[asterisk-users] Can't block intrusion

[Larry Moore]

On 2/04/2020 5:28 AM, Mark Boyce wrote:
> On 1 Apr 2020, at 22:14, Greg Troxel <gdt at lexort.com 
> <mailto:gdt at lexort.com>> wrote:
>>
>> I think you need to use tcpdump and turn up firewall debugging.
>
> sngrep is your friend …My bet is UDP vs TCP on firewall rules :-)
>
> Mark

Or the stateful entry still exists when the table entry is updated.

Does your script also issue a command to kill existing states from that 
host after it has updated the table, e.g.  pfctl -k 45.143.220.235

Larry.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20200402/039916cd/attachment.html>