LinuxMCE - User contributions [en]

Fail2ban - A tool against brute force

2013-02-23T05:58:56Z

Pw44:

[[Category: Networking|Firewall, fail2ban]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=pw44|1004Status=Works|1004UpdatedDate=23 January 2013|1004UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Files under /etc/asterisk/ are owned by the asterisk user, so preceed any edit commands with
sudo -u asterisk <command>

on Linuxmce 1004 no need to edit sip.conf this is implemented on asterisk realtime database.

The first thing to do is edit /etc/asterisk/sip.conf and add the following line:
alwaysauthreject=yes
My sip.conf file looks like:
............
[general]
#include sip_general_additional.conf

bindport = 5060 ; Port to bind to (SIP is 5060)
bindaddr = 0.0.0.0 ; Address to bind to (all addresses on machine)
'''alwaysauthreject=yes'''
disallow=all
allow=ulaw
allow=alaw
.............
Install fail2ban with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk, as root, with:

sudo asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

'''FOR ASTERISK 1.'''4, insert the following (copy & paste)

# Fail2Ban configuration file (for asterisk 1.4)
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

'''FOR ASTERISK 1.8''', insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Peer is not supposed to register
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - ACL error (permit/deny)
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - No matching peer found
NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - Wrong password
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
NOTICE.* .*: <HOST> failed to authenticate as '.*'
NOTICE.* .*: <HOST> tried to authenticate with nonexistent user '.*'
VERBOSE.*SIP/<HOST>-.*Received incoming SIP connection from unknown peer

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/24

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain '''fail2ban-ASTERISK''' (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain '''fail2ban-SSH''' (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this wiki helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

More protection with iptables:
http://sysadminman.net/blog/2010/limiting-sipiax-connections-to-asterisk-with-iptables-1082

Fail2ban - A tool against brute force

2013-02-23T05:57:41Z

Pw44:

[[Category: Networking|Firewall, fail2ban]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}
{{versioninfo|1004Status=Works|1004UpdatedDate=23 January 2013|1004UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Files under /etc/asterisk/ are owned by the asterisk user, so preceed any edit commands with
sudo -u asterisk <command>

on Linuxmce 1004 no need to edit sip.conf this is implemented on asterisk realtime database.

The first thing to do is edit /etc/asterisk/sip.conf and add the following line:
alwaysauthreject=yes
My sip.conf file looks like:
............
[general]
#include sip_general_additional.conf

bindport = 5060 ; Port to bind to (SIP is 5060)
bindaddr = 0.0.0.0 ; Address to bind to (all addresses on machine)
'''alwaysauthreject=yes'''
disallow=all
allow=ulaw
allow=alaw
.............
Install fail2ban with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk, as root, with:

sudo asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

'''FOR ASTERISK 1.'''4, insert the following (copy & paste)

# Fail2Ban configuration file (for asterisk 1.4)
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

'''FOR ASTERISK 1.8''', insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Peer is not supposed to register
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - ACL error (permit/deny)
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - No matching peer found
NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - Wrong password
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
NOTICE.* .*: <HOST> failed to authenticate as '.*'
NOTICE.* .*: <HOST> tried to authenticate with nonexistent user '.*'
VERBOSE.*SIP/<HOST>-.*Received incoming SIP connection from unknown peer

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/24

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain '''fail2ban-ASTERISK''' (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain '''fail2ban-SSH''' (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this wiki helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

More protection with iptables:
http://sysadminman.net/blog/2010/limiting-sipiax-connections-to-asterisk-with-iptables-1082

Fail2ban - A tool against brute force

2013-02-23T05:54:35Z

Pw44:

[[Category: Networking|Firewall, fail2ban]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Files under /etc/asterisk/ are owned by the asterisk user, so preceed any edit commands with
sudo -u asterisk <command>

on Linuxmce 1004 no need to edit sip.conf this is implemented on asterisk realtime database.

The first thing to do is edit /etc/asterisk/sip.conf and add the following line:
alwaysauthreject=yes
My sip.conf file looks like:
............
[general]
#include sip_general_additional.conf

bindport = 5060 ; Port to bind to (SIP is 5060)
bindaddr = 0.0.0.0 ; Address to bind to (all addresses on machine)
'''alwaysauthreject=yes'''
disallow=all
allow=ulaw
allow=alaw
.............
Install fail2ban with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk, as root, with:

sudo asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

'''FOR ASTERISK 1.'''4, insert the following (copy & paste)

# Fail2Ban configuration file (for asterisk 1.4)
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

'''FOR ASTERISK 1.8''', insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Peer is not supposed to register
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - ACL error (permit/deny)
NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - No matching peer found
NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - Wrong password
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
NOTICE.* .*: <HOST> failed to authenticate as '.*'
NOTICE.* .*: <HOST> tried to authenticate with nonexistent user '.*'
VERBOSE.*SIP/<HOST>-.*Received incoming SIP connection from unknown peer

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/24

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain '''fail2ban-ASTERISK''' (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain '''fail2ban-SSH''' (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this wiki helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

More protection with iptables:
http://sysadminman.net/blog/2010/limiting-sipiax-connections-to-asterisk-with-iptables-1082

Fail2ban - A tool against brute force

2013-02-23T05:51:58Z

Pw44:

Linksys SPA3102

2012-10-25T18:57:13Z

Pw44: /* PSTN Tab */

[[Category: Hardware]]
[[Category:Telecom]]
[[Category:VoIP]]
[[Category:ATA]]
{| align="right"
| __TOC__
|}

====Background====
The Linksys SPA3102/Sipura 3000 PSTN Gateways feature the ability to connect a standard telephone landline to IP-based data networks and can be configured as a SIP trunk for use with your LinuxMCE built-in telephony system.

Due to the area in which I live, there are no viable High Speed DSL/CABLE or other types of internet. I only have access to Satellite Internet, which due to the nature of the beast, has a very high latency (900 - 1400ms average) and I can not use a traditional VOIP provider like Broadvoice, Vonage, or the like. However as the telephony feature of LinuxMCE is a very cool perk to this system, I figured I would have a go at integrating my analog Verizon landline into the system. To create this SIP/Bridge I chose the Linksys SPA3102, however after scanning the FreePBX forums, I can assume they will work well with the Sipura 3000 as well. After many hours of breaking, and then fixing my phone setup, I have a working viable solution, and these steps will detail how to set up this product for use with LinuxMCE. Some of these settings are borrowed from the existing wiki's here on these products, but after using them and failing, I had a go on my own. as always if there is a better more efficient way to accomplish this, please EDIT this wiki. I am by no means an expert. :)

{{p}}

=Required items to complete this process.=

*Linksys SPA3102 or Sipura SPA3000 - Average price between $40 and $80, depending on your source. I used Newegg, because "Once you've NewEgged...."
** [http://www.newegg.com/Product/Product.aspx?Item=N82E16833124239&Tpk=spa3102 Linksys SPA3102]
* A laptop, netboox, or PC you can temporarily connect a network cable to the LAN port on the device
* A web browser for configuring the SPA and the Phone Lines in LinuxMCE webmin.
* The following file: [http://dataless.jeromenet.org/filespace/spa3102.tar.gz spa3102.tar.gz]
* Any hardwired old school phone, with touchtone.

{{p}}

=Setting up with LinuxMCE=

====Adding the new config files to your core.====

'''No longer needed, config files added to LinuxMCE 810.'''

* Download the above file to a location of your choice
** wget http://dataless.jeromenet.org/filespace/spa3102.tar.gz
* Extract/Copy/Modify the files
** tar zxvf spa3102.tar.gz
** chmod a+x create_amp_spa3102.pl
** sudo cp create_amp_spa3102.pl /usr/pluto/bin
** sudo cp provider_list.txt /etc/asterisk
*** This file is default plus my addition, if you have already modified your /etc/asterisk/provider_list.txt, you can also simply add the line:
*** Linksys SPA3102/SPA3000 http://www.cisco.com/en/US/products/ps10027 spa3102 SIP (tab seperated)
First steps completed.

{{p}}

====Adding your new Phone Line====
* Log into the webadmin of your core
* From the left hand panel, choose "Phone Lines"
* In the right panel, using the drop downs, select the new "Linksys SPA3102/SPA300" option.
* You will now be presented with 4 boxes to enter data. use the settings I have below here. (They are not UberSecure, and you can change them to what you like, just remember the username and password for later, when we configure the SPA itself)
** Username: spa3102
** Password: lmce
** Phone Number: <insert your 10 digit phone number, including your area code, like 5553221234> Very important, sets up routing, caller ID, etc.
** Host: dynamic <later in this wiki, when setting up the SPA, we will be setting a manual IP address, but this dynamic setting now, works some magic, lets leave it that way.>
** Save the file
Second steps completed. Congratulations, you just set up your FreePBX trunk!! Beer.

{{p}}

=Setting up the SPA3102/SPA3000=

====Factory reset your device (just to be on the same page.)====
* Plug your hardwire phone into the "Phone" jack on the SPA.
* Pick up the receiver on your hardwired phone
** Dial ****
** When the voice comes on dial 7 3 7 3 8#
** When prompted to confirm, press 1
Factory reset complete!

* Plug a network cable from the "WAN" port on the SPA to the internal network on your core.
* Plug a phone cable into the "Line" jack on the SPA to your wall jack.
* Plug a network cable into the "LAN" port on the SPA into your laptop, netbook, or PC.
** Once your device gets an IP address from the SPA, point your browser to http://192.168.0.1
*** By default the SPA has no passwords set for User, or Admin.
{{p}}

====WAN Setup====

* Using the image below, set up all the areas in yellow - Summary:
** Static IP
** IP - 192.168.80.200
** Netmask - 255.255.255.0
** Gateway - 192.168.80.1
** Hostname - SPA3102
** Primary DNS - 192.168.80.1
** Primary NTP - 192.168.80.1
** Set WAN server to "Yes"
You can now, and always remember to, click "Apply All Changes" at the bottom, and if you like, disconnect your device from the LAN port, and re-connect to it from your MD or regular PC.

[[Image:Spa3102-wan-setup.png]]
{{p}}

====SIP Setup====

* The only thing we need to change here is the RTP packet size
** RTP Parameters
*** RTP Packet Size - 0.020 - !!! Very important to do this !!!

[[Image:Spa3102-sip-status.png]]
{{p}}

====Regional Set Up====

* Clear out all Vertical Service Activation Codes - We want FreePBX/LMCE to control these.
** Vertical Service Activation Codes
*** Clear out all codes like shown below.

[[Image:Spa3102-regional-status.png]]
{{p}}

====PSTN Tab====

* Using the image below, set up all the areas in yellow - Summary:
** Line Enable - Yes
** SIP Settings
*** SIP port - 5061
** Proxy Settings
*** Proxy - 192.168.80.1
*** Register Expires - 300
*** Make Call Without Reg - Yes
*** Ans Call Without Reg - Yes
** Subscriber Settings
*** Display Name - Unknown Caller (this is what is displayed when a call comes in without caller ID info)
*** UserID - spa3102 (this is what you set when creating the Phone Line in the LinuxMCE webmin)
*** Password - lmce (this is what you set when creating the Phone Line in the LinuxMCE webmin)
** Dial Plans
*** A note here, do not change any of the default (xx.) settings other than Dial Plan 2 !!
**** Dial Plan 2 - (S0<:XXXXXXXXXX>) - where the X's are your 10 digit phone number including area code. - note to, that is a zero beside the S
** VoIP-To-PSTN Gateway Setup
*** VoIP-To-PSTN Gateway Enable - Yes
*** VoIP Caller Auth Method - None
*** VoIP PIN Max Retry - 3
*** One Stage Dialing - Yes - Extremely inportant setting !!!
*** Line 1 VoIP Caller DP - none
*** VoIP Caller Default DP - none
*** Line 1 Fallback DP - none
** PSTN-To-VoIP Gateway Setup
*** PSTN-To-VoIP Gateway Enable - Yes
*** PSTN Caller Auth Method - none
*** PSTN Ring Thru Line 1 - No
*** PSTN PIN Max Retry - 3
*** PSTN CID For VoIP CID - Yes
*** PSTN Caller Default DP - 2
*** Off Hook While Calling VoIP - No
*** Line 1 Signal Hook Flash To PSTN - Disabled
** FXO Timer Values (sec)
*** VoIP Answer Delay - 0 (zero)
*** PSTN Answer Delay - 3
*** Detect CPC - No
** Don't forget to "Submit All Changes"

'''For LinuxMCE 10.04 ------- CHANGE THE FOLLOWING:''' Thx to gbutters

*** Subscriber Information
*** '''User ID: XXXXXXXXXX <- your phone number including area code'''
*** '''Use Auth ID: yes'''
*** '''Auth ID: XXXXXXXXXX <- your phone number including area code'''

PSTN Tab setup complete!!! Congratualtions!! Beer!

[[Image:Spa3102-pstn-1.png]]

[[Image:Spa3102-pstn-2.png]]

[[Image:Spa3102-pstn-3.png]]

[[Image:Spa3102-pstn-4.png]]

{{p}}

=Troubleshooting=

====Dial Rules vs Dial Patterns====

One of the first issues I came across, was getting the "Your call can not be completed as dialed", and the "All circuits are busy now" Messages.
Here is what I did to overcome them.

* Dial Rules
** Log into the LinuxMCE webmin
*** From the top click Advanced > Configuration > Phones setup to get to the FreePBX admin screen.
*** In the left click on trunks
**** In the right click on the trunk you created for the spa3102
**** Look for Dial Rules:
**** Clear everything that is in it
**** Scroll to bottom, click "Submit Changes"
**** At the top of the FreePBX screen click "Apply Configuration Changes"
This does several things, including eliminating your significant other saying "Why do I have to Dial a 9 and a 1 to call next door" :)

* Dial Patterns
** In the left click "Outbound Routes"
** In the right, click the button for your spa3102 outbound routes
An explanation here as to the difference between Dial Patterns, and Dial Rules.

Dial Rules are used to add a number/character to, or strip a number/character away from anything dialed on any extension in your home. I did not need anything like this as to dial long distance, I only need enter the area code and the number, no 1 and certainly no 9.
Dial patterns are how FreePBX knows how to send a particular call to a route. You may have a route just for local long distance, and you may have a route for international calls, and then another for local calls.
In my cituation, I only need 911, local 7 digit numbers, and long distance 10 digit numbers, so here is what is in my outbound route Dial Pattern:
** N11 - For 911
** NXXNXXXXXX - For 10 digit long distance
** NXXXXXX - for regular old 7 digit local calls

That is it. I only have one trunk, and I only need it to do those 3 types of calls, so why complicate it right?
There is way more information available at:

[http://support.freepbx.org FreePBX support/Wiki/Forums].

{{p}}

=Summary=

You should now see something like this when looking at the "Info" tab:

[[Image:Spa3102-pstn-status.png]]

You will notice here that I did not have my phone line plugged in at the time, LMCE was answering calls, and I had not had the routuing set up the way I want.

All required settings should now be applied. Try to make a test call. If your MD's are not set up for making some calls, try an IP phone if you have one, or a SIP device, like an Ekiga softphone [[Ekiga]]

In addition to the PSTN setup, I will also do a wiki on configuring the "Phone" jack coming out of the SPA as an extension in LinuxMCE phones set up.
Located here: [[Linksys_SPA3102_Line_1_Extension_Set_Up]]
{{p}}

====Useful Link Goodness:====

[[Ekiga]] - Excellent write up on getting a softphone setup on your favorite Non-LinuxMCE linux box.

[[Linksys_spa-3102]] - Original SPA3102 page.

[[Linksys_spa3000_pstn_interface]] - Another home-grown wiki on the device

[http://www.freepbx.org/support/documentation/howtos/howto-linksys-spa-3102-sipura-spa-3000-freepbx The FreePBX HowTo that saved what is left of my hair]

Best Regards,

--[[User:Sethj|Sethj]] 21:13, 11 October 2010 (CEST)

Linksys SPA3102

2012-10-25T18:55:57Z

Pw44: /* PSTN Tab */

[[Category: Hardware]]
[[Category:Telecom]]
[[Category:VoIP]]
[[Category:ATA]]
{| align="right"
| __TOC__
|}

====Background====
The Linksys SPA3102/Sipura 3000 PSTN Gateways feature the ability to connect a standard telephone landline to IP-based data networks and can be configured as a SIP trunk for use with your LinuxMCE built-in telephony system.

Due to the area in which I live, there are no viable High Speed DSL/CABLE or other types of internet. I only have access to Satellite Internet, which due to the nature of the beast, has a very high latency (900 - 1400ms average) and I can not use a traditional VOIP provider like Broadvoice, Vonage, or the like. However as the telephony feature of LinuxMCE is a very cool perk to this system, I figured I would have a go at integrating my analog Verizon landline into the system. To create this SIP/Bridge I chose the Linksys SPA3102, however after scanning the FreePBX forums, I can assume they will work well with the Sipura 3000 as well. After many hours of breaking, and then fixing my phone setup, I have a working viable solution, and these steps will detail how to set up this product for use with LinuxMCE. Some of these settings are borrowed from the existing wiki's here on these products, but after using them and failing, I had a go on my own. as always if there is a better more efficient way to accomplish this, please EDIT this wiki. I am by no means an expert. :)

{{p}}

=Required items to complete this process.=

*Linksys SPA3102 or Sipura SPA3000 - Average price between $40 and $80, depending on your source. I used Newegg, because "Once you've NewEgged...."
** [http://www.newegg.com/Product/Product.aspx?Item=N82E16833124239&Tpk=spa3102 Linksys SPA3102]
* A laptop, netboox, or PC you can temporarily connect a network cable to the LAN port on the device
* A web browser for configuring the SPA and the Phone Lines in LinuxMCE webmin.
* The following file: [http://dataless.jeromenet.org/filespace/spa3102.tar.gz spa3102.tar.gz]
* Any hardwired old school phone, with touchtone.

{{p}}

=Setting up with LinuxMCE=

====Adding the new config files to your core.====

'''No longer needed, config files added to LinuxMCE 810.'''

* Download the above file to a location of your choice
** wget http://dataless.jeromenet.org/filespace/spa3102.tar.gz
* Extract/Copy/Modify the files
** tar zxvf spa3102.tar.gz
** chmod a+x create_amp_spa3102.pl
** sudo cp create_amp_spa3102.pl /usr/pluto/bin
** sudo cp provider_list.txt /etc/asterisk
*** This file is default plus my addition, if you have already modified your /etc/asterisk/provider_list.txt, you can also simply add the line:
*** Linksys SPA3102/SPA3000 http://www.cisco.com/en/US/products/ps10027 spa3102 SIP (tab seperated)
First steps completed.

{{p}}

====Adding your new Phone Line====
* Log into the webadmin of your core
* From the left hand panel, choose "Phone Lines"
* In the right panel, using the drop downs, select the new "Linksys SPA3102/SPA300" option.
* You will now be presented with 4 boxes to enter data. use the settings I have below here. (They are not UberSecure, and you can change them to what you like, just remember the username and password for later, when we configure the SPA itself)
** Username: spa3102
** Password: lmce
** Phone Number: <insert your 10 digit phone number, including your area code, like 5553221234> Very important, sets up routing, caller ID, etc.
** Host: dynamic <later in this wiki, when setting up the SPA, we will be setting a manual IP address, but this dynamic setting now, works some magic, lets leave it that way.>
** Save the file
Second steps completed. Congratulations, you just set up your FreePBX trunk!! Beer.

{{p}}

=Setting up the SPA3102/SPA3000=

====Factory reset your device (just to be on the same page.)====
* Plug your hardwire phone into the "Phone" jack on the SPA.
* Pick up the receiver on your hardwired phone
** Dial ****
** When the voice comes on dial 7 3 7 3 8#
** When prompted to confirm, press 1
Factory reset complete!

* Plug a network cable from the "WAN" port on the SPA to the internal network on your core.
* Plug a phone cable into the "Line" jack on the SPA to your wall jack.
* Plug a network cable into the "LAN" port on the SPA into your laptop, netbook, or PC.
** Once your device gets an IP address from the SPA, point your browser to http://192.168.0.1
*** By default the SPA has no passwords set for User, or Admin.
{{p}}

====WAN Setup====

* Using the image below, set up all the areas in yellow - Summary:
** Static IP
** IP - 192.168.80.200
** Netmask - 255.255.255.0
** Gateway - 192.168.80.1
** Hostname - SPA3102
** Primary DNS - 192.168.80.1
** Primary NTP - 192.168.80.1
** Set WAN server to "Yes"
You can now, and always remember to, click "Apply All Changes" at the bottom, and if you like, disconnect your device from the LAN port, and re-connect to it from your MD or regular PC.

[[Image:Spa3102-wan-setup.png]]
{{p}}

====SIP Setup====

* The only thing we need to change here is the RTP packet size
** RTP Parameters
*** RTP Packet Size - 0.020 - !!! Very important to do this !!!

[[Image:Spa3102-sip-status.png]]
{{p}}

====Regional Set Up====

* Clear out all Vertical Service Activation Codes - We want FreePBX/LMCE to control these.
** Vertical Service Activation Codes
*** Clear out all codes like shown below.

[[Image:Spa3102-regional-status.png]]
{{p}}

====PSTN Tab====

* Using the image below, set up all the areas in yellow - Summary:
** Line Enable - Yes
** SIP Settings
*** SIP port - 5061
** Proxy Settings
*** Proxy - 192.168.80.1
*** Register Expires - 300
*** Make Call Without Reg - Yes
*** Ans Call Without Reg - Yes
** Subscriber Settings
*** Display Name - Unknown Caller (this is what is displayed when a call comes in without caller ID info)
*** UserID - spa3102 (this is what you set when creating the Phone Line in the LinuxMCE webmin)
*** Password - lmce (this is what you set when creating the Phone Line in the LinuxMCE webmin)
** Dial Plans
*** A note here, do not change any of the default (xx.) settings other than Dial Plan 2 !!
**** Dial Plan 2 - (S0<:XXXXXXXXXX>) - where the X's are your 10 digit phone number including area code. - note to, that is a zero beside the S
** VoIP-To-PSTN Gateway Setup
*** VoIP-To-PSTN Gateway Enable - Yes
*** VoIP Caller Auth Method - None
*** VoIP PIN Max Retry - 3
*** One Stage Dialing - Yes - Extremely inportant setting !!!
*** Line 1 VoIP Caller DP - none
*** VoIP Caller Default DP - none
*** Line 1 Fallback DP - none
** PSTN-To-VoIP Gateway Setup
*** PSTN-To-VoIP Gateway Enable - Yes
*** PSTN Caller Auth Method - none
*** PSTN Ring Thru Line 1 - No
*** PSTN PIN Max Retry - 3
*** PSTN CID For VoIP CID - Yes
*** PSTN Caller Default DP - 2
*** Off Hook While Calling VoIP - No
*** Line 1 Signal Hook Flash To PSTN - Disabled
** FXO Timer Values (sec)
*** VoIP Answer Delay - 0 (zero)
*** PSTN Answer Delay - 3
*** Detect CPC - No
** Don't forget to "Submit All Changes"

'''For LinuxMCE 10.04 ------- CHANGE THE FOLLOWING:''' Thx to gbutters

Subscriber Information
Display Name: Unknown Caller
'''User ID: XXXXXXXXXX <- your phone number including area code'''
Password: lmce
'''Use Auth ID: yes'''
'''Auth ID: XXXXXXXXXX <- your phone number including area code'''

PSTN Tab setup complete!!! Congratualtions!! Beer!

