<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body>Hello Hans, <div><br></div><div>maybe I don't rember SIP & Asterisk well, but I THINK it's absolutely possible to place a call from one Asterisk Server to another one without at SIP Provider in between.</div><div><br></div><div>Imagine a (big) company with branches running a server at every site.</div><div><br></div><div>But maybe I'm wrong....</div><div><br></div><div>But for other setups you're right. For example, on my asterisk machine firewall is closed except the (few) IP adresses my SIP provider told me</div><div><br></div><div>Norbert</div><div><br></div><div style="font-size:100%;color:#000000"><!-- originalMessage --><div>-------- Ursprüngliche Nachricht --------</div><div>Von: asterisk@a-domani.nl </div><div>Datum: 30.08.18 12:04 (GMT+02:00) </div><div>An: Asterisk Users Mailing List - Non-Commercial Discussion <asterisk-users@lists.digium.com> </div><div>Betreff: Re: [asterisk-users] getting invites to rtp ports ?? </div><div><br></div></div>Regarding this thread,<br>I was wondering, why would anybody opens his firewall (for incoming <br>traffic), for anybody else, besides his own SIP-provider?<br><br>Isn't that the proper way for having your firewall configured: always, <br>by default closed, unless explicitly required.<br>(but perhaps I'm missing a legitimate use-case)<br><br>Hans<br><br>On 2018-08-30 04:52, Matthew Jordan wrote:<br>> On Wed, Aug 29, 2018 at 6:20 PM Telium Support Group<br>> <support@telium.ca> wrote:<br>> <br>>> Depending on log trolling (Asterisk security log) misses a lot, and<br>>> also depends on the SIP/PJSIP folks to not change message structure<br>>> (which has already happened numerous time). If you are comfortable<br>>> hacking chan_sip.c you may prefer to get the same messages from the<br>>> AMI. It still misses a lot but that approach is better than<br>>> nothing.<br>>> <br>>> Digium warns not to use fail2ban / log trolling as a security<br>>> system: http://forums.asterisk.org/viewtopic.php?p=159984<br>> <br>> That's some pretty old advice.<br>> <br>> The rationale for *not* using general log messages with fail2ban still<br>> stands: the general WARNING/NOTICE/etc. log messages are subject to<br>> change between versions, and no one wants that to impact someone's<br>> security. So you should not use those messages as input into fail2ban.<br>> <br>> That rationale did lead to the 'security' event type in log messages.<br>> Security Event Logging - as it is called - got added into Asterisk<br>> quite some time ago. So long ago I'm really not sure which version. At<br>> a minimum, Asterisk 11, but I'm pretty sure it was in 10 as well.<br>> <br>> Documentation for it can be found here:<br>> <br>> https://wiki.asterisk.org/wiki/display/AST/Asterisk+Security+Event+Logger<br>> <br>> And here:<br>> <br>> https://wiki.asterisk.org/wiki/display/AST/Logging+Configuration<br>> <br>> Note that this also fires off AMI events (and ARI events, IIRC).<br>> <br>> If, for whatever reason, you do not get a SECURITY log message or a<br>> corresponding event when something 'bad' happens, that would be worth<br>> some additional discussion. If anything, the events can be a bit<br>> chatty...<br>> <br>>> -----Original Message-----<br>>> From: asterisk-users<br>>> [mailto:asterisk-users-bounces@lists.digium.com] On Behalf Of sean<br>>> darcy<br>>> Sent: Wednesday, August 29, 2018 6:33 PM<br>>> To: asterisk-users@lists.digium.com<br>>> Subject: Re: [asterisk-users] getting invites to rtp ports ??<br>>> <br>>> On 08/29/2018 11:59 AM, Telium Support Group wrote:<br>>>> Block a single IP is the wrong approach (whack-a-mole). You<br>>> should consider a more comprehensive approach to securing your VoIP<br>>> environment. Have a look at this wiki:<br>>>> <br>>>> https://www.voip-info.org/asterisk-security/<br>>>> <br>>>> <br>>>> <br>>>> -----Original Message-----<br>>>> From: asterisk-users<br>>> [mailto:asterisk-users-bounces@lists.digium.com]<br>>>> On Behalf Of sean darcy<br>>>> Sent: Wednesday, August 29, 2018 10:46 AM<br>>>> To: asterisk-users@lists.digium.com<br>>>> Subject: Re: [asterisk-users] getting invites to rtp ports ??<br>>>> <br>>>> On 08/29/2018 09:42 AM, Carlos Rojas wrote:<br>>>>> Hi<br>>>>> <br>>>>> Probably somebody is trying to hack your system, you should block<br>>> <br>>>>> that ip on your firewall.