FYI: DOS attacks

Time to implement some IPTABLES rules! Fail2ban doesn’t prevent this.
We’re seeing a number of attempts on our PBX’s as follows:

Active Channel(s)
Peer             User/ANR         Call ID          Format           Hold     Last Message   
192.168.100.197  7071             24af163d719c501  0x0 (nothing)    No       Init: NOTIFY              
192.168.100.197  7071             638bab26553e333  0x0 (nothing)    No       Init: NOTIFY              
178.22.70.152    103              1633602371       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    102              4155411910       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    101              3818369912       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    100              86425801         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8888888          3794272525       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    888888           3932102904       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    88888            3183993047       0x0 (nothing)    No       Rx: INVITE                
159.18.161.67    (None)           [email protected]59.18  0x0 (nothing)    No       Rx: OPTIONS               
178.22.70.152    8888             48853458         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    888              3689454630       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    88               4169547906       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8                969055011        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7777777          3591804772       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    777777           21311229         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    77777            2506345696       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7777             2729395706       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    777              860358066        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    77               3990178878       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7                990032174        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6666666          1164695209       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    666666           80485659         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    66666            3404503531       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6666             900710013        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    666              1151722731       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    66               1517209687       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6                3491797390       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5555555          1400068717       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    555555           3757588908       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    55555            1343809223       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5555             3462441099       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    555              2226311765       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    55               1428463308       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5                1342827176       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4444444          190442010        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    444444           2793082204       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    44444            1842656692       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4444             1336161308       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    444              2691006439       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    44               3060389961       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4                4104072981       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3333333          948184164        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    333333           2456658737       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    33333            1247450816       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3333             3908861250       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    333              2055357557       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    33               1924089996       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3                4003736280       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2222222          2263937868       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    222222           186063315        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    22222            4073840248       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2222             2623474650       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    222              1070025312       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    22               3607575265       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2                2932060959       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1111111          2687573637       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    111111           2647982116       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    11111            3351643048       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1111             1177597791       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    111              2395895660       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    11               406631667        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1                3239433752       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    0000000          2337961349       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    000000           1964825134       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    00000            1909782719       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    0000             901934426        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    000              4185187302       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    00               779660419        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    0                3795667507       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9901             2157102774       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9801             233464999        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9701             1109262080       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9601             1443487206       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9501             3284835128       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9401             3083560465       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9301             308778361        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9201             2693083468       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9101             4194132451       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9001             99733964         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8901             570836259        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8801             971643973        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8701             2954692773       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8601             979327972        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8501             917567524        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8401             2197076546       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8301             1275785796       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8201             3222629765       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8101             3189190804       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8001             3145752926       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7901             14780433         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7801             3235816577       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7701             2044295648       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7601             2154620513       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7501             4218922312       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7401             2433108381       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7301             617925933        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7201             2952530856       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7101             1810268888       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7001             1405371493       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6901             2941806813       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6801             3587210954       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6701             1765155098       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6601             2060821325       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6501             385363182        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6401             3214345851       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6301             2022250253       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6201             892371091        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6101             3107390983       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6001             802998834        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5901             1835424956       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5801             2121048709       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5701             3551573687       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5601             3119571809       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5501             519676184        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5401             1814767446       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5301             2036783812       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5201             2837550265       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5101             3643237395       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5001             1950288039       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4901             1671756733       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4801             2057800801       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4701             1880420614       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4601             696759422        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4501             1017400660       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4401             3820089120       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4301             4173861890       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4201             213040968        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4101             2195626659       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4001             1436190980       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3901             3781043434       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3801             2281360970       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3701             1730161820       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3601             3081045428       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3501             118667747        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3401             157445493        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3301             4019949280       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3201             4263603077       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3101             2156887290       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3001             1770362361       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2901             1001945327       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2801             4060634063       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2701             148231846        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2601             3210300474       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2501             3320198349       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2401             2594759420       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2301             3140621861       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2201             2488028462       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2101             3093115858       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2001             2307013284       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1901             2890345924       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1801             3342012199       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1701             3847159762       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1601             2994645512       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1501             1873269269       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1401             1887259528       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1301             3173904537       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1201             294901843        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1101             521297288        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1001             841970362        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9900             1827179561       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9800             880587215        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9700             831430313        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9600             810961242        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9500             3035287016       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9400             298486945        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9300             1685167518       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9200             3606520539       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9100             1571893362       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9000             2050597199       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8900             4224056824       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8800             1222223201       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8700             3999292997       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8600             616878097        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8500             1502853810       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8400             220945460        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8300             2760476601       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8200             3960946953       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8100             245630936        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8000             221459157        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7900             1337552105       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7800             517928015        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7700             4075683387       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7600             1252479414       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7500             1901819288       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7400             1787464390       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7300             4266387085       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7200             1966725547       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7100             3763296173       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7000             2890752254       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6900             276861993        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6800             2470348109       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6700             2362728920       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6600             3602247348       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6500             1069079936       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6400             1479220764       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6300             830974475        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6200             68313353         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6100             3090626305       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6000             388512479        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5900             688949493        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5800             2626344923       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5700             734512867        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5600             1555596699       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5500             3383712270       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5400             3383116978       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5300             892020704        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5200             345297801        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5100             748006956        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5000             2558862990       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4900             2315084162       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4800             2456882782       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4700             1485474761       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4600             1808123135       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4500             2541954704       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4400             3626871271       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4300             2714727879       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4200             1525151977       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4100             1864594478       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4000             343295572        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3900             3521103931       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3800             2564591731       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3700             4202474397       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3600             563048731        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3500             4214450237       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3400             1838747331       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3300             3263717937       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3200             867241259        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3100             3865226553       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3000             2274329597       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2900             2614405006       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2800             550287230        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2700             3277962520       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2600             4159179794       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2500             4009558117       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2400             702125961        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2300             2108649761       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2200             124664981        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2100             2395081803       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2000             1341438429       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1900             963050300        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1800             3415409267       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1700             1785787384       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1600             150409906        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1500             4105677372       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1400             3625252067       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1300             2051847654       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1200             1612072952       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1100             1401419201       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1000             3012167253       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3016823799       3049164123       0x0 (nothing)    No       Rx: INVITE                

I would suggest either your fail2ban config or Asterisk log config need some changes if fail2ban isn’t blocking that. Do you get failure attempts showing up in your log?

It’s easy enough…

http://wiki.centos.org/HowTos/Network/IPTables

Do you get failure attempts showing up in your log?

These attacks do not show in the log. fail2ban is useless. I always wondered why fail2ban is included with FreePBX as it is totally ineffective against certain classes of attacks. It was simply a matter of time before black hats would start using them. Check : http://www.freepbx.org/forum/freepbx/general-help/fail2ban-failregex-and-sip-scanning-attacks
the only purpose of this tool, when used w/asterisk, is providing a false sense of security to the unsuspecting VoIP expert wannabe.

peace

btw: I also wonder why people need to expose port 5060 to the outside world, but that’s another topic entirely …

http://www.freepbx.org/forum/freepbx/general-help/freepbx-security-comments-and-thoughts