[[Image:Spa3102-pstn-1.png]]

[[Image:Spa3102-pstn-2.png]]

[[Image:Spa3102-pstn-3.png]]

[[Image:Spa3102-pstn-4.png]]

{{p}}

=Troubleshooting=

====Dial Rules vs Dial Patterns====

One of the first issues I came across, was getting the "Your call can not be completed as dialed", and the "All circuits are busy now" Messages.
Here is what I did to overcome them.

* Dial Rules
** Log into the LinuxMCE webmin
*** From the top click Advanced > Configuration > Phones setup to get to the FreePBX admin screen.
*** In the left click on trunks
**** In the right click on the trunk you created for the spa3102
**** Look for Dial Rules:
**** Clear everything that is in it
**** Scroll to bottom, click "Submit Changes"
**** At the top of the FreePBX screen click "Apply Configuration Changes"
This does several things, including eliminating your significant other saying "Why do I have to Dial a 9 and a 1 to call next door" :)

* Dial Patterns
** In the left click "Outbound Routes"
** In the right, click the button for your spa3102 outbound routes
An explanation here as to the difference between Dial Patterns, and Dial Rules.

Dial Rules are used to add a number/character to, or strip a number/character away from anything dialed on any extension in your home. I did not need anything like this as to dial long distance, I only need enter the area code and the number, no 1 and certainly no 9.
Dial patterns are how FreePBX knows how to send a particular call to a route. You may have a route just for local long distance, and you may have a route for international calls, and then another for local calls.
In my cituation, I only need 911, local 7 digit numbers, and long distance 10 digit numbers, so here is what is in my outbound route Dial Pattern:
** N11 - For 911
** NXXNXXXXXX - For 10 digit long distance
** NXXXXXX - for regular old 7 digit local calls

That is it. I only have one trunk, and I only need it to do those 3 types of calls, so why complicate it right?
There is way more information available at:

[http://support.freepbx.org FreePBX support/Wiki/Forums].

{{p}}

=Summary=

You should now see something like this when looking at the "Info" tab:

[[Image:Spa3102-pstn-status.png]]

You will notice here that I did not have my phone line plugged in at the time, LMCE was answering calls, and I had not had the routuing set up the way I want.

All required settings should now be applied. Try to make a test call. If your MD's are not set up for making some calls, try an IP phone if you have one, or a SIP device, like an Ekiga softphone [[Ekiga]]

In addition to the PSTN setup, I will also do a wiki on configuring the "Phone" jack coming out of the SPA as an extension in LinuxMCE phones set up.
Located here: [[Linksys_SPA3102_Line_1_Extension_Set_Up]]
{{p}}

====Useful Link Goodness:====

[[Ekiga]] - Excellent write up on getting a softphone setup on your favorite Non-LinuxMCE linux box.

[[Linksys_spa-3102]] - Original SPA3102 page.

[[Linksys_spa3000_pstn_interface]] - Another home-grown wiki on the device

[http://www.freepbx.org/support/documentation/howtos/howto-linksys-spa-3102-sipura-spa-3000-freepbx The FreePBX HowTo that saved what is left of my hair]

Best Regards,

--[[User:Sethj|Sethj]] 21:13, 11 October 2010 (CEST)

Linksys SPA3102

2012-10-25T18:55:08Z

Pw44: /* PSTN Tab */

[[Category: Hardware]]
[[Category:Telecom]]
[[Category:VoIP]]
[[Category:ATA]]
{| align="right"
| __TOC__
|}

====Background====
The Linksys SPA3102/Sipura 3000 PSTN Gateways feature the ability to connect a standard telephone landline to IP-based data networks and can be configured as a SIP trunk for use with your LinuxMCE built-in telephony system.

Due to the area in which I live, there are no viable High Speed DSL/CABLE or other types of internet. I only have access to Satellite Internet, which due to the nature of the beast, has a very high latency (900 - 1400ms average) and I can not use a traditional VOIP provider like Broadvoice, Vonage, or the like. However as the telephony feature of LinuxMCE is a very cool perk to this system, I figured I would have a go at integrating my analog Verizon landline into the system. To create this SIP/Bridge I chose the Linksys SPA3102, however after scanning the FreePBX forums, I can assume they will work well with the Sipura 3000 as well. After many hours of breaking, and then fixing my phone setup, I have a working viable solution, and these steps will detail how to set up this product for use with LinuxMCE. Some of these settings are borrowed from the existing wiki's here on these products, but after using them and failing, I had a go on my own. as always if there is a better more efficient way to accomplish this, please EDIT this wiki. I am by no means an expert. :)

{{p}}

=Required items to complete this process.=

*Linksys SPA3102 or Sipura SPA3000 - Average price between $40 and $80, depending on your source. I used Newegg, because "Once you've NewEgged...."
** [http://www.newegg.com/Product/Product.aspx?Item=N82E16833124239&Tpk=spa3102 Linksys SPA3102]
* A laptop, netboox, or PC you can temporarily connect a network cable to the LAN port on the device
* A web browser for configuring the SPA and the Phone Lines in LinuxMCE webmin.
* The following file: [http://dataless.jeromenet.org/filespace/spa3102.tar.gz spa3102.tar.gz]
* Any hardwired old school phone, with touchtone.

{{p}}

=Setting up with LinuxMCE=

====Adding the new config files to your core.====

'''No longer needed, config files added to LinuxMCE 810.'''

* Download the above file to a location of your choice
** wget http://dataless.jeromenet.org/filespace/spa3102.tar.gz
* Extract/Copy/Modify the files
** tar zxvf spa3102.tar.gz
** chmod a+x create_amp_spa3102.pl
** sudo cp create_amp_spa3102.pl /usr/pluto/bin
** sudo cp provider_list.txt /etc/asterisk
*** This file is default plus my addition, if you have already modified your /etc/asterisk/provider_list.txt, you can also simply add the line:
*** Linksys SPA3102/SPA3000 http://www.cisco.com/en/US/products/ps10027 spa3102 SIP (tab seperated)
First steps completed.

{{p}}

====Adding your new Phone Line====
* Log into the webadmin of your core
* From the left hand panel, choose "Phone Lines"
* In the right panel, using the drop downs, select the new "Linksys SPA3102/SPA300" option.
* You will now be presented with 4 boxes to enter data. use the settings I have below here. (They are not UberSecure, and you can change them to what you like, just remember the username and password for later, when we configure the SPA itself)
** Username: spa3102
** Password: lmce
** Phone Number: <insert your 10 digit phone number, including your area code, like 5553221234> Very important, sets up routing, caller ID, etc.
** Host: dynamic <later in this wiki, when setting up the SPA, we will be setting a manual IP address, but this dynamic setting now, works some magic, lets leave it that way.>
** Save the file
Second steps completed. Congratulations, you just set up your FreePBX trunk!! Beer.

{{p}}

=Setting up the SPA3102/SPA3000=

====Factory reset your device (just to be on the same page.)====
* Plug your hardwire phone into the "Phone" jack on the SPA.
* Pick up the receiver on your hardwired phone
** Dial ****
** When the voice comes on dial 7 3 7 3 8#
** When prompted to confirm, press 1
Factory reset complete!

* Plug a network cable from the "WAN" port on the SPA to the internal network on your core.
* Plug a phone cable into the "Line" jack on the SPA to your wall jack.
* Plug a network cable into the "LAN" port on the SPA into your laptop, netbook, or PC.
** Once your device gets an IP address from the SPA, point your browser to http://192.168.0.1
*** By default the SPA has no passwords set for User, or Admin.
{{p}}

====WAN Setup====

* Using the image below, set up all the areas in yellow - Summary:
** Static IP
** IP - 192.168.80.200
** Netmask - 255.255.255.0
** Gateway - 192.168.80.1
** Hostname - SPA3102
** Primary DNS - 192.168.80.1
** Primary NTP - 192.168.80.1
** Set WAN server to "Yes"
You can now, and always remember to, click "Apply All Changes" at the bottom, and if you like, disconnect your device from the LAN port, and re-connect to it from your MD or regular PC.

[[Image:Spa3102-wan-setup.png]]
{{p}}

====SIP Setup====

* The only thing we need to change here is the RTP packet size
** RTP Parameters
*** RTP Packet Size - 0.020 - !!! Very important to do this !!!

[[Image:Spa3102-sip-status.png]]
{{p}}

====Regional Set Up====

* Clear out all Vertical Service Activation Codes - We want FreePBX/LMCE to control these.
** Vertical Service Activation Codes
*** Clear out all codes like shown below.

[[Image:Spa3102-regional-status.png]]
{{p}}

====PSTN Tab====

* Using the image below, set up all the areas in yellow - Summary:
** Line Enable - Yes
** SIP Settings
*** SIP port - 5061
** Proxy Settings
*** Proxy - 192.168.80.1
*** Register Expires - 300
*** Make Call Without Reg - Yes
*** Ans Call Without Reg - Yes
** Subscriber Settings
*** Display Name - Unknown Caller (this is what is displayed when a call comes in without caller ID info)
*** UserID - spa3102 (this is what you set when creating the Phone Line in the LinuxMCE webmin)
*** Password - lmce (this is what you set when creating the Phone Line in the LinuxMCE webmin)
** Dial Plans
*** A note here, do not change any of the default (xx.) settings other than Dial Plan 2 !!
**** Dial Plan 2 - (S0<:XXXXXXXXXX>) - where the X's are your 10 digit phone number including area code. - note to, that is a zero beside the S
** VoIP-To-PSTN Gateway Setup
*** VoIP-To-PSTN Gateway Enable - Yes
*** VoIP Caller Auth Method - None
*** VoIP PIN Max Retry - 3
*** One Stage Dialing - Yes - Extremely inportant setting !!!
*** Line 1 VoIP Caller DP - none
*** VoIP Caller Default DP - none
*** Line 1 Fallback DP - none
** PSTN-To-VoIP Gateway Setup
*** PSTN-To-VoIP Gateway Enable - Yes
*** PSTN Caller Auth Method - none
*** PSTN Ring Thru Line 1 - No
*** PSTN PIN Max Retry - 3
*** PSTN CID For VoIP CID - Yes
*** PSTN Caller Default DP - 2
*** Off Hook While Calling VoIP - No
*** Line 1 Signal Hook Flash To PSTN - Disabled
** FXO Timer Values (sec)
*** VoIP Answer Delay - 0 (zero)
*** PSTN Answer Delay - 3
*** Detect CPC - No
** Don't forget to "Submit All Changes"

'''For LinuxMCE 10.04 ------- CHANGE THE FOLLOWING:''' Thx to gbutters

Subscriber Information
Display Name: Unknown Caller '''User ID: XXXXXXXXXX <- your phone number including area code'''
Password: lmce '''Use Auth ID: yes'''
'''Auth ID: XXXXXXXXXX <- your phone number including area code'''

PSTN Tab setup complete!!! Congratualtions!! Beer!

[[Image:Spa3102-pstn-1.png]]

[[Image:Spa3102-pstn-2.png]]

[[Image:Spa3102-pstn-3.png]]

[[Image:Spa3102-pstn-4.png]]

{{p}}

=Troubleshooting=

====Dial Rules vs Dial Patterns====

One of the first issues I came across, was getting the "Your call can not be completed as dialed", and the "All circuits are busy now" Messages.
Here is what I did to overcome them.

* Dial Rules
** Log into the LinuxMCE webmin
*** From the top click Advanced > Configuration > Phones setup to get to the FreePBX admin screen.
*** In the left click on trunks
**** In the right click on the trunk you created for the spa3102
**** Look for Dial Rules:
**** Clear everything that is in it
**** Scroll to bottom, click "Submit Changes"
**** At the top of the FreePBX screen click "Apply Configuration Changes"
This does several things, including eliminating your significant other saying "Why do I have to Dial a 9 and a 1 to call next door" :)

* Dial Patterns
** In the left click "Outbound Routes"
** In the right, click the button for your spa3102 outbound routes
An explanation here as to the difference between Dial Patterns, and Dial Rules.

Dial Rules are used to add a number/character to, or strip a number/character away from anything dialed on any extension in your home. I did not need anything like this as to dial long distance, I only need enter the area code and the number, no 1 and certainly no 9.
Dial patterns are how FreePBX knows how to send a particular call to a route. You may have a route just for local long distance, and you may have a route for international calls, and then another for local calls.
In my cituation, I only need 911, local 7 digit numbers, and long distance 10 digit numbers, so here is what is in my outbound route Dial Pattern:
** N11 - For 911
** NXXNXXXXXX - For 10 digit long distance
** NXXXXXX - for regular old 7 digit local calls

That is it. I only have one trunk, and I only need it to do those 3 types of calls, so why complicate it right?
There is way more information available at:

[http://support.freepbx.org FreePBX support/Wiki/Forums].

{{p}}

=Summary=

You should now see something like this when looking at the "Info" tab:

[[Image:Spa3102-pstn-status.png]]

You will notice here that I did not have my phone line plugged in at the time, LMCE was answering calls, and I had not had the routuing set up the way I want.

All required settings should now be applied. Try to make a test call. If your MD's are not set up for making some calls, try an IP phone if you have one, or a SIP device, like an Ekiga softphone [[Ekiga]]

In addition to the PSTN setup, I will also do a wiki on configuring the "Phone" jack coming out of the SPA as an extension in LinuxMCE phones set up.
Located here: [[Linksys_SPA3102_Line_1_Extension_Set_Up]]
{{p}}

====Useful Link Goodness:====

[[Ekiga]] - Excellent write up on getting a softphone setup on your favorite Non-LinuxMCE linux box.

[[Linksys_spa-3102]] - Original SPA3102 page.

[[Linksys_spa3000_pstn_interface]] - Another home-grown wiki on the device

[http://www.freepbx.org/support/documentation/howtos/howto-linksys-spa-3102-sipura-spa-3000-freepbx The FreePBX HowTo that saved what is left of my hair]

Best Regards,

--[[User:Sethj|Sethj]] 21:13, 11 October 2010 (CEST)

Linksys SPA3102

2012-10-25T18:52:34Z

Pw44:

[[Category: Hardware]]
[[Category:Telecom]]
[[Category:VoIP]]
[[Category:ATA]]
{| align="right"
| __TOC__
|}

====Background====
The Linksys SPA3102/Sipura 3000 PSTN Gateways feature the ability to connect a standard telephone landline to IP-based data networks and can be configured as a SIP trunk for use with your LinuxMCE built-in telephony system.

Due to the area in which I live, there are no viable High Speed DSL/CABLE or other types of internet. I only have access to Satellite Internet, which due to the nature of the beast, has a very high latency (900 - 1400ms average) and I can not use a traditional VOIP provider like Broadvoice, Vonage, or the like. However as the telephony feature of LinuxMCE is a very cool perk to this system, I figured I would have a go at integrating my analog Verizon landline into the system. To create this SIP/Bridge I chose the Linksys SPA3102, however after scanning the FreePBX forums, I can assume they will work well with the Sipura 3000 as well. After many hours of breaking, and then fixing my phone setup, I have a working viable solution, and these steps will detail how to set up this product for use with LinuxMCE. Some of these settings are borrowed from the existing wiki's here on these products, but after using them and failing, I had a go on my own. as always if there is a better more efficient way to accomplish this, please EDIT this wiki. I am by no means an expert. :)

{{p}}

=Required items to complete this process.=

*Linksys SPA3102 or Sipura SPA3000 - Average price between $40 and $80, depending on your source. I used Newegg, because "Once you've NewEgged...."
** [http://www.newegg.com/Product/Product.aspx?Item=N82E16833124239&Tpk=spa3102 Linksys SPA3102]
* A laptop, netboox, or PC you can temporarily connect a network cable to the LAN port on the device
* A web browser for configuring the SPA and the Phone Lines in LinuxMCE webmin.
* The following file: [http://dataless.jeromenet.org/filespace/spa3102.tar.gz spa3102.tar.gz]
* Any hardwired old school phone, with touchtone.

{{p}}

=Setting up with LinuxMCE=

====Adding the new config files to your core.====

'''No longer needed, config files added to LinuxMCE 810.'''

* Download the above file to a location of your choice
** wget http://dataless.jeromenet.org/filespace/spa3102.tar.gz
* Extract/Copy/Modify the files
** tar zxvf spa3102.tar.gz
** chmod a+x create_amp_spa3102.pl
** sudo cp create_amp_spa3102.pl /usr/pluto/bin
** sudo cp provider_list.txt /etc/asterisk
*** This file is default plus my addition, if you have already modified your /etc/asterisk/provider_list.txt, you can also simply add the line:
*** Linksys SPA3102/SPA3000 http://www.cisco.com/en/US/products/ps10027 spa3102 SIP (tab seperated)
First steps completed.

{{p}}

====Adding your new Phone Line====
* Log into the webadmin of your core
* From the left hand panel, choose "Phone Lines"
* In the right panel, using the drop downs, select the new "Linksys SPA3102/SPA300" option.
* You will now be presented with 4 boxes to enter data. use the settings I have below here. (They are not UberSecure, and you can change them to what you like, just remember the username and password for later, when we configure the SPA itself)
** Username: spa3102
** Password: lmce
** Phone Number: <insert your 10 digit phone number, including your area code, like 5553221234> Very important, sets up routing, caller ID, etc.
** Host: dynamic <later in this wiki, when setting up the SPA, we will be setting a manual IP address, but this dynamic setting now, works some magic, lets leave it that way.>
** Save the file
Second steps completed. Congratulations, you just set up your FreePBX trunk!! Beer.

{{p}}

=Setting up the SPA3102/SPA3000=

====Factory reset your device (just to be on the same page.)====
* Plug your hardwire phone into the "Phone" jack on the SPA.
* Pick up the receiver on your hardwired phone
** Dial ****
** When the voice comes on dial 7 3 7 3 8#
** When prompted to confirm, press 1
Factory reset complete!

* Plug a network cable from the "WAN" port on the SPA to the internal network on your core.
* Plug a phone cable into the "Line" jack on the SPA to your wall jack.
* Plug a network cable into the "LAN" port on the SPA into your laptop, netbook, or PC.
** Once your device gets an IP address from the SPA, point your browser to http://192.168.0.1
*** By default the SPA has no passwords set for User, or Admin.
{{p}}

====WAN Setup====

* Using the image below, set up all the areas in yellow - Summary:
** Static IP
** IP - 192.168.80.200
** Netmask - 255.255.255.0
** Gateway - 192.168.80.1
** Hostname - SPA3102
** Primary DNS - 192.168.80.1
** Primary NTP - 192.168.80.1
** Set WAN server to "Yes"
You can now, and always remember to, click "Apply All Changes" at the bottom, and if you like, disconnect your device from the LAN port, and re-connect to it from your MD or regular PC.

[[Image:Spa3102-wan-setup.png]]
{{p}}

====SIP Setup====

* The only thing we need to change here is the RTP packet size
** RTP Parameters
*** RTP Packet Size - 0.020 - !!! Very important to do this !!!

[[Image:Spa3102-sip-status.png]]
{{p}}

====Regional Set Up====

* Clear out all Vertical Service Activation Codes - We want FreePBX/LMCE to control these.
** Vertical Service Activation Codes
*** Clear out all codes like shown below.

[[Image:Spa3102-regional-status.png]]
{{p}}

====PSTN Tab====

* Using the image below, set up all the areas in yellow - Summary:
** Line Enable - Yes
** SIP Settings
*** SIP port - 5061
** Proxy Settings
*** Proxy - 192.168.80.1
*** Register Expires - 300
*** Make Call Without Reg - Yes
*** Ans Call Without Reg - Yes
** Subscriber Settings
*** Display Name - Unknown Caller (this is what is displayed when a call comes in without caller ID info)
*** UserID - spa3102 (this is what you set when creating the Phone Line in the LinuxMCE webmin)
*** Password - lmce (this is what you set when creating the Phone Line in the LinuxMCE webmin)
** Dial Plans
*** A note here, do not change any of the default (xx.) settings other than Dial Plan 2 !!
**** Dial Plan 2 - (S0<:XXXXXXXXXX>) - where the X's are your 10 digit phone number including area code. - note to, that is a zero beside the S
** VoIP-To-PSTN Gateway Setup
*** VoIP-To-PSTN Gateway Enable - Yes
*** VoIP Caller Auth Method - None
*** VoIP PIN Max Retry - 3
*** One Stage Dialing - Yes - Extremely inportant setting !!!
*** Line 1 VoIP Caller DP - none
*** VoIP Caller Default DP - none
*** Line 1 Fallback DP - none
** PSTN-To-VoIP Gateway Setup
*** PSTN-To-VoIP Gateway Enable - Yes
*** PSTN Caller Auth Method - none
*** PSTN Ring Thru Line 1 - No
*** PSTN PIN Max Retry - 3
*** PSTN CID For VoIP CID - Yes
*** PSTN Caller Default DP - 2
*** Off Hook While Calling VoIP - No
*** Line 1 Signal Hook Flash To PSTN - Disabled
** FXO Timer Values (sec)
*** VoIP Answer Delay - 0 (zero)
*** PSTN Answer Delay - 3
*** Detect CPC - No
** Don't forget to "Submit All Changes"

FOR LinuxMCE 10.04 ------- CHANGE THE FOLLOWING:

Subscriber Information
Display Name: Unknown Caller User ID: XXXXXXXXXX <- your phone number including area code
Password: lmce Use Auth ID: yes
Auth ID: XXXXXXXXXX <- your phone number including area code

PSTN Tab setup complete!!! Congratualtions!! Beer!

[[Image:Spa3102-pstn-1.png]]

[[Image:Spa3102-pstn-2.png]]

[[Image:Spa3102-pstn-3.png]]

[[Image:Spa3102-pstn-4.png]]

{{p}}

=Troubleshooting=

====Dial Rules vs Dial Patterns====

One of the first issues I came across, was getting the "Your call can not be completed as dialed", and the "All circuits are busy now" Messages.
Here is what I did to overcome them.

* Dial Rules
** Log into the LinuxMCE webmin
*** From the top click Advanced > Configuration > Phones setup to get to the FreePBX admin screen.
*** In the left click on trunks
**** In the right click on the trunk you created for the spa3102
**** Look for Dial Rules:
**** Clear everything that is in it
**** Scroll to bottom, click "Submit Changes"
**** At the top of the FreePBX screen click "Apply Configuration Changes"
This does several things, including eliminating your significant other saying "Why do I have to Dial a 9 and a 1 to call next door" :)

* Dial Patterns
** In the left click "Outbound Routes"
** In the right, click the button for your spa3102 outbound routes
An explanation here as to the difference between Dial Patterns, and Dial Rules.

