<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body>
<p>asterisk jobs писал 27.01.2012 06:49:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px; width:100%"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div>Hello everyone,</div>
I have noticed getting wired IPs blocked by Fail2ban. Has anyone else seen this or can explain this?
<div>
<div>Chain fail2ban-ASTERISK (1 references)</div>
<div>num target prot opt source destination </div>
<div>1 DROP all -- 0.23.20.189 <a href="http://0.0.0.0/0">0.0.0.0/0</a></div>
</div>
<div>I also get things like, 0.0.5.2, etc....Fail2ban seems to be working when I am testing. Are these numbers taken from the SIP packet or the TCP/IP protocol source because they surely are not valid addresses.</div>
<div>Thanks</div>
</blockquote>
<p>Did you find those IPs in Asterisk log?</p>
<p>If so - it isn't Fail2Ban problem, for it just parses logs and extracts substring</p>
<p> </p>
<div>
<pre><span class="sig"><span style="color: #999999;">-- </span><br /><span style="color: #999999;">With Best Regards</span><br /><span style="color: #999999;"><a title="mailto:mlischuk@itx.com.ua" href="mailto:mlischuk@itx.com.ua">Mikhail Lischuk</a></span><br /><span style="color: #999999;"><br /></span></span></pre>
<pre><span class="sig"><br /></span></pre>
</div>
</body></html>