2015-12-09 16:22:47 CHAN_START 1002 1002 DEFAULT 46462886851 from-sip-external SIP/78.87.11.234-00000af6
2015-12-09 16:22:48 ANSWER 1002 1002 1002 46462886851 DEFAULT s from-sip-external Answer SIP/78.87.11.234-00000af6
2015-12-09 16:23:00 HANGUP 1002 1002 1002 46462886851 DEFAULT h from-sip-external SIP/78.87.11.234-00000af6
2015-12-09 16:23:00 CHAN_END 1002 1002 1002 46462886851 DEFAULT h from-sip-external SIP/78.87.11.234-00000af6
2015-12-09 16:23:00 LINKEDID_END 1002 1002 1002 46462886851 DEFAULT h from-sip-external SIP/78.87.11.234-00000af6
Log file from asterisk is:
[2015-12-09 16:27:49] VERBOSE[2272][C-000054ec] netsock2.c: Using SIP RTP TOS bits 184
[2015-12-09 16:27:49] VERBOSE[2272][C-000054ec] netsock2.c: Using SIP RTP CoS mark 5
[2015-12-09 16:27:49] VERBOSE[18713][C-000054ec] pbx.c: Executing [+46462886851@from-sip-external:1] NoOp("SIP/78.87.11.234-00000af7", "Received incoming SIP connection from unknown peer to +46462886851") in new stack
[2015-12-09 16:27:49] VERBOSE[18713][C-000054ec] pbx.c: Executing [+46462886851@from-sip-external:2] Set("SIP/78.87.11.234-00000af7", "DID=+46462886851") in new stack
[2015-12-09 16:27:49] VERBOSE[18713][C-000054ec] pbx.c: Executing [+46462886851@from-sip-external:3] Goto("SIP/78.87.11.234-00000af7", "s,1") in new stack
[2015-12-09 16:27:49] VERBOSE[18713][C-000054ec] pbx.c: Goto (from-sip-external,s,1)
[2015-12-09 16:27:49] VERBOSE[18713][C-000054ec] pbx.c: Executing [s@from-sip-external:1] GotoIf("SIP/78.87.11.234-00000af7", "0?checklang:noanonymous") in new stack
[2015-12-09 16:27:49] VERBOSE[18713][C-000054ec] pbx.c: Goto (from-sip-external,s,5)
[2015-12-09 16:27:49] VERBOSE[18713][C-000054ec] pbx.c: Executing [s@from-sip-external:5] Set("SIP/78.87.11.234-00000af7", "TIMEOUT(absolute)=15") in new stack
[2015-12-09 16:27:49] VERBOSE[18713][C-000054ec] func_timeout.c: Channel will hangup at 2015-12-09 16:28:04.759 EET.
[2015-12-09 16:27:49] VERBOSE[18713][C-000054ec] pbx.c: Executing [s@from-sip-external:6] Log("SIP/78.87.11.234-00000af7", "WARNING,"Rejecting unknown SIP connection from 195.154.251.65"") in new stack
[2015-12-09 16:27:49] WARNING[18713][C-000054ec] Ext. s: "Rejecting unknown SIP connection from 195.154.251.65"
[2015-12-09 16:27:49] VERBOSE[18713][C-000054ec] pbx.c: Executing [s@from-sip-external:7] Answer("SIP/78.87.11.234-00000af7", "") in new stack
[2015-12-09 16:27:50] VERBOSE[18713][C-000054ec] pbx.c: Executing [s@from-sip-external:8] Wait("SIP/78.87.11.234-00000af7", "2") in new stack
[2015-12-09 16:27:52] VERBOSE[18713][C-000054ec] pbx.c: Executing [s@from-sip-external:9] Playback("SIP/78.87.11.234-00000af7", "ss-noservice") in new stack
[2015-12-09 16:27:52] VERBOSE[18713][C-000054ec] file.c: <SIP/78.87.11.234-00000af7> Playing 'ss-noservice.ulaw' (language 'en')
[2015-12-09 16:27:57] VERBOSE[18713][C-000054ec] pbx.c: Executing [s@from-sip-external:10] PlayTones("SIP/78.87.11.234-00000af7", "congestion") in new stack
[2015-12-09 16:27:57] VERBOSE[18713][C-000054ec] pbx.c: Executing [s@from-sip-external:11] Congestion("SIP/78.87.11.234-00000af7", "5") in new stack
Why do I see this? Shouldn’t the firewall block those requests?
My PBX has private IP and ports 5060-5070 and 10000-20000 are forward towards my PBX’s IP. Using FreePBX Distro 10.13.66-6
Thank you,
esarant