Dial Rules are used to add a number/character to, or strip a number/character away from anything dialed on any extension in your home. I did not need anything like this as to dial long distance, I only need enter the area code and the number, no 1 and certainly no 9.
Dial patterns are how FreePBX knows how to send a particular call to a route. You may have a route just for local long distance, and you may have a route for international calls, and then another for local calls.
In my cituation, I only need 911, local 7 digit numbers, and long distance 10 digit numbers, so here is what is in my outbound route Dial Pattern:
** N11 - For 911
** NXXNXXXXXX - For 10 digit long distance
** NXXXXXX - for regular old 7 digit local calls

That is it. I only have one trunk, and I only need it to do those 3 types of calls, so why complicate it right?
There is way more information available at:

[http://support.freepbx.org FreePBX support/Wiki/Forums].

{{p}}

=Summary=

You should now see something like this when looking at the "Info" tab:

[[Image:Spa3102-pstn-status.png]]

You will notice here that I did not have my phone line plugged in at the time, LMCE was answering calls, and I had not had the routuing set up the way I want.

All required settings should now be applied. Try to make a test call. If your MD's are not set up for making some calls, try an IP phone if you have one, or a SIP device, like an Ekiga softphone [[Ekiga]]

In addition to the PSTN setup, I will also do a wiki on configuring the "Phone" jack coming out of the SPA as an extension in LinuxMCE phones set up.
Located here: [[Linksys_SPA3102_Line_1_Extension_Set_Up]]
{{p}}

====Useful Link Goodness:====

[[Ekiga]] - Excellent write up on getting a softphone setup on your favorite Non-LinuxMCE linux box.

[[Linksys_spa-3102]] - Original SPA3102 page.

[[Linksys_spa3000_pstn_interface]] - Another home-grown wiki on the device

[http://www.freepbx.org/support/documentation/howtos/howto-linksys-spa-3102-sipura-spa-3000-freepbx The FreePBX HowTo that saved what is left of my hair]

Best Regards,

--[[User:Sethj|Sethj]] 21:13, 11 October 2010 (CEST)

Asterisk Extension with Nokia Phone

2010-10-23T13:06:06Z

Pw44:

[[Category:Telecom]]
[[Category:Phone Lines]]
[[Category:VoIP]]
[[Category:Tutorials]]
{{versioninfo|810Status=Works|810UpdatedDate=13 October 2010|810UpdatedBy=PW44}}

Imagine being on vacations and someone calls your home phone number and your mobile rings.

With phones having SIP clients, it's possible to have an extension of your home system.

My Nokia N95 became an extension of my home system, and i will describe how.

Webadmin -> Wizard -> Phones -> Add Device.

Select Generic Sip Phone (device template #1734)-> Pick device.

Take note of the extension number and extension number password. You will need to inform it in the Nokia configuration below.

After done, configure you Nokia like:

# configure your phone with your home wireless access point and make sure that phone can navigate. By default it will ask for a DHCP leased IP, so it will be hooked to the 192.168.80.* subnet
# go to Menu -> Tools -> Settings -> Connections -> SIP settings and create e new profile with the following config:
# Profile Name : name of your choice
# Service profile : IETF
# Default access point : your access point
# Public user name : sip:userid@192.168.80.1 (where userid should be the extension number created in webadmin)
# Use compression : no
# Registration : always on
# Use security : no
# Proxy Server
# Proxy server address : sip:192.168.80.1
# Realm : asterisk (it is asterisk by default, unless it is differently set in /etc/asterisk/sip.conf)
# User name : extension number
# Password : extension number password
# Allow loose routing : yes
# Transport type : UDP
# Port : 5060
# Registrar server
# Registrar serv. addr. : sip:192.168.80.1
# Realm : none
# User name : extension number
# Password : none
# Transport type : UDP
# Port : 5060
# Save all
# Go to Menu -> Tools -> Settings -> Connections -> Internet Tel and create a new Internet Tel profile, chossing the SIP profile you created before.

If everything is right, you will be able to place "internet calls" from the Nokia Phone, which acts as a telefone device of your system.

If you plan to have it also working from outside your home, i suggest you enable a PPTP server and get SymVPN, a PPTP client for Symbian.

Have this configured, i do have two sip profiles, one for inside the house and other for outside, enbling me to have an extension of my telecom system from any wifi spot, public or not, even at my work.

Fail2ban - A tool against brute force

2010-10-15T21:04:03Z

Pw44:

[[Category: Tutorials]]
[[Category: Networking]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Files under /etc/asterisk/ are owned by the asterisk user, so preceed any edit commands with
sudo -u asterisk <command>
The first thing to do is edit /etc/asterisk/sip.conf and add the following line:
alwaysauthreject=yes
My sip.conf file looks like:
............
[general]
#include sip_general_additional.conf

bindport = 5060 ; Port to bind to (SIP is 5060)
bindaddr = 0.0.0.0 ; Address to bind to (all addresses on machine)
'''alwaysauthreject=yes'''
disallow=all
allow=ulaw
allow=alaw
.............
Install fail2ban with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk, as root, with:

sudo asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/24

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain '''fail2ban-ASTERISK''' (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain '''fail2ban-SSH''' (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this wiki helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

More protection with iptables:
http://sysadminman.net/blog/2010/limiting-sipiax-connections-to-asterisk-with-iptables-1082

Asterisk Extension with Nokia Phone

2010-10-13T22:34:58Z

Pw44:

[[Category:VOIP Setups]]
[[Category:Telecom]]
[[Category:Phone Lines]]
[[Category:Tutorials]]
{{versioninfo|810Status=Works|810UpdatedDate=13 October 2010|810UpdatedBy=PW44}}

Imagine being on vacations and someone calls your home phone number and your mobile rings.

With phones having SIP clients, it's possible to have an extension of your home system.

My Nokia N95 became an extension of my home system, and i will describe how.

Webadmin -> Wizard -> Phones -> Add Device.

Select Generic Sip Phone (device template #1734)-> Pick device.

Take note of the extension number and extension number password. You will need to inform it in the Nokia configuration below.

After done, configure you Nokia like:

# configure your phone with your home wireless access point and make sure that phone can navigate. By default it will ask for a DHCP leased IP, so it will be hooked to the 192.168.80.* subnet
# go to Menu -> Tools -> Settings -> Connections -> SIP settings and create e new profile with the following config:
# Profile Name : name of your choice
# Service profile : IETF
# Default access point : your access point
# Public user name : sip:userid@192.168.80.1 (where userid should be the ext number you defined earlier in AMP)
# Use compression : no
# Registration : always on
# Use security : no
# Proxy Server
# Proxy server address : sip:192.168.80.1
# Realm : asterisk (it is asterisk by default, unless it is differently set in /etc/asterisk/sip.conf)
# User name : extension number
# Password : extension number password
# Allow loose routing : yes
# Transport type : UDP
# Port : 5060
# Registrar server
# Registrar serv. addr. : sip:192.168.80.1
# Realm : none
# User name : extension number
# Password : none
# Transport type : UDP
# Port : 5060
# Save all
# Go to Menu -> Tools -> Settings -> Connections -> Internet Tel and create a new Internet Tel profile, chossing the SIP profile you created before.

If everything is right, you will be able to place "internet calls" from the Nokia Phone, which acts as a telefone device of your system.

If you plan to have it also working from outside your home, i suggest you enable a PPTP server and get SymVPN, a PPTP client for Symbian.

Have this configured, i do have two sip profiles, one for inside the house and other for outside, enbling me to have an extension of my telecom system from any wifi spot, public or not, even at my work.

Asterisk Extension with Nokia Phone

2010-10-13T22:34:29Z

Pw44:

[[Category:VOIP Setups]]
[[Category:Telecom]]
[[Category:Phone Lines]]
[[Category:Tutorials]]
{{versioninfo|810Status=Works|810UpdatedDate=13 October 2010|810UpdatedBy=PW44}}

Imagine being on vacations and someone calls your home phone number and your mobile rings.

With phones having SIP clients, it's possible to have an extension of your home system.

My Nokia N95 became an extension of my home system, and i will describe how.

Webadmin -> Wizard -> Phones -> Add Device.

Select Generic Sip Phone (device template #1734)-> Pick device.

Take note of the extension number and extension number password. You will need to inform it in the Nokia configuration below.

After done, configure you Nokia like:

# configure your phone with your home wireless access point and make sure that phone can navigate. By default it will ask for a DHCP leased IP, so it will be hooked to the 192.168.80.* subnet
# go to Menu -> Tools -> Settings -> Connections -> SIP settings and create e new profile with the following config:
# Profile Name : name of your choice
# Service profile : IETF
# Default access point : your access point
# Public user name : sip:userid@192.168.80.1 (where userid should be the ext number you defined earlier in AMP)
# Use compression : no
# Registration : always on
# Use security : no
# Proxy Server
# Proxy server address : sip:192.168.80.1
# Realm : asterisk (it is asterisk by default, unless it is differently set in /etc/asterisk/sip.conf)
# User name : extension number
# Password : extension number password
# Allow loose routing : yes
# Transport type : UDP
# Port : 5060
# Registrar server
# Registrar serv. addr. : sip:192.168.80.1
# Realm : none
# User name : extension number
# Password : none
# Transport type : UDP
# Port : 5060
# Save all
# Go to Menu -> Tools -> Settings -> Connections -> Internet Tel and create a new Internet Tel profile, chossing the SIP profile you created before.

If everything is right, you will be able to place "internet calls"from the Nokia Phone, which acts as a telefone device of your system.

If you plan to have it also working from outside your home, i suggest you enable a PPTP server and get SymVPN, a PPTP client for Symbian.

Have this configured, i do have two sip profiles, one for inside the house and other for outside, enbling me to have an extension of my telecom system from any wifi spot, public or not, even at my work.

Asterisk Extension with Nokia Phone

2010-10-13T22:33:55Z

Pw44:

[[Category:VOIP Setups]]
[[Category:Telecom]]
[[Category:Phone Lines]]
[[Category:Tutorials]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=PW44}}

Imagine being on vacations and someone calls your home phone number and your mobile rings.

With phones having SIP clients, it's possible to have an extension of your home system.

My Nokia N95 became an extension of my home system, and i will describe how.

Webadmin -> Wizard -> Phones -> Add Device.

Select Generic Sip Phone (device template #1734)-> Pick device.

Take note of the extension number and extension number password. You will need to inform it in the Nokia configuration below.

After done, configure you Nokia like:

# configure your phone with your home wireless access point and make sure that phone can navigate. By default it will ask for a DHCP leased IP, so it will be hooked to the 192.168.80.* subnet
# go to Menu -> Tools -> Settings -> Connections -> SIP settings and create e new profile with the following config:
# Profile Name : name of your choice
# Service profile : IETF
# Default access point : your access point
# Public user name : sip:userid@192.168.80.1 (where userid should be the ext number you defined earlier in AMP)
# Use compression : no
# Registration : always on
# Use security : no
# Proxy Server
# Proxy server address : sip:192.168.80.1
# Realm : asterisk (it is asterisk by default, unless it is differently set in /etc/asterisk/sip.conf)
# User name : extension number
# Password : extension number password
# Allow loose routing : yes
# Transport type : UDP
# Port : 5060
# Registrar server
# Registrar serv. addr. : sip:192.168.80.1
# Realm : none
# User name : extension number
# Password : none
# Transport type : UDP
# Port : 5060
# Save all
# Go to Menu -> Tools -> Settings -> Connections -> Internet Tel and create a new Internet Tel profile, chossing the SIP profile you created before.

If everything is right, you will be able to place "internet calls"from the Nokia Phone, which acts as a telefone device of your system.

If you plan to have it also working from outside your home, i suggest you enable a PPTP server and get SymVPN, a PPTP client for Symbian.

Have this configured, i do have two sip profiles, one for inside the house and other for outside, enbling me to have an extension of my telecom system from any wifi spot, public or not, even at my work.

Asterisk Extension with Nokia Phone

2010-10-13T22:32:17Z

Pw44: New page: Category:VOIP Setups Category:Telecom Category:Phone Lines Category:Tutorials {{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=PW44}} Imagine being...

[[Category:VOIP Setups]]
[[Category:Telecom]]
[[Category:Phone Lines]]
[[Category:Tutorials]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=PW44}}

Imagine being on vacations and someone calls your home phone number and your mobile rings.

With phones having SIP clients, it's possible to have an extension of your home system.

My Nokia N95 became an extension of my home system, and i will describe how.

Webadmin -> Wizard -> Phones -> Add Device.

Select Generic Sip Phone (device template #1734)-> Pick device.

As you would do with any generic SIP phone. Take note of the extension number and extension number password. You will need to inform it in the Nokia configuration below.

After done, configure you Nokia like:

# configure your phone with your home wireless access point and make sure that phone can navigate. By default it will ask for a DHCP leased IP, so it will be hooked to the 192.168.80.* subnet
# go to Menu -> Tools -> Settings -> Connections -> SIP settings and create e new profile with the following config:
# Profile Name : name of your choice
# Service profile : IETF
# Default access point : your access point
# Public user name : sip:userid@192.168.80.1 (where userid should be the ext number you defined earlier in AMP)
# Use compression : no
# Registration : always on
# Use security : no
# Proxy Server
# Proxy server address : sip:192.168.80.1
# Realm : asterisk (it is asterisk by default, unless it is differently set in /etc/asterisk/sip.conf)
# User name : extension number
# Password : extension number password
# Allow loose routing : yes
# Transport type : UDP
# Port : 5060
# Registrar server
# Registrar serv. addr. : sip:192.168.80.1
# Realm : none
# User name : extension number
# Password : none
# Transport type : UDP
# Port : 5060
# Save all
# Go to Menu -> Tools -> Settings -> Connections -> Internet Tel and create a new Internet Tel profile, chossing the SIP profile you created before.

If everything is right, you will be able to place "internet calls"from the Nokia Phone, which acts as a telefone device of your system.

If you plan to have it also working from outside your home, i suggest you enable a PPTP server and get SymVPN, a PPTP client for Symbian.

Have this configured, i do have two sip profiles, one for inside the house and other for outside, enbling me to have an extension of my telecom system from any wifi spot, public or not, even at my work.

Linksys SPA3102

2010-10-11T21:18:01Z

Pw44:

[[Category: Hardware]]
{| align="right"
| __TOC__
|}

[[Category:Tutorials]]
[[Category:Telecom]]
[[Category:Voip]]
====Background====
The Linksys SPA3102/Sipura 3000 PSTN Gateways feature the ability to connect a standard telephone landline to IP-based data networks and can be configured as a SIP trunk for use with your LinuxMCE built-in telephony system.

Due to the area in which I live, there are no viable High Speed DSL/CABLE or other types of internet. I only have access to Satellite Internet, which due to the nature of the beast, has a very high latency (900 - 1400ms average) and I can not use a traditional VOIP provider like Broadvoice, Vonage, or the like. However as the telephony feature of LinuxMCE is a very cool perk to this system, I figured I would have a go at integrating my analog Verizon landline into the system. To create this SIP/Bridge I chose the Linksys SPA3102, however after scanning the FreePBX forums, I can assume they will work well with the Sipura 3000 as well. After many hours of breaking, and then fixing my phone setup, I have a working viable solution, and these steps will detail how to set up this product for use with LinuxMCE. Some of these settings are borrowed from the existing wiki's here on these products, but after using them and failing, I had a go on my own. as always if there is a better more efficient way to accomplish this, please EDIT this wiki. I am by no means an expert. :)

=Required items to complete this process.=

*Linksys SPA3102 or Sipura SPA3000 - Average price between $40 and $80, depending on your source. I used Newegg, because "Once you've NewEgged...."
** [http://www.newegg.com/Product/Product.aspx?Item=N82E16833124239&Tpk=spa3102 Linksys SPA3102]
* A laptop, netboox, or PC you can temporarily connect a network cable to the LAN port on the device
* A web browser for configuring the SPA and the Phone Lines in LinuxMCE webmin.
* The following file: [http://dataless.jeromenet.org/filespace/spa3102.tar.gz spa3102.tar.gz]
* Any hardwired old school phone, with touchtone.

=Setting up with LinuxMCE=

====Adding the new config files to your core.====
* Download the above file to a location of your choice
** wget http://dataless.jeromenet.org/filespace/spa3102.tar.gz
* Extract/Copy/Modify the files
** tar zxvf spa3102.tar.gz
** chmod a+x create_amp_spa3102.pl
** sudo cp create_amp_spa3102.pl /usr/pluto/bin
** sudo cp provider_list.txt /etc/asterisk
*** This file is default plus my addition, if you have already modified your /etc/asterisk/provider_list.txt, you can also simply add the line:
*** Linksys SPA3102/SPA3000 http://www.cisco.com/en/US/products/ps10027 spa3102 SIP (tab seperated)
First steps completed.

====Adding your new Phone Line====
* Log into the webadmin of your core
* From the left hand panel, choose "Phone Lines"
* In the right panel, using the drop downs, select the new "Linksys SPA3102/SPA300" option.
* You will now be presented with 4 boxes to enter data. use the settings I have below here. (They are not UberSecure, and you can change them to what you like, just remember the username and password for later, when we configure the SPA itself)
** Username: spa3102
** Password: lmce
** Phone Number: <insert your 10 digit phone number, including your area code, like 5553221234> Very important, sets up routing, caller ID, etc.
** Host: dynamic <later in this wiki, when setting up the SPA, we will be setting a manual IP address, but this dynamic setting now, works some magic, lets leave it that way.>
** Save the file
Second steps completed. Congratulations, you just set up your FreePBX trunk!! Beer.

=Setting up the SPA3102/SPA3000=

====Factory reset your device (just to be on the same page.)====
* Plug your hardwire phone into the "Phone" jack on the SPA.
* Pick up the receiver on your hardwired phone
** Dial ****
** When the voice comes on dial 7 3 7 3 8#
** When prompted to confirm, press 1
Factory reset complete!

* Plug a network cable from the "WAN" port on the SPA to the internal network on your core.
* Plug a phone cable into the "Line" jack on the SPA to your wall jack.
* Plug a network cable into the "LAN" port on the SPA into your laptop, netbook, or PC.
** Once your device gets an IP address from the SPA, point your browser to http://192.168.0.1
*** By default the SPA has no passwords set for User, or Admin.

====WAN Setup====

* Using the image below, set up all the areas in yellow - Summary:
** Static IP
** IP - 192.168.80.200
** Netmask - 255.255.255.0
** Gateway - 192.168.80.1
** Hostname - SPA3102
** Primary DNS - 192.168.80.1
** Primary NTP - 192.168.80.1
** Set WAN server to "Yes"
You can now, and always remember to, click "Apply All Changes" at the bottom, and if you like, disconnect your device from the LAN port, and re-connect to it from your MD or regular PC.

[[Image:Spa3102-wan-setup.png]]

====SIP Setup====

* The only thing we need to change here is the RTP packet size
** RTP Parameters
*** RTP Packet Size - 0.020 - !!! Very important to do this !!!

[[Image:Spa3102-sip-status.png]]

====Regional Set Up====

* Clear out all Vertical Service Activation Codes - We want FreePBX/LMCE to control these.
** Vertical Service Activation Codes
*** Clear out all codes like shown below.

[[Image:Spa3102-regional-status.png]]

====PSTN Tab====

* Using the image below, set up all the areas in yellow - Summary:
** Line Enable - Yes
** SIP Settings
*** SIP port - 5061
** Proxy Settings
*** Proxy - 192.168.80.1
*** Register Expires - 300
*** Make Call Without Reg - Yes
*** Ans Call Without Reg - Yes
** Subscriber Settings
*** Display Name - Unknown Caller (this is what is displayed when a call comes in without caller ID info)
*** UserID - spa3102 (this is what you set when creating the Phone Line in the LinuxMCE webmin)
*** Password - lmce (this is what you set when creating the Phone Line in the LinuxMCE webmin)
** Dial Plans
*** A note here, do not change any of the default (xx.) settings other than Dial Plan 2 !!
**** Dial Plan 2 - (S0<:XXXXXXXXXX>) - where the X's are your 10 digit phone number including area code. - note to, that is a zero beside the S
** VoIP-To-PSTN Gateway Setup
*** VoIP-To-PSTN Gateway Enable - Yes
*** VoIP Caller Auth Method - None
*** VoIP PIN Max Retry - 3
*** One Stage Dialing - Yes - Extremely inportant setting !!!
*** Line 1 VoIP Caller DP - none
*** VoIP Caller Default DP - none
*** Line 1 Fallback DP - none
** PSTN-To-VoIP Gateway Setup
*** PSTN-To-VoIP Gateway Enable - Yes
*** PSTN Caller Auth Method - none
*** PSTN Ring Thru Line 1 - No
*** PSTN PIN Max Retry - 3
*** PSTN CID For VoIP CID - Yes
*** PSTN Caller Default DP - 2
*** Off Hook While Calling VoIP - No
*** Line 1 Signal Hook Flash To PSTN - Disabled
** FXO Timer Values (sec)
*** VoIP Answer Delay - 0 (zero)
*** PSTN Answer Delay - 3
*** Detect CPC - No
** Don't forget to "Submit All Changes"

PSTN Tab setup complete!!! Congratualtions!! Beer!

[[Image:Spa3102-pstn-1.png]]

[[Image:Spa3102-pstn-2.png]]

[[Image:Spa3102-pstn-3.png]]

[[Image:Spa3102-pstn-4.png]]

=Troubleshooting=

====Dial Rules vs Dial Patterns====

One of the first issues I came across, was getting the "Your call can not be completed as dialed", and the "All circuits are busy now" Messages.
Here is what I did to overcome them.

* Dial Rules
** Log into the LinuxMCE webmin
*** From the top click Advanced > Configuration > Phones setup to get to the FreePBX admin screen.
*** In the left click on trunks
**** In the right click on the trunk you created for the spa3102
**** Look for Dial Rules:
**** Clear everything that is in it
**** Scroll to bottom, click "Submit Changes"
**** At the top of the FreePBX screen click "Apply Configuration Changes"
This does several things, including eliminating your significant other saying "Why do I have to Dial a 9 and a 1 to call next door" :)

* Dial Patterns
** In the left click "Outbound Routes"
** In the right, click the button for your spa3102 outbound routes
An explanation here as to the difference between Dial Patterns, and Dial Rules.

Dial Rules are used to add a number/character to, or strip a number/character away from anything dialed on any extension in your home. I did not need anything like this as to dial long distance, I only need enter the area code and the number, no 1 and certainly no 9.
Dial patterns are how FreePBX knows how to send a particular call to a route. You may have a route just for local long distance, and you may have a route for international calls, and then another for local calls.
In my cituation, I only need 911, local 7 digit numbers, and long distance 10 digit numbers, so here is what is in my outbound route Dial Pattern:
** N11 - For 911
** NXXNXXXXXX - For 10 digit long distance
** NXXXXXX - for regular old 7 digit local calls

That is it. I only have one trunk, and I only need it to do those 3 types of calls, so why complicate it right?
There is way more information available at:

[http://support.freepbx.org FreePBX support/Wiki/Forums].