<br>>>>> <br>>>>> Regards<br>>>>> <br>>>>> On Wed, Aug 29, 2018 at 9:34 AM, sean darcy <seandarcy2@gmail.com<br>>> <br>>>>> <mailto:seandarcy2@gmail.com>> wrote:<br>>>>> <br>>>>> I'm getting invites to very high ports every 30 seconds from<br>>> a<br>>>>> particular ip address:<br>>>>> <br>>>>> Retransmitting #10 (NAT) to 5.199.133.128:52734 [1]<br>>>>> <http://5.199.133.128:52734>:<br>>>>> SIP/2.0 401 Unauthorized<br>>>>> Via: SIP/2.0/UDP<br>>>>> <br>>> <br>> 0.0.0.0:52734;branch=z9hG4bK1207255353;received=5.199.133.128;rport=52734<br>>>>> From: <sip:37120116780191250@67.80.191.250<br>>>>> <br>>> <mailto:sip%3A37120116780191250@67.80.191.250>>;tag=1872048972<br>>>>> To: <sip:3712011972592181418@67.80.191.250<br>>>>> <br>>> <mailto:sip%3A3712011972592181418@67.80.191.250>>;tag=as3a52e748<br>>>>> Call-ID: 1504207870-295758084-609228182<br>>>>> CSeq: 1 INVITE<br>>>>> .......<br>>>>> WARNING[150318]: chan_sip.c:4127 retrans_pkt: Timeout on<br>>>>> 1504207870-295758084-609228182...<br>>>>> <br>>>>> I thought invites had to go to port 5060 or so. I don't<br>>> understand<br>>>>> why somebody (let's assume a bad guy) is trying ports above<br>>> 50000.<br>>>>> <br>>>>> sean<br>>>>> <br>>>>> <br>>>> <br>>>> Ok, so the high port is not the destination port but the source<br>>> port.<br>>>> <br>>>> So I hacked the log warning in chan_sip.c on non-critical invites<br>>> to show the source ip:<br>>>> <br>>>> ast_log(LOG_WARNING, "Timeout on %s non-critic invite trans from<br>>>> %s.\n",<br>>>> <br>>> <br>> pkt->owner->callid,ast_sockaddr_stringify(sip_real_dst(pkt->owner)));<br>>>> <br>>>> With that in the log, I'm now blocking the ip addresses.<br>>>> <br>>>> Thanks,<br>>>> sean<br>>>> <br>>>> <br>>>> --<br>>>> <br>>> <br>> _____________________________________________________________________<br>>>> -- Bandwidth and Colocation Provided by http://www.api-digital.com<br>>> --<br>>>> <br>>>> Astricon is coming up October 9-11! Signup is available at:<br>>>> https://www.asterisk.org/community/astricon-user-conference<br>>>> <br>>>> Check out the new Asterisk community forum at:<br>>>> https://community.asterisk.org/<br>>>> <br>>> <br>>> I agree. That's why I hacked chan_sip.c to get the addresses in the<br>>> log.<br>>> <br>>> I'm surprised they're not in the log by default. I must be the only<br>>> person who gets these "non-critical invites".<br>>> <br>>> sean<br>>> <br>>> --<br>>> <br>> _____________________________________________________________________<br>>> -- Bandwidth and Colocation Provided by http://www.api-digital.com<br>>> --<br>>> <br>>> Astricon is coming up October 9-11! Signup is available at:<br>>> https://www.asterisk.org/community/astricon-user-conference<br>>> <br>>> Check out the new Asterisk community forum at:<br>>> https://community.asterisk.org/<br>>> <br>>> New to Asterisk? Start here:<br>>> https://wiki.asterisk.org/wiki/display/AST/Getting+Started<br>>> <br>>> asterisk-users mailing list<br>>> To UNSUBSCRIBE or update options visit:<br>>> http://lists.digium.com/mailman/listinfo/asterisk-users<br>>> <br>>> --<br>>> <br>> _____________________________________________________________________<br>>> -- Bandwidth and Colocation Provided by http://www.api-digital.com<br>>> --<br>>> <br>>> Astricon is coming up October 9-11! Signup is available at:<br>>> https://www.asterisk.org/community/astricon-user-conference<br>>> <br>>> Check out the new Asterisk community forum at:<br>>> https://community.asterisk.org/<br>>> <br>>> New to Asterisk? Start here:<br>>> https://wiki.asterisk.org/wiki/display/AST/Getting+Started<br>>> <br>>> asterisk-users mailing list<br>>> To UNSUBSCRIBE or update options visit:<br>>> http://lists.digium.com/mailman/listinfo/asterisk-users<br>> <br>> --<br>> Matthew Jordan<br>> Digium, Inc. | CTO<br>> 445 Jan Davis Drive NW - Huntsville, AL 35806 - USA<br>> Check us out at: http://digium.com & http://asterisk.org<br>> <br>> Links:<br>> ------<br>> [1] http://5.199.133.128:52734<br><br>-- <br>_____________________________________________________________________<br>-- Bandwidth and Colocation Provided by http://www.api-digital.com --<br><br>Astricon is coming up October 9-11! Signup is available at: https://www.asterisk.org/community/astricon-user-conference<br><br>Check out the new Asterisk community forum at: https://community.asterisk.org/<br><br>New to Asterisk? Start here:<br> https://wiki.asterisk.org/wiki/display/AST/Getting+Started<br><br>asterisk-users mailing list<br>To UNSUBSCRIBE or update options visit:<br> http://lists.digium.com/mailman/listinfo/asterisk-users</body></html>