<html><head><title>Re: [asterisk-users] Am I being hacked?</title>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-15">
</head>
<body>
<span style=" font-family:'courier new'; font-size: 9pt;">Hello Steve,<br>
<br>
Monday, August 19, 2013, 11:55:54 AM, you wrote:<br>
<br>
>> >> [2013-08-18 05:56:29] NOTICE[17089][C-000000a8] chan_sip.c: <br>
>> >> Failed to authenticate device 390<sip:390@xx.xx.xxx.xxx>;tag=2762c06e<br>
>> <br>
>> xx.xx.xxx.xxx is my public I.P.<br>
<br>
> What kind of filtering are you doing? Iptables?<br>
<br>
> Rather than playing 'wack-a-mole' with hackers, my first line of defense<br>
> is to 'white-list' just the few legitimate connections between my clients<br>
> and their SIP providers.<br>
<br>
<span style=" font-family:'Arial'; font-size: 10pt;">I have blocked almost all the IPs except the very few I care about. I'm not that good at iptables, but I did block at least <br>
<br>
I guess I need to change it to something like:<br>
<br>
Allow x<br>
alloy y<br>
allow z<br>
allow local<br>
block all<br>
<br>
One of my concerns was what happens if my provider hands off the RTP stream to a blocked address? It's a small Atom box with 6 phones, 6 or 8 numbers and two users. it's behind NAT and the internet is Time Warner Cable.<br>
<br>
Long ago I changed all my extensions to non numeric 40 character or so things with similar passwords. The only weak spot might be the connections to my brother-in-law's TrixBox box across the country and that's because he doesn't believe in secure passwords. I've tried, but it's just not worth the effort.<br>
<br>
<span style=" font-family:'courier new'; font-size: 9pt;">-- Ira</body></html>