=Summary=

You should now see something like this when looking at the "Info" tab:

[[Image:Spa3102-pstn-status.png]]

You will notice here that I did not have my phone line plugged in at the time, LMCE was answering calls, and I had not had the routuing set up the way I want.

All required settings should now be applied. Try to make a test call. If your MD's are not set up for making some calls, try an IP phone if you have one, or a SIP device, like an Ekiga softphone [[Ekiga]]

In addition to the PSTN setup, I will also do a wiki on configuring the "Phone" jack coming out of the SPA as an extension in LinuxMCE phones set up.
Located here: [[Linksys_SPA3102_Line_1_Extension_Set_Up#Configure_the_Line_1_Tab]]

====Useful Link Goodness:====

[[Ekiga]] - Excellent write up on getting a softphone setup on your favorite Non-LinuxMCE linux box.

[[Linksys_spa-3102]] - Original SPA3102 page.

[[Linksys_spa3000_pstn_interface]] - Another home-grown wiki on the device

[http://www.freepbx.org/support/documentation/howtos/howto-linksys-spa-3102-sipura-spa-3000-freepbx The FreePBX HowTo that saved what is left of my hair]

Best Regards,

--[[User:Sethj|Sethj]] 21:13, 11 October 2010 (CEST)

Linksys SPA3102

2010-10-11T20:23:38Z

Pw44:

[[Category: Hardware]]
{| align="right"
| __TOC__
|}

[[Category:Tutorials]]
[[Category:Telecom]]
[[Category:Voip]]
====Background====
The Linksys SPA3102/Sipura 3000 PSTN Gateways feature the ability to connect a standard telephone landline to IP-based data networks and can be configured as a SIP trunk for use with your LinuxMCE built-in telephony system.

Due to the area in which I live, there are no viable High Speed DSL/CABLE or other types of internet. I only have access to Satellite Internet, which due to the nature of the beast, has a very high latency (900 - 1400ms average) and I can not use a traditional VOIP provider like Broadvoice, Vonage, or the like. However as the telephony feature of LinuxMCE is a very cool perk to this system, I figured I would have a go at integrating my analog Verizon landline into the system. To create this SIP/Bridge I chose the Linksys SPA3102, however after scanning the FreePBX forums, I can assume they will work well with the Sipura 3000 as well. After many hours of breaking, and then fixing my phone setup, I have a working viable solution, and these steps will detail how to set up this product for use with LinuxMCE. Some of these settings are borrowed from the existing wiki's here on these products, but after using them and failing, I had a go on my own. as always if there is a better more efficient way to accomplish this, please EDIT this wiki. I am by no means an expert. :)

=Required items to complete this process.=

*Linksys SPA3102 or Sipura SPA3000 - Average price between $40 and $80, depending on your source. I used Newegg, because "Once you've NewEgged...."
** [http://www.newegg.com/Product/Product.aspx?Item=N82E16833124239&Tpk=spa3102 Linksys SPA3102]
* A laptop, netboox, or PC you can temporarily connect a network cable to the LAN port on the device
* A web browser for configuring the SPA and the Phone Lines in LinuxMCE webmin.
* The following file: [http://dataless.jeromenet.org/filespace/spa3102.tar.gz spa3102.tar.gz]
* Any hardwired old school phone, with touchtone.

=Setting up with LinuxMCE=

====Adding the new config files to your core.====
* Download the above file to a location of your choice
** wget http://dataless.jeromenet.org/filespace/spa3102.tar.gz
* Extract/Copy/Modify the files
** tar zxvf spa3102.tar.gz
** chmod a+x create_amp_spa3102.pl
** sudo cp create_amp_spa3102.pl /usr/pluto/bin
** sudo cp provider_list.txt /etc/asterisk
*** This file is default plus my addition, if you have already modified your /etc/asterisk/provider_list.txt, you can also simply add the line:
*** Linksys SPA3102/SPA3000 http://www.cisco.com/en/US/products/ps10027 spa3102 SIP (tab seperated)
First steps completed.

====Adding your new Phone Line====
* Log into the webadmin of your core
* From the left hand panel, choose "Phone Lines"
* In the right panel, using the drop downs, select the new "Linksys SPA3102/SPA300" option.
* You will now be presented with 4 boxes to enter data. use the settings I have below here. (They are not UberSecure, and you can change them to what you like, just remember the username and password for later, when we configure the SPA itself)
** Username: spa3102
** Password: lmce
** Phone Number: <insert your 10 digit phone number, including your area code, like 5553221234> Very important, sets up routing, caller ID, etc.
** Host: dynamic <later in this wiki, when setting up the SPA, we will be setting a manual IP address, but this dynamic setting now, works some magic, lets leave it that way.>
** Save the file
Second steps completed. Congratulations, you just set up your FreePBX trunk!! Beer.

=Setting up the SPA3102/SPA3000=

====Factory reset your device (just to be on the same page.)====
* Plug your hardwire phone into the "Phone" jack on the SPA.
* Pick up the receiver on your hardwired phone
** Dial ****
** When the voice comes on dial 7 3 7 3 8#
** When prompted to confirm, press 1
Factory reset complete!

* Plug a network cable from the "WAN" port on the SPA to the internal network on your core.
* Plug a phone cable into the "Line" jack on the SPA to your wall jack.
* Plug a network cable into the "LAN" port on the SPA into your laptop, netbook, or PC.
** Once your device gets an IP address from the SPA, point your browser to http://192.168.0.1
*** By default the SPA has no passwords set for User, or Admin.

====WAN Setup====

* Using the image below, set up all the areas in yellow - Summary:
** Static IP
** IP - 192.168.80.200
** Netmask - 255.255.255.0
** Gateway - 192.168.80.1
** Hostname - SPA3102
** Primary DNS - 192.168.80.1
** Primary NTP - 192.168.80.1
** Set WAN server to "Yes"
You can now, and always remember to, click "Apply All Changes" at the bottom, and if you like, disconnect your device from the LAN port, and re-connect to it from your MD or regular PC.

[[Image:Spa3102-wan-setup.png]]

====SIP Setup====

* The only thing we need to change here is the RTP packet size
** RTP Parameters
*** RTP Packet Size - 0.020 - !!! Very important to do this !!!

[[Image:Spa3102-sip-status.png]]

====Regional Set Up====

* Clear out all Vertical Service Activation Codes - We want FreePBX/LMCE to control these.
** Vertical Service Activation Codes
*** Clear out all codes like shown below.

[[Image:Spa3102-regional-status.png]]

====PSTN Tab====

* Using the image below, set up all the areas in yellow - Summary:
** Line Enable - Yes
** SIP Settings
*** SIP port - 5061
** Proxy Settings
*** Proxy - 192.168.80.1
*** Register Expires - 300
*** Make Call Without Reg - Yes
*** Ans Call Without Reg - Yes
** Subscriber Settings
*** Display Name - Unknown Caller (this is what is displayed when a call comes in without caller ID info)
*** UserID - spa3102 (this is what you set when creating the Phone Line in the LinuxMCE webmin)
*** Password - lmce (this is what you set when creating the Phone Line in the LinuxMCE webmin)
** Dial Plans
*** A note here, do not change any of the default (xx.) settings other than Dial Plan 2 !!
**** Dial Plan 2 - (S0<:XXXXXXXXXX>) - where the X's are your 10 digit phone number including area code. - note to, that is a zero beside the S
** VoIP-To-PSTN Gateway Setup
*** VoIP-To-PSTN Gateway Enable - Yes
*** VoIP Caller Auth Method - None
*** VoIP PIN Max Retry - 3
*** One Stage Dialing - Yes - Extremely inportant setting !!!
*** Line 1 VoIP Caller DP - none
*** VoIP Caller Default DP - none
*** Line 1 VoIP Caller DP - none
*** Line 1 Fallback DP - none
** PSTN-To-VoIP Gateway Setup
*** PSTN-To-VoIP Gateway Enable - Yes
*** PSTN Caller Auth Method - none
*** PSTN Ring Thru Line 1 - No
*** PSTN PIN Max Retry - 3
*** PSTN CID For VoIP CID - Yes
*** PSTN Caller Default DP - 2
*** Off Hook While Calling VoIP - No
*** Line 1 Signal Hook Flash To PSTN - Disabled
** FXO Timer Values (sec)
*** VoIP Answer Delay - 0 (zero)
*** PSTN Answer Delay - 3
*** Detect CPC - No
** Don't forget to "Submit All Changes"

PSTN Tab setup complete!!! Congratualtions!! Beer!

[[Image:Spa3102-pstn-1.png]]

[[Image:Spa3102-pstn-2.png]]

[[Image:Spa3102-pstn-3.png]]

[[Image:Spa3102-pstn-4.png]]

=Troubleshooting=

====Dial Rules vs Dial Patterns====

One of the first issues I came across, was getting the "Your call can not be completed as dialed", and the "All circuits are busy now" Messages.
Here is what I did to overcome them.

* Dial Rules
** Log into the LinuxMCE webmin
*** From the top click Advanced > Configuration > Phones setup to get to the FreePBX admin screen.
*** In the left click on trunks
**** In the right click on the trunk you created for the spa3102
**** Look for Dial Rules:
**** Clear everything that is in it
**** Scroll to bottom, click "Submit Changes"
**** At the top of the FreePBX screen click "Apply Configuration Changes"
This does several things, including eliminating your significant other saying "Why do I have to Dial a 9 and a 1 to call next door" :)

* Dial Patterns
** In the left click "Outbound Routes"
** In the right, click the button for your spa3102 outbound routes
An explanation here as to the difference between Dial Patterns, and Dial Rules.

Dial Rules are used to add a number/character to, or strip a number/character away from anything dialed on any extension in your home. I did not need anything like this as to dial long distance, I only need enter the area code and the number, no 1 and certainly no 9.
Dial patterns are how FreePBX knows how to send a particular call to a route. You may have a route just for local long distance, and you may have a route for international calls, and then another for local calls.
In my cituation, I only need 911, local 7 digit numbers, and long distance 10 digit numbers, so here is what is in my outbound route Dial Pattern:
** N11 - For 911
** NXXNXXXXXX - For 10 digit long distance
** NXXXXXX - for regular old 7 digit local calls

That is it. I only have one trunk, and I only need it to do those 3 types of calls, so why complicate it right?
There is way more information available at:

[http://support.freepbx.org FreePBX support/Wiki/Forums].

=Summary=

You should now see something like this when looking at the "Info" tab:

[[Image:Spa3102-pstn-status.png]]

You will notice here that I did not have my phone line plugged in at the time, LMCE was answering calls, and I had not had the routuing set up the way I want.

All required settings should now be applied. Try to make a test call. If your MD's are not set up for making some calls, try an IP phone if you have one, or a SIP device, like an Ekiga softphone [[Ekiga]]

In addition to the PSTN setup, I will also do a wiki on configuring the "Phone" jack coming out of the SPA as an extension in LinuxMCE phones set up.
Located here: [[Linksys_SPA3102_Line_1_Extension_Set_Up#Configure_the_Line_1_Tab]]

====Useful Link Goodness:====

[[Ekiga]] - Excellent write up on getting a softphone setup on your favorite Non-LinuxMCE linux box.

[[Linksys_spa-3102]] - Original SPA3102 page.

[[Linksys_spa3000_pstn_interface]] - Another home-grown wiki on the device

[http://www.freepbx.org/support/documentation/howtos/howto-linksys-spa-3102-sipura-spa-3000-freepbx The FreePBX HowTo that saved what is left of my hair]

Best Regards,

--[[User:Sethj|Sethj]] 21:13, 11 October 2010 (CEST)

PPTP server

2010-10-10T20:48:06Z

Pw44:

[[Category:Networking]]
[[Category:Tutorials]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Setting up a PPTP Server.

The pptp server is the right tool to use for outside access to your internal network.
While not the most secure VPN solution, PPTP is the most simple to install, configure and connect from windows, and mobile devices.

Reasons for doing it:
# Having your mobile as an extension of your asterisk server (Iphone, for example, can do it, Nokia can do it via an add on), even from public wifi spots.
# Being able to remotely access files or anything in your server from anywhere, even from wifi spots.
# Others, as you wish.

Lets make it simple:

Server Setup - install the pptp server package:

sudo apt-get install pptpd

edit the /etc/pptpd.conf file:

sudo vi /etc/pptpd.conf

and add:

localip 192.168.80.245,192.168.0.245
remoteip 192.168.80.246-250,192.168.0.246-250

where the localip is the address of the server, and the remoteip are the addresses that will be assigned to clients.

edit the /etc/ppp/pptpd-options file:

sudo vi /etc/ppp/pptpd-options

append the following directives:

ms-dns 192.168.80.1
nobsdcomp
noipx
mtu 1490
mru 1490

Mine looks like:

name dcerouter
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-dns 192.168.80.1
proxyarp
nodefaultroute
debug
lock
nobsdcomp

Add the user credentials for authentication to you chap secrets file:

sudo vi /etc/ppp/chap-secrets

Add to it the user name + password in the following syntax:

usernmae <TAB> dcerouter <TAB> users-password <TAB> *

Restart the server for the settings to take affect:

sudo /etc/init.d/pptpd restart

Firewall rules:

Webadmin -> advanced -> Network -> Firewall Rules: core input for port 1723

You need to append the following lines to /usr/pluto/bin/Network_Firewall.sh, in order to permit GRE protocol flow (needed by PPTP):

iptables --append INPUT --protocol 47 --jump ACCEPT
iptables --append OUTPUT --protocol 47 --jump ACCEPT

If you also have a router running Tomato or DD-WRT, the following iptables rules shall be applied (these are the ones in my Tomato router): My LinuxMCE has the eth0 setted to 192.168.0.160, defined by static address in my Tomato.

# init pptp + gre pass thru
iptables -t nat -I PREROUTING -p tcp --dport 1723 -j DNAT --to 192.168.0.160:1723
iptables -I FORWARD -p tcp -d 192.168.0.160 --dport 1723 -j ACCEPT
iptables -t nat -I PREROUTING -p 47 -j DNAT --to 192.168.0.160
iptables -I FORWARD -p 47 -d 192.168.0.160 -j ACCEPT

iptables -t nat -A PREROUTING -i ppp0 -p tcp -d 0/0 --dport 1723 -j DNAT --to-destination 192.168.0.160
iptables -t nat -A PREROUTING -i ppp0 -p gre -d 0/0 -j DNAT --to-destination 192.168.0.160

iptables -A FORWARD -i ppp0 -o br0 -p tcp --dport 1723 -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p tcp -s 192.168.0.160 --sport 1723 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ppp0 -o br0 -p gre -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED-j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p gre -s 192.168.0.160 -m state --state ESTABLISHED,RELATED -j ACCEPT
# end pptp + gre pass thru

Once done, reload DCERouter, in order that the /usr/pluto/bin/Network_Firewall.sh is reloaded,and if you have Tomato or DD-WRT, reboot it.

Configure your client to use PPTP and test (beyond this wiki).

Fail2ban - A tool against brute force

2010-10-10T20:33:39Z

Pw44:

[[Category: Tutorials]]
[[Category: Networking]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

The first thing to do is edit /etc/asterisk/sip.conf and add the following line:
alwaysauthreject=yes
My sip.conf file looks like:
............
[general]
#include sip_general_additional.conf

bindport = 5060 ; Port to bind to (SIP is 5060)
bindaddr = 0.0.0.0 ; Address to bind to (all addresses on machine)
'''alwaysauthreject=yes'''
disallow=all
allow=ulaw
allow=alaw
.............
Install fail2ban with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/24

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain '''fail2ban-ASTERISK''' (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain '''fail2ban-SSH''' (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

More protection with iptables:
http://sysadminman.net/blog/2010/limiting-sipiax-connections-to-asterisk-with-iptables-1082

Fail2ban - A tool against brute force

2010-10-10T20:32:39Z

Pw44:

[[Category: Tutorials]]
[[Category: Networking]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

The first thing to do is edit /etc/asterisk/sip.conf and add the following line:
alwaysauthreject=yes
My sip.conf file looks like:
[general]
#include sip_general_additional.conf

bindport = 5060 ; Port to bind to (SIP is 5060)
bindaddr = 0.0.0.0 ; Address to bind to (all addresses on machine)
'''alwaysauthreject=yes'''
disallow=all
allow=ulaw
allow=alaw
Install fail2ban with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/24

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain '''fail2ban-ASTERISK''' (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain '''fail2ban-SSH''' (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

More protection with iptables:
http://sysadminman.net/blog/2010/limiting-sipiax-connections-to-asterisk-with-iptables-1082

Fail2ban - A tool against brute force

2010-10-10T20:29:04Z

Pw44:

[[Category: Tutorials]]
[[Category: Networking]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

The first thing to do is to edit /etc/asterisk/sip.conf and add the following line:

alwaysauthreject=yes

My sip.conf file looks like:

[general]
#include sip_general_additional.conf

bindport = 5060 ; Port to bind to (SIP is 5060)
bindaddr = 0.0.0.0 ; Address to bind to (all addresses on machine)
'''alwaysauthreject=yes'''
disallow=all
allow=ulaw
allow=alaw

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/24

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain '''fail2ban-ASTERISK''' (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain '''fail2ban-SSH''' (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

More protection with iptables:
http://sysadminman.net/blog/2010/limiting-sipiax-connections-to-asterisk-with-iptables-1082

PPTP server

2010-10-06T19:06:48Z

Pw44:

[[Category:Networking]]
[[Category:Tutorials]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Setting up a PPTP Server.

The pptp server is the right tool to use for outside access to your internal network.
While not the most secure VPN solution, PPTP is the most simple to install, configure and connect from windows, and mobile devices.

Reasons for doing it:
# Having your mobile as an extension of your asterisk server (Iphone, for example, can do it, Nokia can do it via an add on), even from public wifi spots.
# Being able to remotely access files or anything in your server from anywhere, even from wifi spots.
# Others, as you wish.

Lets make it simple:

Server Setup - install the pptp server package:

sudo apt-get install pptpd

edit the /etc/pptpd.conf file:

sudo vi /etc/pptpd.conf

and add:

localip 192.168.80.245,192.168.0.245
remoteip 192.168.80.246-250,192.168.0.246-250

where the localip is the address of the server, and the remoteip are the addresses that will be assigned to clients.
160
edit the /etc/ppp/pptpd-options file:

sudo vi /etc/ppp/pptpd-options

append the following directives:

ms-dns 192.168.80.1
nobsdcomp
noipx
mtu 1490
mru 1490

Mine looks like:

name dcerouter
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-dns 192.168.80.1
proxyarp
nodefaultroute
debug
lock
nobsdcomp

Add the user credentials for authentication to you chap secrets file:

sudo vi /etc/ppp/chap-secrets

Add to it the user name + password in the following syntax:

usernmae <TAB> dcerouter <TAB> users-password <TAB> *

Restart the server for the settings to take affect:

sudo /etc/init.d/pptpd restart

Firewall rules:

Webadmin -> advanced -> Network -> Firewall Rules: core input for port 1723

You need to append the following lines to /usr/pluto/bin/Network_Firewall.sh, in order to permit GRE protocol flow (needed by PPTP):

iptables --append INPUT --protocol 47 --jump ACCEPT
iptables --append OUTPUT --protocol 47 --jump ACCEPT

If you also have a router running Tomato or DD-WRT, the following iptables rules shall be applied (these are the ones in my Tomato router): My LinuxMCE has the eth0 setted to 192.168.0.160, defined by static address in my Tomato.

# init pptp + gre pass thru
iptables -t nat -I PREROUTING -p tcp --dport 1723 -j DNAT --to 192.168.0.160:1723
iptables -I FORWARD -p tcp -d 192.168.0.160 --dport 1723 -j ACCEPT
iptables -t nat -I PREROUTING -p 47 -j DNAT --to 192.168.0.160
iptables -I FORWARD -p 47 -d 192.168.0.160 -j ACCEPT

iptables -t nat -A PREROUTING -i ppp0 -p tcp -d 0/0 --dport 1723 -j DNAT --to-destination 192.168.0.160
iptables -t nat -A PREROUTING -i ppp0 -p gre -d 0/0 -j DNAT --to-destination 192.168.0.160

iptables -A FORWARD -i ppp0 -o br0 -p tcp --dport 1723 -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p tcp -s 192.168.0.160 --sport 1723 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ppp0 -o br0 -p gre -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED-j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p gre -s 192.168.0.160 -m state --state ESTABLISHED,RELATED -j ACCEPT
# end pptp + gre pass thru

Once done, reload DCERouter, in order that the /usr/pluto/bin/Network_Firewall.sh is reloaded,and if you have Tomato or DD-WRT, reboot it.

Configure your client to use PPTP and test (beyond this wiki).

Fail2ban - A tool against brute force

2010-10-06T19:06:07Z

Pw44:

[[Category: Tutorials]]
[[Category: Networking]]
{{versioninfo|810Status=Works|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/24

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain '''fail2ban-ASTERISK''' (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain '''fail2ban-SSH''' (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

More protection with iptables:
http://sysadminman.net/blog/2010/limiting-sipiax-connections-to-asterisk-with-iptables-1082

Fail2ban - A tool against brute force

2010-10-06T19:04:30Z

Pw44:

[[Category: Tutorials]]
[[Category: Networking]]
{{versioninfo|810Status=??|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/24

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain '''fail2ban-ASTERISK''' (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain '''fail2ban-SSH''' (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

More protection with iptables:
http://sysadminman.net/blog/2010/limiting-sipiax-connections-to-asterisk-with-iptables-1082

Fail2ban - A tool against brute force

2010-10-06T19:03:14Z

Pw44:

[[Category: Tutorials]]
[[Category: Networking]]
{{versioninfo|810Status=??|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/24

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

More protection with iptables:
http://sysadminman.net/blog/2010/limiting-sipiax-connections-to-asterisk-with-iptables-1082

User:Pw44

2010-10-06T12:58:55Z

Pw44:

[[Category:User Setups]]

Initial Hardware Setup: 
Asus M3N78-VM with AMD 955 
SPDIF expansion card (Asus SPDIF OUT/COA+OPT) 
2 GB DDR3 800 Mhz 
3 500 GB HD in a RAID 5 conf (mdadm) 
1 320 GB HD boot (1 partition for LMCE, 1 partition for Kubuntu 8.10, both having access to the RAID 5 /dev/md0) 
Gyration Keyboard and air mouse 
USB-UIRT with a Xantech 284D 
Intel Pro 1000 NIC card (internal network) 
Bluetooth dongle - Motorola 
Hauppauge PVR-150 MCE Edition 
Wiimote remote 
Philips 37" LCD HDTV ready (720p) TV 
Yamaha DSP-A1 amplifier 
Linksys SPA-3102 
Linksys PAP2T-NA (x2) 

Software 
Prior: LMCE Beta 1 issues: 
- TV overscan (solved) 
- Subtitles (not solved) 

Now: Beta 2 - time to start all over again - learned with Beta 1.

Installation:

Kubuntu 8.10 
-> apt-get update. 
-> apt-get upgrade. 
-> apt-get dist-upgrade. 
All done with the VGA monitor. 
LCD TV is also connected to the mobo's HDMI video output. 
Running nvidia-settings, LCD TV identified. 
After all is done (installations and reboots), KDE shows up, i disconnect the vga cable, hit CTRL-ALT-Backspace and the video output is redirected to HDMI. 
First problem: video overscan. 
-- Solution: nvidia-settings shows an overscan ruler. Save conf to ~/.nvidia-settings-rc 
HDMI Sound works (KDE welcome sound) - it plays on TV speakers. 
Second problem: network interfaces are switched - the mobo interface shows as eth1 and the Gb Intel interface shows eth0. 
-- Solution: edit file /etc/udev/rules.d/70-persistent-net.rules and change eth1 to eth0 on first entry (mobo interface) and change eth0 to eth1 (Gb Intel interface) - after reboot, it works like it should. 

LMCE Beta 2 
connect optical cable from the SPDIF Expansion card (the mobo's SPDIF does not shows up) to the Yamaha optical in. 
install from internet. 
Reboot. 
AVWizard: HDMI / 720p / UI2 / Optical Spdif. 
Initial setup (Sara). 

Second problem: some files does not play sound. 
-- Solution: http://forum.linuxmce.org/index.php?topic=9194.msg62958#msg62958. 
Third problem: H264 mkv and mp4 files plays with no sound, even after renaming to m2ts. After renaming to .m2ts, mplayer is used to play them, subtitles shows up fine, but NO sound. 
-- Solution: http://forum.linuxmce.org/index.php?topic=9653.msg66388#msg66388 - see reply #17 
Sound, subtitles and controls works. 

 

to be continued.

----

PPTP server

2010-10-06T12:47:31Z

Pw44:

[[Category:Networking]]
[[Category:Tutorials]]
{{versioninfo|810Status=??|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Setting up a PPTP Server.

The pptp server is the right tool to use for outside access to your internal network.
While not the most secure VPN solution, PPTP is the most simple to install, configure and connect from windows, and mobile devices.

Reasons for doing it:
# Having your mobile as an extension of your asterisk server (Iphone, for example, can do it, Nokia can do it via an add on), even from public wifi spots.
# Being able to remotely access files or anything in your server from anywhere, even from wifi spots.
# Others, as you wish.

Lets make it simple:

Server Setup - install the pptp server package:

sudo apt-get install pptpd

edit the /etc/pptpd.conf file:

sudo vi /etc/pptpd.conf

and add:

localip 192.168.80.245,192.168.0.245
remoteip 192.168.80.246-250,192.168.0.246-250

where the localip is the address of the server, and the remoteip are the addresses that will be assigned to clients.
160
edit the /etc/ppp/pptpd-options file:

sudo vi /etc/ppp/pptpd-options

append the following directives:

ms-dns 192.168.80.1
nobsdcomp
noipx
mtu 1490
mru 1490

Mine looks like:

name dcerouter
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-dns 192.168.80.1
proxyarp
nodefaultroute
debug
lock
nobsdcomp

Add the user credentials for authentication to you chap secrets file:

sudo vi /etc/ppp/chap-secrets

Add to it the user name + password in the following syntax:

usernmae <TAB> dcerouter <TAB> users-password <TAB> *

Restart the server for the settings to take affect:

sudo /etc/init.d/pptpd restart

Firewall rules:

Webadmin -> advanced -> Network -> Firewall Rules: core input for port 1723

You need to append the following lines to /usr/pluto/bin/Network_Firewall.sh, in order to permit GRE protocol flow (needed by PPTP):

iptables --append INPUT --protocol 47 --jump ACCEPT
iptables --append OUTPUT --protocol 47 --jump ACCEPT

If you also have a router running Tomato or DD-WRT, the following iptables rules shall be applied (these are the ones in my Tomato router): My LinuxMCE has the eth0 setted to 192.168.0.160, defined by static address in my Tomato.

# init pptp + gre pass thru
iptables -t nat -I PREROUTING -p tcp --dport 1723 -j DNAT --to 192.168.0.160:1723
iptables -I FORWARD -p tcp -d 192.168.0.160 --dport 1723 -j ACCEPT
iptables -t nat -I PREROUTING -p 47 -j DNAT --to 192.168.0.160
iptables -I FORWARD -p 47 -d 192.168.0.160 -j ACCEPT

iptables -t nat -A PREROUTING -i ppp0 -p tcp -d 0/0 --dport 1723 -j DNAT --to-destination 192.168.0.160
iptables -t nat -A PREROUTING -i ppp0 -p gre -d 0/0 -j DNAT --to-destination 192.168.0.160

iptables -A FORWARD -i ppp0 -o br0 -p tcp --dport 1723 -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p tcp -s 192.168.0.160 --sport 1723 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ppp0 -o br0 -p gre -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED-j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p gre -s 192.168.0.160 -m state --state ESTABLISHED,RELATED -j ACCEPT
# end pptp + gre pass thru

Once done, reload DCERouter, in order that the /usr/pluto/bin/Network_Firewall.sh is reloaded,and if you have Tomato or DD-WRT, reboot it.

Configure your client to use PPTP and test (beyond this wiki).

PPTP server

2010-10-06T12:46:32Z

Pw44:

[[Category:Networking]]
[[Category:Tutorials]]
{{versioninfo|810Status=??|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Setting up a PPTP Server.

The pptp server is the right tool to use for outside access to your internal network.
While not the most secure VPN solution, PPTP is the most simple to install, configure and connect from windows, and mobile devices.

Reasons for doing it:
# Having your mobile as an extension of your asterisk server (Iphone, for example, can do it, Nokia can do it via an add on), even from public wifi spots.
# Being able to remotely access files or anything in your server from anywhere, even from wifi spots.
# Others, as you wish.

Lets make it simple:

Server Setup - install the pptp server package:

sudo apt-get install pptpd

edit the /etc/pptpd.conf file:

sudo vi /etc/pptpd.conf

and add:

localip 192.168.80.245,192.168.0.245
remoteip 192.168.80.246-250,192.168.0.246-250

where the localip is the address of the server, and the remoteip are the addresses that will be assigned to clients.
160
edit the /etc/ppp/pptpd-options file:

sudo vi /etc/ppp/pptpd-options

append the following directives:

ms-dns 192.168.80.1
nobsdcomp
noipx
mtu 1490
mru 1490

Mine looks like:

name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-dns 192.168.80.1
proxyarp
nodefaultroute
debug
lock
nobsdcomp

Add the user credentials for authentication to you chap secrets file:

sudo vi /etc/ppp/chap-secrets

Add to it the user name + password in the following syntax:

usernmae <TAB> pptpd <TAB> users-password <TAB> *

Restart the server for the settings to take affect:

sudo /etc/init.d/pptpd restart

Firewall rules:

Webadmin -> advanced -> Network -> Firewall Rules: core input for port 1723

You need to append the following lines to /usr/pluto/bin/Network_Firewall.sh, in order to permit GRE protocol flow (needed by PPTP):

iptables --append INPUT --protocol 47 --jump ACCEPT
iptables --append OUTPUT --protocol 47 --jump ACCEPT

If you also have a router running Tomato or DD-WRT, the following iptables rules shall be applied (these are the ones in my Tomato router): My LinuxMCE has the eth0 setted to 192.168.0.160, defined by static address in my Tomato.

# init pptp + gre pass thru
iptables -t nat -I PREROUTING -p tcp --dport 1723 -j DNAT --to 192.168.0.160:1723
iptables -I FORWARD -p tcp -d 192.168.0.160 --dport 1723 -j ACCEPT
iptables -t nat -I PREROUTING -p 47 -j DNAT --to 192.168.0.160
iptables -I FORWARD -p 47 -d 192.168.0.160 -j ACCEPT

iptables -t nat -A PREROUTING -i ppp0 -p tcp -d 0/0 --dport 1723 -j DNAT --to-destination 192.168.0.160
iptables -t nat -A PREROUTING -i ppp0 -p gre -d 0/0 -j DNAT --to-destination 192.168.0.160

iptables -A FORWARD -i ppp0 -o br0 -p tcp --dport 1723 -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p tcp -s 192.168.0.160 --sport 1723 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ppp0 -o br0 -p gre -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED-j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p gre -s 192.168.0.160 -m state --state ESTABLISHED,RELATED -j ACCEPT
# end pptp + gre pass thru

Once done, reload DCERouter, in order that the /usr/pluto/bin/Network_Firewall.sh is reloaded,and if you have Tomato or DD-WRT, reboot it.

Configure your client to use PPTP and test (beyond this wiki).

Fail2ban - A tool against brute force

2010-10-05T22:29:46Z

Pw44:

[[Category: Tutorials]]
[[Category: Networking]]
{{versioninfo|810Status=??|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

PPTP server

2010-10-05T22:28:40Z

Pw44:

[[Category:Networking]]
[[Category:Tutorials]]
{{versioninfo|810Status=??|810UpdatedDate=5 October 2010|810UpdatedBy=pw44}}

Setting up a PPTP Server.

The pptp server is the right tool to use for outside access to your internal network.
While not the most secure VPN solution, PPTP is the most simple to install, configure and connect from windows, and mobile devices.

Reasons for doing it:
# Having your mobile as an extension of your asterisk server (Iphone, for example, can do it, Nokia can do it via an add on), even from public wifi spots.
# Being able to remotely access files or anything in your server from anywhere, even from wifi spots.
# Others, as you wish.

Lets make it simple:

Server Setup - install the pptp server package:

sudo apt-get install pptpd

edit the /etc/pptpd.conf file:

sudo vi /etc/pptpd.conf

and add:

localip 192.168.80.245,192.168.0.245
remoteip 192.168.80.246-250,192.168.0.246-250

where the localip is the address of the server, and the remoteip are the addresses that will be assigned to clients.
160
edit the /etc/ppp/pptpd-options file:

sudo vi /etc/ppp/pptpd-options

append the following directives:

ms-dns 192.168.80.1
nobsdcomp
noipx
mtu 1490
mru 1490

Mine looks like:

name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-dns 192.168.80.1
proxyarp
nodefaultroute
debug
lock
nobsdcomp

Add the user credentials for authentication to you chap secrets file:

sudo vi /etc/ppp/chap-secrets

Add to it the user name + password in the following syntax:

usernmae <TAB> * <TAB> users-password <TAB> *

Restart the server for the settings to take affect:

sudo /etc/init.d/pptpd restart

Firewall rules:

Webadmin -> advanced -> Network -> Firewall Rules: core input for port 1723

You need to append the following lines to /usr/pluto/bin/Network_Firewall.sh, in order to permit GRE protocol flow (needed by PPTP):

iptables --append INPUT --protocol 47 --jump ACCEPT
iptables --append OUTPUT --protocol 47 --jump ACCEPT

If you also have a router running Tomato or DD-WRT, the following iptables rules shall be applied (these are the ones in my Tomato router): My LinuxMCE has the eth0 setted to 192.168.0.160, defined by static address in my Tomato.

# init pptp + gre pass thru
iptables -t nat -I PREROUTING -p tcp --dport 1723 -j DNAT --to 192.168.0.160:1723
iptables -I FORWARD -p tcp -d 192.168.0.160 --dport 1723 -j ACCEPT
iptables -t nat -I PREROUTING -p 47 -j DNAT --to 192.168.0.160
iptables -I FORWARD -p 47 -d 192.168.0.160 -j ACCEPT

iptables -t nat -A PREROUTING -i ppp0 -p tcp -d 0/0 --dport 1723 -j DNAT --to-destination 192.168.0.160
iptables -t nat -A PREROUTING -i ppp0 -p gre -d 0/0 -j DNAT --to-destination 192.168.0.160

iptables -A FORWARD -i ppp0 -o br0 -p tcp --dport 1723 -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p tcp -s 192.168.0.160 --sport 1723 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ppp0 -o br0 -p gre -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED-j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p gre -s 192.168.0.160 -m state --state ESTABLISHED,RELATED -j ACCEPT
# end pptp + gre pass thru

Once done, reload DCERouter, in order that the /usr/pluto/bin/Network_Firewall.sh is reloaded,and if you have Tomato or DD-WRT, reboot it.

Configure your client to use PPTP and test (beyond this wiki).

PPTP server

2010-10-05T22:24:26Z

Pw44:

[[Category:Networking]]
[[Category:Tutorials]]

Setting up a PPTP Server.

The pptp server is the right tool to use for outside access to your internal network.
While not the most secure VPN solution, PPTP is the most simple to install, configure and connect from windows, and mobile devices.

Reasons for doing it:
# Having your mobile as an extension of your asterisk server (Iphone, for example, can do it, Nokia can do it via an add on), even from public wifi spots.
# Being able to remotely access files or anything in your server from anywhere, even from wifi spots.
# Others, as you wish.

Lets make it simple:

Server Setup - install the pptp server package:

sudo apt-get install pptpd

edit the /etc/pptpd.conf file:

sudo vi /etc/pptpd.conf

and add:

localip 192.168.80.245,192.168.0.245
remoteip 192.168.80.246-250,192.168.0.246-250

where the localip is the address of the server, and the remoteip are the addresses that will be assigned to clients.
160
edit the /etc/ppp/pptpd-options file:

sudo vi /etc/ppp/pptpd-options

append the following directives:

ms-dns 192.168.80.1
nobsdcomp
noipx
mtu 1490
mru 1490

Mine looks like:

name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-dns 192.168.80.1
proxyarp
nodefaultroute
debug
lock
nobsdcomp

Add the user credentials for authentication to you chap secrets file:

sudo vi /etc/ppp/chap-secrets

Add to it the user name + password in the following syntax:

usernmae <TAB> * <TAB> users-password <TAB> *

Restart the server for the settings to take affect:

sudo /etc/init.d/pptpd restart

Firewall rules:

Webadmin -> advanced -> Network -> Firewall Rules: core input for port 1723

You need to append the following lines to /usr/pluto/bin/Network_Firewall.sh, in order to permit GRE protocol flow (needed by PPTP):

iptables --append INPUT --protocol 47 --jump ACCEPT
iptables --append OUTPUT --protocol 47 --jump ACCEPT

If you also have a router running Tomato or DD-WRT, the following iptables rules shall be applied (these are the ones in my Tomato router): My LinuxMCE has the eth0 setted to 192.168.0.160, defined by static address in my Tomato.

# init pptp + gre pass thru
iptables -t nat -I PREROUTING -p tcp --dport 1723 -j DNAT --to 192.168.0.160:1723
iptables -I FORWARD -p tcp -d 192.168.0.160 --dport 1723 -j ACCEPT
iptables -t nat -I PREROUTING -p 47 -j DNAT --to 192.168.0.160
iptables -I FORWARD -p 47 -d 192.168.0.160 -j ACCEPT

iptables -t nat -A PREROUTING -i ppp0 -p tcp -d 0/0 --dport 1723 -j DNAT --to-destination 192.168.0.160
iptables -t nat -A PREROUTING -i ppp0 -p gre -d 0/0 -j DNAT --to-destination 192.168.0.160

iptables -A FORWARD -i ppp0 -o br0 -p tcp --dport 1723 -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p tcp -s 192.168.0.160 --sport 1723 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ppp0 -o br0 -p gre -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED-j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p gre -s 192.168.0.160 -m state --state ESTABLISHED,RELATED -j ACCEPT
# end pptp + gre pass thru

Once done, reload DCERouter, in order that the /usr/pluto/bin/Network_Firewall.sh is reloaded,and if you have Tomato or DD-WRT, reboot it.

Configure your client to use PPTP and test (beyond this wiki).

PPTP server

2010-10-05T22:22:18Z

Pw44: New page: Setting up a PPTP Server. The pptp server is the right tool to use for outside access to your internal network. While not the most secure VPN solution, PPTP is the most simple to install,...

Setting up a PPTP Server.

The pptp server is the right tool to use for outside access to your internal network.
While not the most secure VPN solution, PPTP is the most simple to install, configure and connect from windows, and mobile devices.

Reasons for doing it:
# Having your mobile as an extension of your asterisk server (Iphone, for example, can do it, Nokia can do it via an add on), even from public wifi spots.
# Being able to remotely access files or anything in your server from anywhere, even from wifi spots.
# Others, as you wish.

Lets make it simple:

Server Setup - install the pptp server package:

sudo apt-get install pptpd

edit the /etc/pptpd.conf file:

sudo vi /etc/pptpd.conf

and add:

localip 192.168.80.245,192.168.0.245
remoteip 192.168.80.246-250,192.168.0.246-250

where the localip is the address of the server, and the remoteip are the addresses that will be assigned to clients.
160
edit the /etc/ppp/pptpd-options file:

sudo vi /etc/ppp/pptpd-options

append the following directives:

ms-dns 192.168.80.1
nobsdcomp
noipx
mtu 1490
mru 1490

Mine looks like:

name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-dns 192.168.80.1
proxyarp
nodefaultroute
debug
lock
nobsdcomp

Add the user credentials for authentication to you chap secrets file:

sudo vi /etc/ppp/chap-secrets

Add to it the user name + password in the following syntax:

usernmae <TAB> * <TAB> users-password <TAB> *

Restart the server for the settings to take affect:

sudo /etc/init.d/pptpd restart

Firewall rules:

Webadmin -> advanced -> Network -> Firewall Rules: core input for port 1723

You need to append the following lines to /usr/pluto/bin/Network_Firewall.sh, in order to permit GRE protocol flow (needed by PPTP):

iptables --append INPUT --protocol 47 --jump ACCEPT
iptables --append OUTPUT --protocol 47 --jump ACCEPT

If you also have a router running Tomato or DD-WRT, the following iptables rules shall be applied (these are the ones in my Tomato router): My LinuxMCE has the eth0 setted to 192.168.0.160, defined by static address in my Tomato.

# init pptp + gre pass thru
iptables -t nat -I PREROUTING -p tcp --dport 1723 -j DNAT --to 192.168.0.160:1723
iptables -I FORWARD -p tcp -d 192.168.0.160 --dport 1723 -j ACCEPT
iptables -t nat -I PREROUTING -p 47 -j DNAT --to 192.168.0.160
iptables -I FORWARD -p 47 -d 192.168.0.160 -j ACCEPT

iptables -t nat -A PREROUTING -i ppp0 -p tcp -d 0/0 --dport 1723 -j DNAT --to-destination 192.168.0.160
iptables -t nat -A PREROUTING -i ppp0 -p gre -d 0/0 -j DNAT --to-destination 192.168.0.160

iptables -A FORWARD -i ppp0 -o br0 -p tcp --dport 1723 -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p tcp -s 192.168.0.160 --sport 1723 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ppp0 -o br0 -p gre -d 192.168.0.160 -m state --state NEW,ESTABLISHED,RELATED-j ACCEPT
iptables -A FORWARD -i br0 -o ppp0 -p gre -s 192.168.0.160 -m state --state ESTABLISHED,RELATED -j ACCEPT
# end pptp + gre pass thru

Once done, reload DCERouter, in order that the /usr/pluto/bin/Network_Firewall.sh is reloaded,and if you have Tomato or DD-WRT, reboot it.

Configure your client to use PPTP and test (beyond this wiki).

Fail2ban - A tool against brute force

2010-09-27T16:34:34Z

Pw44:

[[Category: Tutorials]]

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you need a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

Fail2ban - A tool against brute force

2010-09-27T16:33:45Z

Pw44:

[[Category: Tutorials]]

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is started.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you nedd a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

Fail2ban - A tool against brute force

2010-09-27T16:32:17Z

Pw44:

[[Category: Tutorials]]

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

For LinuxMCE, there is needed "patch", while fail2ban is not part of the distribution.

When LinuxMCE starts, it runs /usr/pluto/bin/Network_Firewall.sh, and this is done AFTER /etc/init.d/fail2ban is run.

So, edit /usr/pluto/bin/Network_Firewall.sh and add the following at the END of this file:

/etc/init.d/fail2ban restart

This will make sure that fail2bain is started AFTER the iptables rules from LinuxMCE.

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

One last tip: you nedd a MTA, like sendmail or postfix, in order to receive the notifications from fail2ban.

If you have a MTA installed and properly configured, nothing else is needed, but if not, install sendmail

sudo apt-get install sendmail

Then edit the /etc/hosts file and change the line '''192.168.80.1 dcerouter''' to read '''192.168.80.1 dcerouter.localdomain dcerouter'''

Doing it, sendmail will start as expected (fast) and mail will properly delivered. If this change is not done, sendmail will take a long time to start, because it does not find the qualified host name, as the log shows:

Sep 27 13:12:11 dcerouter sendmail[10585]: My unqualified host name (dcerouter) unknown; sleeping for retry

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

Fail2ban - A tool against brute force

2010-09-20T16:22:26Z

Pw44:

[[Category: Tutorials]]

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 2
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

Sipgate.co.uk

2010-09-20T13:52:06Z

Pw44:

=SIPGATE.CO.UK=

=='''CAVEAT'''==
:1)this guide is what worked for me, It is intentionally "dumbed down" because.
::a) I have no indepth knowledge and,
::b)it's intended for the totally virgin Windows' refugee with negligible cli experience and limited typing skills

:2)If it insults your intelligence, and you get nothing from it '''GOOD'''...it means you've been lucky enough to have gained a fair amount of knowledge....'''USE''' it & when you've found the answer to your problem, '''PLEASE''' come back & share it with us lesser mortals

:3)All credit for any accuracy goes to Zaerc and Colinjones
:4)I've cut and pasted most of the material,and hopefully credited the sources, :if not, my apologies for plaugiarising your work.
:5) ALL errors are mine, please do not repeat them without giving me credit : )
* ASSUMPTIONS uk user, ISP= British TelecoN, router/modem= BT.HomeHub, dynamic IP address (section on static should work but I can't test) ......you may have to modify for any other combination

==''''''PREPARE''''''==

::READ, READ , READ....check out the links at the end for good starting points
*get fixed in your mind that "external ip"in all(?) mon-LMCE docs means the internet isp provided ip.NOT the ip of your Hybrid's "external" nic, ie the one that connects to the router
*get a pen &paper....make a clear note of settings as you go along ...DON'T trust to memory....
*bookmark usefull sites...open atleast four tabs in firefox for: google, pluto web admin,forums, homeHub adminpage, and put their bookmarks on the toolbar,don't close tabs/firefox on shutdown/reloads ....restore last session when you restart firefox.
* beware of hidden html code when cutting/pasting
'''

=='''GET INFO'''==

=='''voip provider'''==

*google "free voip" to find a provider, preferably free, pay as you go, free phone No. .. in your preffered region, according to your anticipated usage .. #check out the forums at VOXILLA for uptodate good/bad guys ...
::I chose SIPGATE>CO>UK 'cos it ticked all the boxes and there is some barebones wiki material/and a ready made trunk allready.
:::Register ,print off your details,.. your loginP/wd/user name for the website are NEVER used in any of this setup ...you'll need the 7 digit numeric sipID (usernam trunk id ), 7 digit sip password, the only place the actual localDID is used is for caller ID ?????CHECK????

*IF YOU CAN..-.beg, borrow, or steal, a windows laptop and install Xlite from spgate/settigs/help centre--it comes pre configured, - test the connection out. ::TEST IN and OUT using landline/mobile ....bear in mind the Sipgate online status page is '''only valid at login''' time.so you may have to log out and back in to check your installation's registration.

=='''Dynamic DNS'''==

Choose a Dynamic domain name sever provider , loads on google, get a free one,
*READ help/howtos
::(I chose DynDNS ,free , well known and it makes life a bit easier later) READ the instructions -
::* register -- wait for login e-mail (2 mins)
::* choose any (host)name for your hybrid,choose an extension eg. homeip.net-- take the wild card option,
::*--set IP type either static/dynamic..set ttl according to IP type.....
::*find the providers test apps and follow instructions,
:::TEST name resolution ,
:::CHECK for any blocked ports, make a note of current dynamic IP address.

=='''BT HomeHub'''==

* Does your internet connection have a static or a dynamic ip address ?
::If it's dynamic (most domestic BT BROADBAND) and you don't begrudge them the extra £5 pcm you pay for the privelige,get them to change it to static.wait for notificatin/check in HOMEHUB that it's in effect. It will make installation simpler, and allegedly is more reliable than alternatives.
::........at the same time get them to disable their own voip service, '''and''' do it yourself as well ,-if you are using their supplied HomeHub........

::::login => advanced => telephony=> uncheck the "enable telephony " box (no idea if the textphone option has an impact.)
'''YOU MUST disable BT BROADBAND TALK'''
:::: while youre in Hub admin, go into IP Adresses and note the range of DHCP pool (mine is LAN_private 192.168.1.64 - 192.168.1.237 & Gateway (your HOMEHUB ) 192.168.1.254

==='''NAT'''===
::*admin/advanced/application sharing / create new game/Manual Entry of Port Maps /
:::'''name'''(I used "sipserver")... click '''next'''
:::: check the new name is correct

::::::click '''ENTER'''
:::fill in the boxes, as follows
:::::protocl UDP from5060 to 5080 translate to 5060 Trigger protocol ANY Trigger Port leave blank ADD
:::::protocl UDP from10000 to 20000 translate to 10001 Trigger protocol ANY Trigger Port leave blank ADD

'''
CHECK SETTINGS''' its a '''PITA'''to do it later

Click '''APPLY'''

==='''MISC'''===

:GOTO FIREWALL .. set at standard
:GOTO DEVICES .. establish which entry is the HYBRID ,it SHOULD be the one at the IP youset for it earlier (if it shows a mac address, check in Pluto admin/network/network settings for a match)

CLICK '''EDIT'''

:::CHANGE name to the hostname you picked at DynDNS earlier,just the name not the (for e.g. .is-a-geek.net)
:::GAME or SERVICE ''' dropdown''' ...... pick the application ( "sipserver") you created earlier..
CLICK '''ADD'''

'''NOTE''' if you need to edit the "application" in anyway, you must first unassign it from your Hybrid, make the alterations, then remember to reassign it to the hybrid

='''LMCE'''=

:::: go into Web (pluto) admin on your core/Hybrid,login (your password is whatever you entered as first user during initial AV wizard)

*-wizard/ basic/keyboard setup.. and select relevant country (if you haven't
allready) ../ update button
==Network settings==:
*-wizard/advanced/network/network settings .... change radio button to use a static IP address
**fill in cores/Hybrids ip address as 192.165.2.X where X is outside the private lan dhcp pool for e.g 250
:::subnetmask 255.255.255.0
:::gateway/dns1/dns2 all same as your HomeHubs address (probably) 192.168.1.254
:::::::'''press green UPDATE button'''

=='''Firewall'''==

*- advanced/network/firewall rules... and use the boxes untill the rules look exactly like this,
:::::'''BE PATIENT & ACCURATE''' ....sometimes the progress bar seems to
:::::::freeze...leave it alone untill it's done it's thing

:udp....4569 to 0.......0...............core_input..............Delete
:udp....5060 to 0.......0...............core_input..............Delete
:udp....2000 to 0.......0...............core_input..............Delete
:tcp....2000 to 0.......0...............core_input..............Delete
:tcp....3877 to 3877....3877...192.168.80.1...port_forward......Delete
:udp....10001 to 20000 0...............core_input..............Delete
(port 4569 is iax protocol 5060 is sip 10001to 20000 carries the audio NB some docs say use 10000 rather than 10001''' don't''' FreePBX uses that for it's web panel

*-wizard/restart/reload router (not strictly necessary in this case but it is in others ,-get into the habit,- it doesn't cost you anything, besides, its time for tea/smoke /sex whatever takes your fancy.

=='''Phone Lines'''==
:GOTO ... pluto admin/wizard /devices/phone lines
*1)'''Check''' When dialing a local number, automatically prepend the area code and specify the areacode you would like to have prepended when dialing a local number, for instance mine is 0114 (sheffield)
*2. '''Uncheck''' Also prepend a digit (1 for US/Canada, 0 for Europe) (also optional).
*3. Local Number Length 7 (the default).

::::::Hit the '''Update''' button.
:Choose provider sipgate (try for free, pay as you go)

*1. Username <'''SipID''' from provider....>
*2. Password '''SipPassword'''from provider>
*3. Phone number <'''SipID''' from provider... AGAIN......NOT the DID ie local number.>
*4. Host <sipgate.co.uk>
*5. Hit the '''Submit''' button.
*6. Hit the '''Deactivate Automatic Configuration button''' and the following Yes button.
*7. Click the '''click here''' link (next to "Manual configuration activated. To configure AMP, click")
*8. Click Trunks, and Trunk SIP/sipgate
*9. Under "Outgoing Dial Rules" change Dial Rules to
112
999
0114+XXXXXXX
9|.

:1. This will recognize 112,999, the emergency numbers
:2. Seven digit local numbers will get 0114 prepended.
:3 A nine will dial out no matter how many digits.
:4You now can (optionally) modify other settings to your liking as well, however do NOT change the Trunk Name (leave it at the default sipgate). When done hit '''Submit Changes'''.
:5Click '''Reload Required Apply Configuration Changes'''
: and '''Continue with reload.'''

GOTO Go back to pluto admin/Wizard > Devices > Phone Lines and hit the '''Activate Automatic Configuration button''', followed by the '''Yes and keep my advanced settings''' button.

=='''FreePBX'''==

:GOTO ... pluto admin/wizard /advanced/config./phone setup , which puts you into FreePBX webadmin

*CLICK '''"TRUNKS"''' on left hand side
*CLICK '''"sipgate"''' on right hand side

*'''CHECK''' settings are as below

PEER DETAILS
allow=alaw&alaw&ulaw&g729&gsm&slinear
auth=md5
authuser='''SIP ID'''
callerid='''SIP ID'''
canreinvite=no
context=from-trunk
dtmfmode=inband
fromdomain='''sipgate.co.uk'''
fromuser='''SIP ID'''
host='''sipgate.co.uk'''
insecure=very
nat='''yes'''
qualify=no
secret='''SIP Pwd'''
type=peer
user='''SIP ID'''
username='''SIP ID'''

USER CONTEXT
'''SIP ID'''

USER DETAILS
allow=alaw&alaw&ulaw&g729&gsm&slinear
auth=md5
authuser='''SIP ID'''
callerid='''SIP ID'''
canreinvite=no
context=from-trunk
dtmfmode=inband
fromdomain='''sipgate.co.uk'''
fromuser='''SIP ID'''
host='''sipgate.co.uk'''
insecure=very
nat='''yes'''
qualify=no
secret='''SIP Pwd'''
type=user
user='''SIP ID'''
username='''SIP ID'''

REGISTER STRING
'''SIP ID:SIP password@sipgate.co.uk/SIP ID
'''
:::click '''submit button'''
::::then..
:::click'''orange config bar''' at top of page

'''make sure''' pluto admin/advanced/configuration/phones setup.....
FreePBX...../outbound route / 0sipgate settings are as below

...trunk sequence 0 (drop down =) '''SIP/sipgate'''
:::click '''submit button'''
::::then..
:::click'''orange config bar''' at top of page

='''Asterisk'''=

[(RIP-OFF FROM) <nowiki>freepbx.org/support/documentation/howtos/howto-resolving-audio-problems]</nowiki>

=='''DYNAMIC ADDRESS'''==

####NEED TO CHECK/change file PERMISSIONS ????HOW

*Once you get a DynDNS or other address that identifies your system on the Internet, put it in your etc/hosts file. For example, if you are assigned foo.dyndns.net, then open etc/hosts in your favorite text editor
(I use joe...it's very simple....konsole/...........sudoapt-get install joe)
::::* joe /etc/hosts

:::::::(use UP, DOWN, LEFT RIGHT arrows to navigate, Ctrl k x to save Ctrl h for help)

'''127.0.0.1 localhost'''

'''DO NOT REMOVE OR CHANGE THAT LINE.''' On a NEW line directly underneath it, place this line:
'''
127.0.0.1 foo.dyndns.net'''

But substitute '''YOUR address''', of course......

:::::'''save & exit'''

Add some information to your /etc/asterisk/sip_nat.conf file

####NEED TO CHECK PERMISSIONS ????HOW

sudo joe /etc/asterisk/sip_nat.conf..................(your password is linuxmce)

nat=yes
externhost=YOUR FULL DynDNS address e.g dummy.is-a-geek.net
externrefresh=10
localnet=192.168.80.0/255.255.255.0

:::::'''save and exit'''

=='''STATIC ADDRESS'''==

Make use that your system knows its own name.

####NEED TO CHECK/change file PERMISSIONS ????HOW

Once you get a DynDNS or other address that identifies your system on the Internet, put it in your etc/hosts file. For example, if you are assigned foo.dyndns.net, then open etc/hosts in your favorite text editor
I use joe...it's very simple....konsole/...........sudoapt-get install joe
joe /etc/hosts

(use UP, DOWN, LEFT RIGHT arrows to navigate, Ctrl k x to save Ctrl h for help)

'''127.0.0.1 localhost'''

'''DO NOT REMOVE OR CHANGE THAT LINE.''' On a NEW line directly underneath it, place this line:

'''127.0.0.1 foo.dyndns.net'''

But substitute '''YOUR address''', of course......save & exit

Add some information to your /etc/asterisk/sip_nat.conf file

####NEED TO CHECK PERMISSIONS ????HOW

sudo joe /etc/asterisk/sip_nat.conf..................(your password is linuxmce)
nat=yes
externip=your.external.dotted.IPaddess

fromdomain=YOUR DynDNS name in full
localnet=192.168.80.0/255.255.255.0

::::'''save and exit'''

=='''ALL'''==

Check your /etc/asterisk/rtp.conf file

sudo joe /etc/asterisk/rtp.conf

It should contain these two lines:

rtpstart=10001

rtpend=20000

"If the port values are any different, change them. N.B. These MUST match what you opened in your firewall, and DO NOT start with port 10000, because it conflicts with usage in FreePBX Webmin
Some people feel the need to open fewer than 10,000 ports. I don't recommend this because six months from now when you start having audio problems you may not remember that you opened fewer than the recommended number of ports, and may spend hours troubleshooting the issue. But if you are simply obsessive about open ports, remember that each open SIP connection may require as many as FOUR concurrent ports, so don't cut it down to some ridiculously small number. For the non-paranoid, I suggest sticking with the recommendations above (and remember, if a hacker is looking at ports on your system, he's going to scan ALL of them, so having fewer UDP ports open really doesn't make you any more secure)."

::::'''save & exit'''

='''Keeping Asterisk current'''=
You can use this sh script. run it from the crontab, maybe every 4 hours and on boot..

#!/bin/sh
# get current ip of the router
CURRENT_IP=`/usr/bin/lynx -dump http://www.netins.net/dialup/tools/my_ip.shtml | grep -A2 "Your current IP Address is:" | tail -n2 | tr -d ' '`
# update the sip_nat.conf and re-read configs
echo "externip=$CURRENT_IP" > /tmp/sip_nat.conf
echo "localnet=192.168.80.0/255.255.255.0" >> /tmp/sip_nat.conf
echo "externrefresh=5" >> /tmp/sip_nat.conf
echo "localnet=192.168.80.0/255.255.255.0" >> /tmp/sip_nat.conf
cat /tmp/sip_nat.conf > /etc/asterisk/sip_nat.conf
chown asterisk.asterisk /etc/asterisk/sip_nat.conf
asterisk -rx reload

PERL SCRIPT from/www.freepbx.org/support/documentation/howtos/howto-resolving-audio-problems

when i tried this it threw errors.....needs a linux man for this section}}}

=='''YOU'RE ALMOST DONE !'''==

exit Konsole
GOTO ... pluto admin/wizard /advanced/config./phone setup

if the orange bar is showing in FreePBX '''click it'''

GOTO pluto admin/wizard/restart/ '''click reboot'''

GET TEA...(smoke/ have sex etc)

pickup cell/landline
dial the local number sipgate gave you.....the rest , if it works should be obvious

==TROUBLESHOOTING==

if it does'nt work
{A run perl checkip.pl}

1 check your ISP hasn't changed your IP address
2 check everything, form square one for typos
3 goto Dyndns and run their name resolver
4 consider posting in user forum-- AFTER you've had a break, freshened up, and RECHECKED EVERYTHING CAREFULLY

=='''ONCE YOU'RE RUNNING'''==
TEST TEST TEST
*read up on dial plans and tweak to your own desires
*read up on extensions/mds/voicemail/IVRs and configure to your own desires

'''PLEASE'''
*.....keep it simple and test each step as you go -it makes troubleshooting so much easier
*--- take notes, post/wiki any new knowledge

=='''LINKS'''==

BT HomeHub.........................http://www.frequencycast.co.uk/homehub.html
WIKI...............................http://wiki.linuxmce.org/index.php/Category:Phone_Lines
:::::::::::::::::::::::::::::::::::http://wiki.linuxmce.org/index.php/LinuxMCE_telecom_features

FreePBX.............................http://www.freepbx.org/support/documentation
other voip providers/setups.........http://www.freepbx.org/support/documentation/howtos/howto-setting-up-voip-provider-trunks

THE O'reiley book..................http://www.digium.com/elqNow/elqRedir.htm?ref=http://downloads.oreilly.com/books/9780596510480.pdf

[[Category: Telecom]]
[[Category: Phone Lines]]
[[Category: Tutorials]]
[[Category: VOIP Setups]]

A
<nowiki>Insert non-formatted text here</nowiki>

Sipgate.co.uk

2010-09-20T13:48:48Z

Pw44:

=SIPGATE.CO.UK=

=='''CAVEAT'''==
:1)this guide is what worked for me, It is intentionally "dumbed down" because.
::a) I have no indepth knowledge and,
::b)it's intended for the totally virgin Windows' refugee with negligible cli experience and limited typing skills

:2)If it insults your intelligence, and you get nothing from it '''GOOD'''...it means you've been lucky enough to have gained a fair amount of knowledge....'''USE''' it & when you've found the answer to your problem, '''PLEASE''' come back & share it with us lesser mortals

:3)All credit for any accuracy goes to Zaerc and Colinjones
:4)I've cut and pasted most of the material,and hopefully credited the sources, :if not, my apologies for plaugiarising your work.
:5) ALL errors are mine, please do not repeat them without giving me credit : )
* ASSUMPTIONS uk user, ISP= British TelecoN, router/modem= BT.HomeHub, dynamic IP address (section on static should work but I can't test) ......you may have to modify for any other combination

==''''''PREPARE''''''==

::READ, READ , READ....check out the links at the end for good starting points
*get fixed in your mind that "external ip"in all(?) mon-LMCE docs means the internet isp provided ip.NOT the ip of your Hybrid's "external" nic, ie the one that connects to the router
*get a pen &paper....make a clear note of settings as you go along ...DON'T trust to memory....
*bookmark usefull sites...open atleast four tabs in firefox for: google, pluto web admin,forums, homeHub adminpage, and put their bookmarks on the toolbar,don't close tabs/firefox on shutdown/reloads ....restore last session when you restart firefox.
* beware of hidden html code when cutting/pasting
'''

=='''GET INFO'''==

=='''voip provider'''==

*google "free voip" to find a provider, preferably free, pay as you go, free phone No. .. in your preffered region, according to your anticipated usage .. #check out the forums at VOXILLA for uptodate good/bad guys ...
::I chose SIPGATE>CO>UK 'cos it ticked all the boxes and there is some barebones wiki material/and a ready made trunk allready.
:::Register ,print off your details,.. your loginP/wd/user name for the website are NEVER used in any of this setup ...you'll need the 7 digit numeric sipID (usernam trunk id ), 7 digit sip password, the only place the actual localDID is used is for caller ID ?????CHECK????

*IF YOU CAN..-.beg, borrow, or steal, a windows laptop and install Xlite from spgate/settigs/help centre--it comes pre configured, - test the connection out. ::TEST IN and OUT using landline/mobile ....bear in mind the Sipgate online status page is '''only valid at login''' time.so you may have to log out and back in to check your installation's registration.

=='''Dynamic DNS'''==

Choose a Dynamic domain name sever provider , loads on google, get a free one,
*READ help/howtos
::(I chose DynDNS ,free , well known and it makes life a bit easier later) READ the instructions -
::* register -- wait for login e-mail (2 mins)
::* choose any (host)name for your hybrid,choose an extension eg. homeip.net-- take the wild card option,
::*--set IP type either static/dynamic..set ttl according to IP type.....
::*find the providers test apps and follow instructions,
:::TEST name resolution ,
:::CHECK for any blocked ports, make a note of current dynamic IP address.

=='''BT HomeHub'''==

* Does your internet connection have a static or a dynamic ip address ?
::If it's dynamic (most domestic BT BROADBAND) and you don't begrudge them the extra £5 pcm you pay for the privelige,get them to change it to static.wait for notificatin/check in HOMEHUB that it's in effect. It will make installation simpler, and allegedly is more reliable than alternatives.
::........at the same time get them to disable their own voip service, '''and''' do it yourself as well ,-if you are using their supplied HomeHub........

::::login => advanced => telephony=> uncheck the "enable telephony " box (no idea if the textphone option has an impact.)
'''YOU MUST disable BT BROADBAND TALK'''
:::: while youre in Hub admin, go into IP Adresses and note the range of DHCP pool (mine is LAN_private 192.168.1.64 - 192.168.1.237 & Gateway (your HOMEHUB ) 192.168.1.254

==='''NAT'''===
::*admin/advanced/application sharing / create new game/Manual Entry of Port Maps /
:::'''name'''(I used "sipserver")... click '''next'''
:::: check the new name is correct

::::::click '''ENTER'''
:::fill in the boxes, as follows
:::::protocl UDP from5060 to 5080 translate to 5060 Trigger protocol ANY Trigger Port leave blank ADD
:::::protocl UDP from10000 to 20000 translate to 10001 Trigger protocol ANY Trigger Port leave blank ADD

'''
CHECK SETTINGS''' its a '''PITA'''to do it later

Click '''APPLY'''

==='''MISC'''===

:GOTO FIREWALL .. set at standard
:GOTO DEVICES .. establish which entry is the HYBRID ,it SHOULD be the one at the IP youset for it earlier (if it shows a mac address, check in Pluto admin/network/network settings for a match)

CLICK '''EDIT'''

:::CHANGE name to the hostname you picked at DynDNS earlier,just the name not the (for e.g. .is-a-geek.net)
:::GAME or SERVICE ''' dropdown''' ...... pick the application ( "sipserver") you created earlier..
CLICK '''ADD'''

'''NOTE''' if you need to edit the "application" in anyway, you must first unassign it from your Hybrid, make the alterations, then remember to reassign it to the hybrid

='''LMCE'''=

:::: go into Web (pluto) admin on your core/Hybrid,login (your password is whatever you entered as first user during initial AV wizard)

*-wizard/ basic/keyboard setup.. and select relevant country (if you haven't
allready) ../ update button
==Network settings==:
*-wizard/advanced/network/network settings .... change radio button to use a static IP address
**fill in cores/Hybrids ip address as 192.165.2.X where X is outside the private lan dhcp pool for e.g 250
:::subnetmask 255.255.255.0
:::gateway/dns1/dns2 all same as your HomeHubs address (probably) 192.168.1.254
:::::::'''press green UPDATE button'''

=='''Firewall'''==

*- advanced/network/firewall rules... and use the boxes untill the rules look exactly like this,
:::::'''BE PATIENT & ACCURATE''' ....sometimes the progress bar seems to
:::::::freeze...leave it alone untill it's done it's thing

:udp....4569 to 0.......0...............core_input..............Delete
:udp....5060 to 0.......0...............core_input..............Delete
:udp....2000 to 0.......0...............core_input..............Delete
:tcp....2000 to 0.......0...............core_input..............Delete
:tcp....3877 to 3877....3877...192.168.80.1...port_forward......Delete
:udp....10001 to 20000 0...............core_input..............Delete
(port 4569 is iax protocol 5060 is sip 10001to 20000 carries the audio NB some docs say use 10000 rather than 10001''' don't''' FreePBX uses that for it's web panel

*-wizard/restart/reload router (not strictly necessary in this case but it is in others ,-get into the habit,- it doesn't cost you anything, besides, its time for tea/smoke /sex whatever takes your fancy.

=='''Phone Lines'''==
:GOTO ... pluto admin/wizard /devices/phone lines
*1)'''Check''' When dialing a local number, automatically prepend the area code and specify the areacode you would like to have prepended when dialing a local number, for instance mine is 0114 (sheffield)
*2. '''Uncheck''' Also prepend a digit (1 for US/Canada, 0 for Europe) (also optional).
*3. Local Number Length 7 (the default).

::::::Hit the '''Update''' button.
:Choose provider sipgate (try for free, pay as you go)

*1. Username <'''SipID''' from provider....>
*2. Password '''SipPassword'''from provider>
*3. Phone number <'''SipID''' from provider... AGAIN......NOT the DID ie local number.>
*4. Host <sipgate.co.uk>
*5. Hit the '''Submit''' button.
*6. Hit the '''Deactivate Automatic Configuration button''' and the following Yes button.
*7. Click the '''click here''' link (next to "Manual configuration activated. To configure AMP, click")
*8. Click Trunks, and Trunk SIP/sipgate
*9. Under "Outgoing Dial Rules" change Dial Rules to
112
999
0114+XXXXXXX
9|.

:1. This will recognize 112,999, the emergency numbers
:2. Seven digit local numbers will get 0114 prepended.
:3 A nine will dial out no matter how many digits.
:4You now can (optionally) modify other settings to your liking as well, however do NOT change the Trunk Name (leave it at the default sipgate). When done hit '''Submit Changes'''.
:5Click '''Reload Required Apply Configuration Changes'''
: and '''Continue with reload.'''

GOTO Go back to pluto admin/Wizard > Devices > Phone Lines and hit the '''Activate Automatic Configuration button''', followed by the '''Yes and keep my advanced settings''' button.

=='''FreePBX'''==

:GOTO ... pluto admin/wizard /advanced/config./phone setup , which puts you into FreePBX webadmin

*CLICK '''"TRUNKS"''' on left hand side
*CLICK '''"sipgate"''' on right hand side

*'''CHECK''' settings are as below

PEER DETAILS
allow=alaw&alaw&ulaw&g729&gsm&slinear
auth=md5
authuser='''SIP ID'''
callerid='''SIP ID'''
canreinvite=no
context=from-trunk
dtmfmode=inband
fromdomain='''sipgate.co.uk'''
fromuser='''SIP ID'''
host='''sipgate.co.uk'''
insecure=very
nat='''yes'''
qualify=no
secret='''SIP Pwd'''
type=peer
user='''SIP ID'''
username='''SIP ID'''

USER CONTEXT
'''SIP ID'''

USER DETAILS
allow=alaw&alaw&ulaw&g729&gsm&slinear
auth=md5
authuser='''SIP ID'''
callerid='''SIP ID'''
canreinvite=no
context=from-trunk
dtmfmode=inband
fromdomain='''sipgate.co.uk'''
fromuser='''SIP ID'''
host='''sipgate.co.uk'''
insecure=very
nat='''yes'''
qualify=no
secret='''SIP Pwd'''
type=user
user='''SIP ID'''
username='''SIP ID'''

REGISTER STRING
'''SIP ID:SIP password@sipgate.co.uk/SIP ID
'''
:::click '''submit button'''
::::then..
:::click'''orange config bar''' at top of page

'''make sure''' pluto admin/advanced/configuration/phones setup.....
FreePBX...../outbound route / 0sipgate settings are as below

...trunk sequence 0 (drop down =) '''SIP/sipgate'''
:::click '''submit button'''
::::then..
:::click'''orange config bar''' at top of page

='''Asterisk'''=

[(RIP-OFF FROM) <nowiki>freepbx.org/support/documentation/howtos/howto-resolving-audio-problems]</nowiki>

=='''DYNAMIC ADDRESS'''==

####NEED TO CHECK/change file PERMISSIONS ????HOW

*Once you get a DynDNS or other address that identifies your system on the Internet, put it in your etc/hosts file. For example, if you are assigned foo.dyndns.net, then open etc/hosts in your favorite text editor
(I use joe...it's very simple....konsole/...........sudoapt-get install joe)
::::* joe /etc/hosts

:::::::(use UP, DOWN, LEFT RIGHT arrows to navigate, Ctrl k x to save Ctrl h for help)

'''127.0.0.1 localhost'''

'''DO NOT REMOVE OR CHANGE THAT LINE.''' On a NEW line directly underneath it, place this line:
'''
127.0.0.1 foo.dyndns.net'''

But substitute '''YOUR address''', of course......

:::::'''save & exit'''

Add some information to your /etc/asterisk/sip_nat.conf file

####NEED TO CHECK PERMISSIONS ????HOW

sudo joe /etc/asterisk/sip_nat.conf..................(your password is linuxmce)
nat=yes
externhost=YOUR FULL DynDNS address e.g dummy.is-a-geek.net
externrefresh=10
localnet=192.168.80.0/255.255.255.0

:::::'''save and exit'''

=='''STATIC ADDRESS'''==

Make use that your system knows its own name.

####NEED TO CHECK/change file PERMISSIONS ????HOW

Once you get a DynDNS or other address that identifies your system on the Internet, put it in your etc/hosts file. For example, if you are assigned foo.dyndns.net, then open etc/hosts in your favorite text editor
I use joe...it's very simple....konsole/...........sudoapt-get install joe
joe /etc/hosts

(use UP, DOWN, LEFT RIGHT arrows to navigate, Ctrl k x to save Ctrl h for help)

'''127.0.0.1 localhost'''

'''DO NOT REMOVE OR CHANGE THAT LINE.''' On a NEW line directly underneath it, place this line:

'''127.0.0.1 foo.dyndns.net'''

But substitute '''YOUR address''', of course......save & exit

Add some information to your /etc/asterisk/sip_nat.conf file

####NEED TO CHECK PERMISSIONS ????HOW

sudo joe /etc/asterisk/sip_nat.conf..................(your password is linuxmce)
nat=yes
externip=your.external.dotted.IPaddess

fromdomain=YOUR DynDNS name in full
localnet=192.168.80.0/255.255.255.0

::::'''save and exit'''

=='''ALL'''==

Check your /etc/asterisk/rtp.conf file

sudo joe /etc/asterisk/rtp.conf

It should contain these two lines:

rtpstart=10001

rtpend=20000

"If the port values are any different, change them. N.B. These MUST match what you opened in your firewall, and DO NOT start with port 10000, because it conflicts with usage in FreePBX Webmin
Some people feel the need to open fewer than 10,000 ports. I don't recommend this because six months from now when you start having audio problems you may not remember that you opened fewer than the recommended number of ports, and may spend hours troubleshooting the issue. But if you are simply obsessive about open ports, remember that each open SIP connection may require as many as FOUR concurrent ports, so don't cut it down to some ridiculously small number. For the non-paranoid, I suggest sticking with the recommendations above (and remember, if a hacker is looking at ports on your system, he's going to scan ALL of them, so having fewer UDP ports open really doesn't make you any more secure)."

::::'''save & exit'''

='''Keeping Asterisk current'''=
You can use this sh script. run it from the crontab, maybe every 4 hours and on boot..

#!/bin/sh
# get current ip of the router
CURRENT_IP=`/usr/bin/lynx -dump http://www.netins.net/dialup/tools/my_ip.shtml | grep -A2 "Your current IP Address is:" | tail -n2 | tr -d ' '`
# update the sip_nat.conf and re-read configs
echo "externip=$CURRENT_IP" > /tmp/sip_nat.conf
echo "localnet=192.168.80.0/255.255.255.0" >> /tmp/sip_nat.conf
echo "externrefresh=5" >> /tmp/sip_nat.conf
echo "localnet=192.168.80.0/255.255.255.0" >> /tmp/sip_nat.conf
cat /tmp/sip_nat.conf > /etc/asterisk/sip_nat.conf
chown asterisk.asterisk /etc/asterisk/sip_nat.conf
asterisk -rx reload

PERL SCRIPT from/www.freepbx.org/support/documentation/howtos/howto-resolving-audio-problems

when i tried this it threw errors.....needs a linux man for this section}}}

=='''YOU'RE ALMOST DONE !'''==

exit Konsole
GOTO ... pluto admin/wizard /advanced/config./phone setup

if the orange bar is showing in FreePBX '''click it'''

GOTO pluto admin/wizard/restart/ '''click reboot'''

GET TEA...(smoke/ have sex etc)

pickup cell/landline
dial the local number sipgate gave you.....the rest , if it works should be obvious

==TROUBLESHOOTING==

if it does'nt work
{A run perl checkip.pl}

1 check your ISP hasn't changed your IP address
2 check everything, form square one for typos
3 goto Dyndns and run their name resolver
4 consider posting in user forum-- AFTER you've had a break, freshened up, and RECHECKED EVERYTHING CAREFULLY

=='''ONCE YOU'RE RUNNING'''==
TEST TEST TEST
*read up on dial plans and tweak to your own desires
*read up on extensions/mds/voicemail/IVRs and configure to your own desires

'''PLEASE'''
*.....keep it simple and test each step as you go -it makes troubleshooting so much easier
*--- take notes, post/wiki any new knowledge

=='''LINKS'''==

BT HomeHub.........................http://www.frequencycast.co.uk/homehub.html
WIKI...............................http://wiki.linuxmce.org/index.php/Category:Phone_Lines
:::::::::::::::::::::::::::::::::::http://wiki.linuxmce.org/index.php/LinuxMCE_telecom_features

FreePBX.............................http://www.freepbx.org/support/documentation
other voip providers/setups.........http://www.freepbx.org/support/documentation/howtos/howto-setting-up-voip-provider-trunks

THE O'reiley book..................http://www.digium.com/elqNow/elqRedir.htm?ref=http://downloads.oreilly.com/books/9780596510480.pdf

[[Category: Telecom]]
[[Category: Phone Lines]]
[[Category: Tutorials]]
[[Category: VOIP Setups]]

A
<nowiki>Insert non-formatted text here</nowiki>

Sipgate.co.uk

2010-09-20T13:43:13Z

Pw44:

=SIPGATE.CO.UK=

=='''CAVEAT'''==
:1)this guide is what worked for me, It is intentionally "dumbed down" because.
::a) I have no indepth knowledge and,
::b)it's intended for the totally virgin Windows' refugee with negligible cli experience and limited typing skills

:2)If it insults your intelligence, and you get nothing from it '''GOOD'''...it means you've been lucky enough to have gained a fair amount of knowledge....'''USE''' it & when you've found the answer to your problem, '''PLEASE''' come back & share it with us lesser mortals

:3)All credit for any accuracy goes to Zaerc and Colinjones
:4)I've cut and pasted most of the material,and hopefully credited the sources, :if not, my apologies for plaugiarising your work.
:5) ALL errors are mine, please do not repeat them without giving me credit : )
* ASSUMPTIONS uk user, ISP= British TelecoN, router/modem= BT.HomeHub, dynamic IP address (section on static should work but I can't test) ......you may have to modify for any other combination

==''''''PREPARE''''''==

::READ, READ , READ....check out the links at the end for good starting points
*get fixed in your mind that "external ip"in all(?) mon-LMCE docs means the internet isp provided ip.NOT the ip of your Hybrid's "external" nic, ie the one that connects to the router
*get a pen &paper....make a clear note of settings as you go along ...DON'T trust to memory....
*bookmark usefull sites...open atleast four tabs in firefox for: google, pluto web admin,forums, homeHub adminpage, and put their bookmarks on the toolbar,don't close tabs/firefox on shutdown/reloads ....restore last session when you restart firefox.
* beware of hidden html code when cutting/pasting
'''

=='''GET INFO'''==

=='''voip provider'''==

*google "free voip" to find a provider, preferably free, pay as you go, free phone No. .. in your preffered region, according to your anticipated usage .. #check out the forums at VOXILLA for uptodate good/bad guys ...
::I chose SIPGATE>CO>UK 'cos it ticked all the boxes and there is some barebones wiki material/and a ready made trunk allready.
:::Register ,print off your details,.. your loginP/wd/user name for the website are NEVER used in any of this setup ...you'll need the 7 digit numeric sipID (usernam trunk id ), 7 digit sip password, the only place the actual localDID is used is for caller ID ?????CHECK????

*IF YOU CAN..-.beg, borrow, or steal, a windows laptop and install Xlite from spgate/settigs/help centre--it comes pre configured, - test the connection out. ::TEST IN and OUT using landline/mobile ....bear in mind the Sipgate online status page is '''only valid at login''' time.so you may have to log out and back in to check your installation's registration.

=='''Dynamic DNS'''==

Choose a Dynamic domain name sever provider , loads on google, get a free one,
*READ help/howtos
::(I chose DynDNS ,free , well known and it makes life a bit easier later) READ the instructions -
::* register -- wait for login e-mail (2 mins)
::* choose any (host)name for your hybrid,choose an extension eg. homeip.net-- take the wild card option,
::*--set IP type either static/dynamic..set ttl according to IP type.....
::*find the providers test apps and follow instructions,
:::TEST name resolution ,
:::CHECK for any blocked ports, make a note of current dynamic IP address.

=='''BT HomeHub'''==

* Does your internet connection have a static or a dynamic ip address ?
::If it's dynamic (most domestic BT BROADBAND) and you don't begrudge them the extra £5 pcm you pay for the privelige,get them to change it to static.wait for notificatin/check in HOMEHUB that it's in effect. It will make installation simpler, and allegedly is more reliable than alternatives.
::........at the same time get them to disable their own voip service, '''and''' do it yourself as well ,-if you are using their supplied HomeHub........

::::login => advanced => telephony=> uncheck the "enable telephony " box (no idea if the textphone option has an impact.)
'''YOU MUST disable BT BROADBAND TALK'''
:::: while youre in Hub admin, go into IP Adresses and note the range of DHCP pool (mine is LAN_private 192.168.1.64 - 192.168.1.237 & Gateway (your HOMEHUB ) 192.168.1.254

==='''NAT'''===
::*admin/advanced/application sharing / create new game/Manual Entry of Port Maps /
:::'''name'''(I used "sipserver")... click '''next'''
:::: check the new name is correct

::::::click '''ENTER'''
:::fill in the boxes, as follows
:::::protocl UDP from5060 to 5080 translate to 5060 Trigger protocol ANY Trigger Port leave blank ADD
:::::protocl UDP from10000 to 20000 translate to 10001 Trigger protocol ANY Trigger Port leave blank ADD

'''
CHECK SETTINGS''' its a '''PITA'''to do it later

Click '''APPLY'''

==='''MISC'''===

:GOTO FIREWALL .. set at standard
:GOTO DEVICES .. establish which entry is the HYBRID ,it SHOULD be the one at the IP youset for it earlier (if it shows a mac address, check in Pluto admin/network/network settings for a match)

CLICK '''EDIT'''

:::CHANGE name to the hostname you picked at DynDNS earlier,just the name not the (for e.g. .is-a-geek.net)
:::GAME or SERVICE ''' dropdown''' ...... pick the application ( "sipserver") you created earlier..
CLICK '''ADD'''

'''NOTE''' if you need to edit the "application" in anyway, you must first unassign it from your Hybrid, make the alterations, then remember to reassign it to the hybrid

='''LMCE'''=

:::: go into Web (pluto) admin on your core/Hybrid,login (your password is whatever you entered as first user during initial AV wizard)

*-wizard/ basic/keyboard setup.. and select relevant country (if you haven't
allready) ../ update button
==Network settings==:
*-wizard/advanced/network/network settings .... change radio button to use a static IP address
**fill in cores/Hybrids ip address as 192.165.2.X where X is outside the private lan dhcp pool for e.g 250
:::subnetmask 255.255.255.0
:::gateway/dns1/dns2 all same as your HomeHubs address (probably) 192.168.1.254
:::::::'''press green UPDATE button'''

=='''Firewall'''==

*- advanced/network/firewall rules... and use the boxes untill the rules look exactly like this,
:::::'''BE PATIENT & ACCURATE''' ....sometimes the progress bar seems to
:::::::freeze...leave it alone untill it's done it's thing

:udp....4569 to 0.......0...............core_input..............Delete
:udp....5060 to 0.......0...............core_input..............Delete
:udp....2000 to 0.......0...............core_input..............Delete
:tcp....2000 to 0.......0...............core_input..............Delete
:tcp....3877 to 3877....3877...192.168.80.1...port_forward......Delete
:udp....10001 to 20000 0...............core_input..............Delete
(port 4569 is iax protocol 5060 is sip 10001to 20000 carries the audio NB some docs say use 10000 rather than 10001''' don't''' FreePBX uses that for it's web panel

*-wizard/restart/reload router (not strictly necessary in this case but it is in others ,-get into the habit,- it doesn't cost you anything, besides, its time for tea/smoke /sex whatever takes your fancy.

=='''Phone Lines'''==
:GOTO ... pluto admin/wizard /devices/phone lines
*1)'''Check''' When dialing a local number, automatically prepend the area code and specify the areacode you would like to have prepended when dialing a local number, for instance mine is 0114 (sheffield)
*2. '''Uncheck''' Also prepend a digit (1 for US/Canada, 0 for Europe) (also optional).
*3. Local Number Length 7 (the default).

::::::Hit the '''Update''' button.
:Choose provider sipgate (try for free, pay as you go)

*1. Username <'''SipID''' from provider....>
*2. Password '''SipPassword'''from provider>
*3. Phone number <'''SipID''' from provider... AGAIN......NOT the DID ie local number.>
*4. Host <sipgate.co.uk>
*5. Hit the '''Submit''' button.
*6. Hit the '''Deactivate Automatic Configuration button''' and the following Yes button.
*7. Click the '''click here''' link (next to "Manual configuration activated. To configure AMP, click")
*8. Click Trunks, and Trunk SIP/sipgate
*9. Under "Outgoing Dial Rules" change Dial Rules to

::::112
::::999
::::0114+XXXXXXX
::::9|.

:::::1. This will recognize 112,999, the emergency numbers
:::::2. Seven digit local numbers will get 0114 prepended.
:::::3 A nine will dial out no matter how many digits.
:::::4You now can (optionally) modify other settings to your liking as well, however do NOT change the Trunk Name (leave it at the default sipgate). When done hit '''Submit Changes'''.
:::::5Click '''Reload Required Apply Configuration Changes'''
::::::: and '''Continue with reload.'''

GOTO Go back to pluto admin/Wizard > Devices > Phone Lines and hit the '''Activate Automatic Configuration button''', followed by the '''Yes and keep my advanced settings''' button.

=='''FreePBX'''==

:GOTO ... pluto admin/wizard /advanced/config./phone setup , which puts you into FreePBX webadmin

*CLICK '''"TRUNKS"''' on left hand side
*CLICK '''"sipgate"''' on right hand side

*'''CHECK''' settings are as below

PEER DETAILS
allow=alaw&alaw&ulaw&g729&gsm&slinear
auth=md5
authuser='''SIP ID'''
callerid='''SIP ID'''
canreinvite=no
context=from-trunk
dtmfmode=inband
fromdomain='''sipgate.co.uk'''
fromuser='''SIP ID'''
host='''sipgate.co.uk'''
insecure=very
nat='''yes'''
qualify=no
secret='''SIP Pwd'''
type=peer
user='''SIP ID'''
username='''SIP ID'''

USER CONTEXT
'''SIP ID'''

USER DETAILS

allow=alaw&alaw&ulaw&g729&gsm&slinear
auth=md5
authuser='''SIP ID'''
callerid='''SIP ID'''
canreinvite=no
context=from-trunk
dtmfmode=inband
fromdomain='''sipgate.co.uk'''
fromuser='''SIP ID'''
host='''sipgate.co.uk'''
insecure=very
nat='''yes'''
qualify=no
secret='''SIP Pwd'''
type=user
user='''SIP ID'''
username='''SIP ID'''

REGISTER STRING
'''SIP ID:SIP password@sipgate.co.uk/SIP ID
'''
:::click '''submit button'''
::::then..
:::click'''orange config bar''' at top of page

'''make sure''' pluto admin/advanced/configuration/phones setup.....
FreePBX...../outbound route / 0sipgate settings are as below

...trunk sequence 0 (drop down =) '''SIP/sipgate'''
:::click '''submit button'''
::::then..
:::click'''orange config bar''' at top of page

='''Asterisk'''=

[(RIP-OFF FROM) <nowiki>freepbx.org/support/documentation/howtos/howto-resolving-audio-problems]</nowiki>

=='''DYNAMIC ADDRESS'''==

####NEED TO CHECK/change file PERMISSIONS ????HOW

*Once you get a DynDNS or other address that identifies your system on the Internet, put it in your etc/hosts file. For example, if you are assigned foo.dyndns.net, then open etc/hosts in your favorite text editor
(I use joe...it's very simple....konsole/...........sudoapt-get install joe)
::::* joe /etc/hosts

:::::::(use UP, DOWN, LEFT RIGHT arrows to navigate, Ctrl k x to save Ctrl h for help)

'''127.0.0.1 localhost'''

'''DO NOT REMOVE OR CHANGE THAT LINE.''' On a NEW line directly underneath it, place this line:
'''
127.0.0.1 foo.dyndns.net'''

But substitute '''YOUR address''', of course......

:::::'''save & exit'''

Add some information to your /etc/asterisk/sip_nat.conf file

####NEED TO CHECK PERMISSIONS ????HOW

sudo joe /etc/asterisk/sip_nat.conf..................(your password is linuxmce)
nat=yes
externhost=YOUR FULL DynDNS address e.g dummy.is-a-geek.net
externrefresh=10
localnet=192.168.80.0/255.255.255.0

:::::'''save and exit'''

=='''STATIC ADDRESS'''==

Make use that your system knows its own name.

####NEED TO CHECK/change file PERMISSIONS ????HOW

Once you get a DynDNS or other address that identifies your system on the Internet, put it in your etc/hosts file. For example, if you are assigned foo.dyndns.net, then open etc/hosts in your favorite text editor
I use joe...it's very simple....konsole/...........sudoapt-get install joe
joe /etc/hosts

(use UP, DOWN, LEFT RIGHT arrows to navigate, Ctrl k x to save Ctrl h for help)

'''127.0.0.1 localhost'''

'''DO NOT REMOVE OR CHANGE THAT LINE.''' On a NEW line directly underneath it, place this line:

'''127.0.0.1 foo.dyndns.net'''

But substitute '''YOUR address''', of course......save & exit

Add some information to your /etc/asterisk/sip_nat.conf file

####NEED TO CHECK PERMISSIONS ????HOW

sudo joe /etc/asterisk/sip_nat.conf..................(your password is linuxmce)
nat=yes
externip=your.external.dotted.IPaddess

fromdomain=YOUR DynDNS name in full
localnet=192.168.80.0/255.255.255.0

::::'''save and exit'''

=='''ALL'''==

Check your /etc/asterisk/rtp.conf file

sudo joe /etc/asterisk/rtp.conf

It should contain these two lines:

rtpstart=10001

rtpend=20000

"If the port values are any different, change them. N.B. These MUST match what you opened in your firewall, and DO NOT start with port 10000, because it conflicts with usage in FreePBX Webmin
Some people feel the need to open fewer than 10,000 ports. I don't recommend this because six months from now when you start having audio problems you may not remember that you opened fewer than the recommended number of ports, and may spend hours troubleshooting the issue. But if you are simply obsessive about open ports, remember that each open SIP connection may require as many as FOUR concurrent ports, so don't cut it down to some ridiculously small number. For the non-paranoid, I suggest sticking with the recommendations above (and remember, if a hacker is looking at ports on your system, he's going to scan ALL of them, so having fewer UDP ports open really doesn't make you any more secure)."

::::'''save & exit'''

='''Keeping Asterisk current'''=
You can use this sh script. run it from the crontab, maybe every 4 hours and on boot..

#!/bin/sh
# get current ip of the router
CURRENT_IP=`/usr/bin/lynx -dump http://www.netins.net/dialup/tools/my_ip.shtml | grep -A2 "Your current IP Address is:" | tail -n2 | tr -d ' '`
# update the sip_nat.conf and re-read configs
echo "externip=$CURRENT_IP" > /tmp/sip_nat.conf
echo "localnet=192.168.80.0/255.255.255.0" >> /tmp/sip_nat.conf
echo "externrefresh=5" >> /tmp/sip_nat.conf
echo "localnet=192.168.80.0/255.255.255.0" >> /tmp/sip_nat.conf
cat /tmp/sip_nat.conf > /etc/asterisk/sip_nat.conf
chown asterisk.asterisk /etc/asterisk/sip_nat.conf
asterisk -rx reload

PERL SCRIPT from/www.freepbx.org/support/documentation/howtos/howto-resolving-audio-problems

when i tried this it threw errors.....needs a linux man for this section}}}

=='''YOU'RE ALMOST DONE !'''==

exit Konsole
GOTO ... pluto admin/wizard /advanced/config./phone setup

if the orange bar is showing in FreePBX '''click it'''

GOTO pluto admin/wizard/restart/ '''click reboot'''

GET TEA...(smoke/ have sex etc)

pickup cell/landline
dial the local number sipgate gave you.....the rest , if it works should be obvious

==TROUBLESHOOTING==

if it does'nt work
{A run perl checkip.pl}

1 check your ISP hasn't changed your IP address
2 check everything, form square one for typos
3 goto Dyndns and run their name resolver
4 consider posting in user forum-- AFTER you've had a break, freshened up, and RECHECKED EVERYTHING CAREFULLY

=='''ONCE YOU'RE RUNNING'''==
TEST TEST TEST
*read up on dial plans and tweak to your own desires
*read up on extensions/mds/voicemail/IVRs and configure to your own desires

'''PLEASE'''
*.....keep it simple and test each step as you go -it makes troubleshooting so much easier
*--- take notes, post/wiki any new knowledge

=='''LINKS'''==

BT HomeHub.........................http://www.frequencycast.co.uk/homehub.html
WIKI...............................http://wiki.linuxmce.org/index.php/Category:Phone_Lines
:::::::::::::::::::::::::::::::::::http://wiki.linuxmce.org/index.php/LinuxMCE_telecom_features

FreePBX.............................http://www.freepbx.org/support/documentation
other voip providers/setups.........http://www.freepbx.org/support/documentation/howtos/howto-setting-up-voip-provider-trunks

THE O'reiley book..................http://www.digium.com/elqNow/elqRedir.htm?ref=http://downloads.oreilly.com/books/9780596510480.pdf

[[Category: Telecom]]
[[Category: Phone Lines]]
[[Category: Tutorials]]
[[Category: VOIP Setups]]

A
<nowiki>Insert non-formatted text here</nowiki>

Fail2ban - A tool against brute force

2010-09-20T13:40:45Z

Pw44:

[[Category: Tutorials]]

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 5
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

I hope this helps.

source:
http://www.fail2ban.org
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
http://www.fail2ban.org/wiki/index.php/Asterisk

Fail2ban - A tool against brute force

2010-09-20T00:56:12Z

Pw44:

[[Category: Tutorials]]

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by fail2ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 5
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start fail2ban type the following as root:

/etc/init.d/fail2ban start

Check It

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

I hope this helps.

source: http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk

Fail2ban - A tool against brute force

2010-09-20T00:54:02Z

Pw44:

[[Category: Tutorials]]

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by Fail2Ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 5
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start Fail2Ban type the following as root:

/etc/init.d/fail2ban start

Check It

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

I hope this helps.

source: http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk

Fail2ban - A tool against brute force

2010-09-20T00:37:28Z

Pw44:

[[Category: Tutorials]]

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, it did not take 2 days and some "smart guy" was trying to register to take advantage of it, and causing me losses.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for Asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by Fail2Ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 5
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start Fail2Ban type the following as root:

/etc/init.d/fail2ban start

Check It

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

I hope this helps.

source: http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk

Fail2ban tool against brute force

2010-09-20T00:34:24Z

Pw44: Fail2ban tool against brute force moved to Fail2ban - A tool against brute force: Title was revised

#REDIRECT [[Fail2ban - A tool against brute force]]

Fail2ban - A tool against brute force

2010-09-20T00:34:24Z

Pw44: Fail2ban tool against brute force moved to Fail2ban - A tool against brute force: Title was revised

[[Category: Tutorials]]

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, i did not take 2 days and someone was trying to register to take advantage of it.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for Asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by Fail2Ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 5
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start Fail2Ban type the following as root:

/etc/init.d/fail2ban start

Check It

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not see something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

I hope this helps.

source: http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk

Fail2ban - A tool against brute force

2010-09-20T00:33:20Z

Pw44:

Fail2ban - A tool against brute force

2010-09-20T00:31:56Z

Pw44:

[[Category: Tutorials]]

Having asterik installed is almost an invitation for others wishing to place calls at your expense.

After configuring my sip trunk, i did not take 2 days and someone was trying to register to take advantage of it.

Fail2ban prevented it, blocking the attacker with iptables rules.

Installing fail2ban is not complicated and i will describe the steps to have it properly installed and configured, so you can protect your asterisk and other services from brute force attack.

Install with:
sudo apt-get install fail2ban

After is installed, you need to change /etc/asterisk/logger.conf and add the following line under [general] section (You may have to create this before the [logfiles] section).

[general]
dateformat=%F %T

In /etc/asterisk/logger.conf add the following line under the [logfiles] section for Asterisk to log NOTICE level events to the syslog (/var/log/messages) as well as its normal log file. These entries in syslog will have a Date/Time stamp that is usable by Fail2Ban.

syslog.local0 => notice

Reload asterisk with:

asterisk -rx "logger reload"

Configuring fail2ban:

cd /etc/fail2ban/filter.d

touch asterisk.conf

vi asterisk.conf

insert the following (copy & paste)

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
NOTICE.* <HOST> failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' $from <HOST>$
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath = /var/log/asterisk/full
maxretry = 5
bantime = 259200

Locate the line ignoreip in /etc/fail2ban/jail.conf (beginning of the file) and insert the ip's and / or blocks you want fail2ban to ignore, so you don't risk banning yourserf or any host in your network.

Mine is defined as follows:

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0 192.168.0.0

To start Fail2Ban type the following as root:

/etc/init.d/fail2ban start

Check It

If started properly issue the following command to view your iptables rules:

iptables -L -v

You should see something like the following for the INPUT chain (this is the ouput of mine)

Chain INPUT (policy DROP 2241 packets, 160K bytes)
pkts bytes target prot opt in out source destination
372 27264 '''fail2ban-SSH''' tcp -- any any anywhere anywhere tcp dpt:ssh
1312K 991M '''fail2ban-ASTERISK''' all -- any any anywhere anywhere
553K 81M ACCEPT all -- lo any anywhere anywhere
1288K 1162M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
9 540 ACCEPT all -- any any anywhere anywhere MARK match 0x1
2 1152 ACCEPT udp -- any any anywhere anywhere udp dpt:bootps
19276 5790K ACCEPT all -- any any 192.168.80.0/24 anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:iax
4 1795 ACCEPT udp -- any any anywhere anywhere udp dpt:sip
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:2000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:sieve
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1723
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www
1 60 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
1 50 ACCEPT udp -- any any anywhere anywhere udp dpts:10001:20000
0 0 ACCEPT gre -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 719K packets, 245M bytes)
pkts bytes target prot opt in out source destination
0 0 TCPMSS tcp -- any ppp+ anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 2099K packets, 590M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT gre -- any any anywhere anywhere
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
5091 2125K DROP all -- any any 173.193.194.106-static.reverse.softlayer.com anywhere
1307K 989M RETURN all -- any any anywhere anywhere
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination

If you do not seem something similar to that then you have some troubleshooting to, check out /var/log/fail2ban.log.

Example of my /var/log/fai2ban.log (173.193.194.106 is the real address from the attacker fail2ban banned):

....
2010-09-19 11:12:56,131 fail2ban.filter : INFO Set maxRetry = 6
2010-09-19 11:12:56,133 fail2ban.filter : INFO Set findtime = 600
2010-09-19 11:12:56,133 fail2ban.actions: INFO Set banTime = 600
2010-09-19 11:12:56,138 fail2ban.jail : INFO Jail 'ssh-iptables' started
2010-09-19 11:12:56,139 fail2ban.jail : INFO Jail 'asterisk-iptables' started
2010-09-19 11:12:56,141 fail2ban.jail : INFO Jail 'apache-tcpwrapper' started
2010-09-19 15:33:50,392 fail2ban.actions: WARNING [asterisk-iptables] Ban 173.193.194.106
2010-09-19 15:34:50,982 fail2ban.actions: WARNING [asterisk-iptables] 173.193.194.106 already banned

And this is the log (/var/log/asterisk/messages) showing the attack:

[2010-09-19 15:33:48] NOTICE[26690] chan_sip.c: Registration from '"3235410554"<sip:3235410554@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"thomas"<sip:thomas@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"arsenal"<sip:arsenal@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"letmein"<sip:letmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"liverpool"<sip:liverpool@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"nevermind"<sip:nevermind@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"getmein"<sip:getmein@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"echo"<sip:echo@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw325"<sip:bmw325@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"bmw335"<sip:bmw335@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e"<sip:1q2w3e@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w3e4r5t6y"<sip:1q2w3e4r5t6y@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q1q2w2w"<sip:1q1q2w2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w1q2w"<sip:1q2w1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1q2w"<sip:1q2w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"11q22w"<sip:11q22w@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2"<sip:q1w2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"q1w2e3"<sip:q1w2e3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"tvv03tvv03"<sip:tvv03tvv03@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd1"<sip:abcd1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd12"<sip:abcd12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"abcd123"<sip:abcd123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"qq11ww22ee33rr44"<sip:qq11ww22ee33rr44@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1"<sip:sip1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip2"<sip:sip2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12"<sip:sip12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip123"<sip:sip123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1234"<sip:sip1234@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip12345"<sip:sip12345@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip1111"<sip:sip1111@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"sip222"<sip:sip222@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:49] NOTICE[26690] chan_sip.c: Registration from '"1qa2ws3ed"<sip:1qa2ws3ed@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234asdf"<sip:1234asdf@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d"<sip:1a2s3d@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1a2s3d4f"<sip:1a2s3d4f@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"asdzxc"<sip:asdzxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"123zxc"<sip:123zxc@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"1234zxcv"<sip:1234zxcv@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"aazzssxx"<sip:aazzssxx@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssword"<sip:p@ssword@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"p@ssw0rd"<sip:p@ssw0rd@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass1"<sip:pass1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"password3"<sip:password3@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"pass12"<sip:pass12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account"<sip:account@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"passlogin"<sip:passlogin@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account1"<sip:account1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account5"<sip:account5@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account6"<sip:account6@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account123"<sip:account123@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"account12"<sip:account12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc1"<sip:acc1@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc2"<sip:acc2@201.29.213.245>' failed for '173.193.194.106' - No matching peer found
[2010-09-19 15:33:50] NOTICE[26690] chan_sip.c: Registration from '"acc12"<sip:acc12@201.29.213.245>' failed for '173.193.194.106' - No matching peer found

I hope this helps.

source: http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk

Fail2ban - A tool against brute force

2010-09-20T00:16:55Z

Pw44:

Fail2ban - A tool against brute force

2010-09-20T00:15:27Z

Pw44:

Fail2ban - A tool against brute force

2010-09-20T00:13:26Z

Pw44: New page: Category: Tutorials Having asterik installed is almost an invitation for others wishing to place calls at your expense. After configuring my sip trunk, i did not take 2 days and some...

Sipgate.co.uk

2010-08-13T20:39:16Z

Pw44:

=SIPGATE.CO.UK=

=='''CAVEAT'''==
:1)this guide is what worked for me, It is intentionally "dumbed down" because.
::a) I have no indepth knowledge and,
::b)it's intended for the totally virgin Windows' refugee with negligible cli experience and limited typing skills

:2)If it insults your intelligence, and you get nothing from it '''GOOD'''...it means you've been lucky enough to have gained a fair amount of knowledge....'''USE''' it & when you've found the answer to your problem, '''PLEASE''' come back & share it with us lesser mortals

:3)All credit for any accuracy goes to Zaerc and Colinjones
:4)I've cut and pasted most of the material,and hopefully credited the sources, :if not, my apologies for plaugiarising your work.
:5) ALL errors are mine, please do not repeat them without giving me credit : )
* ASSUMPTIONS uk user, ISP= British TelecoN, router/modem= BT.HomeHub, dynamic IP address (section on static should work but I can't test) ......you may have to modify for any other combination

==''''''PREPARE''''''==

::READ, READ , READ....check out the links at the end for good starting points
*get fixed in your mind that "external ip"in all(?) mon-LMCE docs means the internet isp provided ip.NOT the ip of your Hybrid's "external" nic, ie the one that connects to the router
*get a pen &paper....make a clear note of settings as you go along ...DON'T trust to memory....
*bookmark usefull sites...open atleast four tabs in firefox for: google, pluto web admin,forums, homeHub adminpage, and put their bookmarks on the toolbar,don't close tabs/firefox on shutdown/reloads ....restore last session when you restart firefox.
* beware of hidden html code when cutting/pasting
'''

=='''GET INFO'''==

=='''voip provider'''==

*google "free voip" to find a provider, preferably free, pay as you go, free phone No. .. in your preffered region, according to your anticipated usage .. #check out the forums at VOXILLA for uptodate good/bad guys ...
::I chose SIPGATE>CO>UK 'cos it ticked all the boxes and there is some barebones wiki material/and a ready made trunk allready.
:::Register ,print off your details,.. your loginP/wd/user name for the website are NEVER used in any of this setup ...you'll need the 7 digit numeric sipID (usernam trunk id ), 7 digit sip password, the only place the actual localDID is used is for caller ID ?????CHECK????

*IF YOU CAN..-.beg, borrow, or steal, a windows laptop and install Xlite from spgate/settigs/help centre--it comes pre configured, - test the connection out. ::TEST IN and OUT using landline/mobile ....bear in mind the Sipgate online status page is '''only valid at login''' time.so you may have to log out and back in to check your installation's registration.

=='''Dynamic DNS'''==

Choose a Dynamic domain name sever provider , loads on google, get a free one,
*READ help/howtos
::(I chose DynDNS ,free , well known and it makes life a bit easier later) READ the instructions -
::* register -- wait for login e-mail (2 mins)
::* choose any (host)name for your hybrid,choose an extension eg. homeip.net-- take the wild card option,
::*--set IP type either static/dynamic..set ttl according to IP type.....
::*find the providers test apps and follow instructions,
:::TEST name resolution ,
:::CHECK for any blocked ports, make a note of current dynamic IP address.

=='''BT HomeHub'''==

* Does your internet connection have a static or a dynamic ip address ?
::If it's dynamic (most domestic BT BROADBAND) and you don't begrudge them the extra £5 pcm you pay for the privelige,get them to change it to static.wait for notificatin/check in HOMEHUB that it's in effect. It will make installation simpler, and allegedly is more reliable than alternatives.
::........at the same time get them to disable their own voip service, '''and''' do it yourself as well ,-if you are using their supplied HomeHub........

::::login => advanced => telephony=> uncheck the "enable telephony " box (no idea if the textphone option has an impact.)
'''YOU MUST disable BT BROADBAND TALK'''
:::: while youre in Hub admin, go into IP Adresses and note the range of DHCP pool (mine is LAN_private 192.168.1.64 - 192.168.1.237 & Gateway (your HOMEHUB ) 192.168.1.254

==='''NAT'''===
::*admin/advanced/application sharing / create new game/Manual Entry of Port Maps /
:::'''name'''(I used "sipserver")... click '''next'''
:::: check the new name is correct

::::::click '''ENTER'''
:::fill in the boxes, as follows
:::::protocl UDP from5060 to 5080 translate to 5060 Trigger protocol ANY Trigger Port leave blank ADD
:::::protocl UDP from10000 to 20000 translate to 10001 Trigger protocol ANY Trigger Port leave blank ADD

'''
CHECK SETTINGS''' its a '''PITA'''to do it later

Click '''APPLY'''

==='''MISC'''===

:GOTO FIREWALL .. set at standard
:GOTO DEVICES .. establish which entry is the HYBRID ,it SHOULD be the one at the IP youset for it earlier (if it shows a mac address, check in Pluto admin/network/network settings for a match)

CLICK '''EDIT'''

:::CHANGE name to the hostname you picked at DynDNS earlier,just the name not the (for e.g. .is-a-geek.net)
:::GAME or SERVICE ''' dropdown''' ...... pick the application ( "sipserver") you created earlier..
CLICK '''ADD'''

'''NOTE''' if you need to edit the "application" in anyway, you must first unassign it from your Hybrid, make the alterations, then remember to reassign it to the hybrid

='''LMCE'''=

:::: go into Web (pluto) admin on your core/Hybrid,login (your password is whatever you entered as first user during initial AV wizard)

*-wizard/ basic/keyboard setup.. and select relevant country (if you haven't
allready) ../ update button
==Network settings==:
*-wizard/advanced/network/network settings .... change radio button to use a static IP address
**fill in cores/Hybrids ip address as 192.165.2.X where X is outside the private lan dhcp pool for e.g 250
:::subnetmask 255.255.255.0
:::gateway/dns1/dns2 all same as your HomeHubs address (probably) 192.168.1.254
:::::::'''press green UPDATE button'''

=='''Firewall'''==

*- advanced/network/firewall rules... and use the boxes untill the rules look exactly like this,
:::::'''BE PATIENT & ACCURATE''' ....sometimes the progress bar seems to
:::::::freeze...leave it alone untill it's done it's thing

:udp....4569 to 0.......0...............core_input..............Delete
:udp....5060 to 0.......0...............core_input..............Delete
:udp....2000 to 0.......0...............core_input..............Delete
:tcp....2000 to 0.......0...............core_input..............Delete
:tcp....3877 to 3877....3877...192.168.80.1...port_forward......Delete
:udp....10001 to 20000 0...............core_input..............Delete
(port 4569 is iax protocol 5060 is sip 10001to 20000 carries the audio NB some docs say use 10000 rather than 10001''' don't''' FreePBX uses that for it's web panel

*-wizard/restart/reload router (not strictly necessary in this case but it is in others ,-get into the habit,- it doesn't cost you anything, besides, its time for tea/smoke /sex whatever takes your fancy.

=='''Phone Lines'''==
:GOTO ... pluto admin/wizard /devices/phone lines
*1)'''Check''' When dialing a local number, automatically prepend the area code and specify the areacode you would like to have prepended when dialing a local number, for instance mine is 0114 (sheffield)
*2. '''Uncheck''' Also prepend a digit (1 for US/Canada, 0 for Europe) (also optional).
*3. Local Number Length 7 (the default).

::::::Hit the '''Update''' button.
:Choose provider sipgate (try for free, pay as you go)

*1. Username <'''SipID''' from provider....>
*2. Password '''SipPassword'''from provider>
*3. Phone number <'''SipID''' from provider... AGAIN......NOT the DID ie local number.>
*4. Host <sipgate.co.uk>
*5. Hit the '''Submit''' button.
*6. Hit the '''Deactivate Automatic Configuration button''' and the following Yes button.
*7. Click the '''click here''' link (next to "Manual configuration activated. To configure AMP, click")
*8. Click Trunks, and Trunk SIP/sipgate
*9. Under "Outgoing Dial Rules" change Dial Rules to

::::112
::::999
::::0114+XXXXXXX
::::9|.

:::::1. This will recognize 112,999, the emergency numbers
:::::2. Seven digit local numbers will get 0114 prepended.
:::::3 A nine will dial out no matter how many digits.
:::::4You now can (optionally) modify other settings to your liking as well, however do NOT change the Trunk Name (leave it at the default sipgate). When done hit '''Submit Changes'''.
:::::5Click '''Reload Required Apply Configuration Changes'''
::::::: and '''Continue with reload.'''

GOTO Go back to pluto admin/Wizard > Devices > Phone Lines and hit the '''Activate Automatic Configuration button''', followed by the '''Yes and keep my advanced settings''' button.

=='''FreePBX'''==

:GOTO ... pluto admin/wizard /advanced/config./phone setup , which puts you into FreePBX webadmin

*CLICK '''"TRUNKS"''' on left hand side
*CLICK '''"sipgate"''' on right hand side

*'''CHECK''' settings are as below

PEER DETAILS
allow=alaw&alaw&ulaw&g729&gsm&slinear
auth=md5
authuser='''SIP ID'''
callerid='''SIP ID'''
canreinvite=no
context=from-trunk
dtmfmode=inband
fromdomain='''sipgate.co.uk'''
fromuser='''SIP ID'''
host='''sipgate.co.uk'''
insecure=very
nat='''yes'''
qualify=no
secret='''SIP Pwd'''
type=peer
user='''SIP ID'''
username='''SIP ID'''

USER CONTEXT
'''SIP ID'''

USER DETAILS

allow=alaw&alaw&ulaw&g729&gsm&slinear
auth=md5
authuser='''SIP ID'''
callerid='''SIP ID'''
canreinvite=no
context=from-trunk
dtmfmode=inband
fromdomain='''sipgate.co.uk'''
fromuser='''SIP ID'''
host='''sipgate.co.uk'''
insecure=very
nat='''yes'''
qualify=no
secret='''SIP Pwd'''
type=user
user='''SIP ID'''
username='''SIP ID'''

REGISTER STRING
'''SIP ID:SIP password@sipgate.co.uk/SIP ID
'''
:::click '''submit button'''
::::then..
:::click'''orange config bar''' at top of page

'''make sure''' pluto admin/advanced/configuration/phones setup.....
FreePBX...../outbound route / 0sipgate settings are as below

...trunk sequence 0 (drop down =) '''SIP/sipgate'''
:::click '''submit button'''
::::then..
:::click'''orange config bar''' at top of page

='''Asterisk'''=

[(RIP-OFF FROM) <nowiki>freepbx.org/support/documentation/howtos/howto-resolving-audio-problems]</nowiki>

=='''DYNAMIC ADDRESS'''==

####NEED TO CHECK/change file PERMISSIONS ????HOW

*Once you get a DynDNS or other address that identifies your system on the Internet, put it in your etc/hosts file. For example, if you are assigned foo.dyndns.net, then open etc/hosts in your favorite text editor
(I use joe...it's very simple....konsole/...........sudoapt-get install joe)
::::* joe /etc/hosts

:::::::(use UP, DOWN, LEFT RIGHT arrows to navigate, Ctrl k x to save Ctrl h for help)

'''127.0.0.1 localhost'''

'''DO NOT REMOVE OR CHANGE THAT LINE.''' On a NEW line directly underneath it, place this line:
'''
127.0.0.1 foo.dyndns.net'''

But substitute '''YOUR address''', of course......

:::::'''save & exit'''

Add some information to your /etc/asterisk/sip_nat.conf file

####NEED TO CHECK PERMISSIONS ????HOW

sudo joe /etc/asterisk/sip_nat.conf..................(your password is linuxmce)
nat=yes
externhost=YOUR FULL DynDNS address e.g dummy.is-a-geek.net
externrefresh=10
localnet=192.168.80.0/255.255.255.0

:::::'''save and exit'''

=='''STATIC ADDRESS'''==

Make use that your system knows its own name.

####NEED TO CHECK/change file PERMISSIONS ????HOW

Once you get a DynDNS or other address that identifies your system on the Internet, put it in your etc/hosts file. For example, if you are assigned foo.dyndns.net, then open etc/hosts in your favorite text editor
I use joe...it's very simple....konsole/...........sudoapt-get install joe
joe /etc/hosts

(use UP, DOWN, LEFT RIGHT arrows to navigate, Ctrl k x to save Ctrl h for help)

'''127.0.0.1 localhost'''

'''DO NOT REMOVE OR CHANGE THAT LINE.''' On a NEW line directly underneath it, place this line:

'''127.0.0.1 foo.dyndns.net'''

But substitute '''YOUR address''', of course......save & exit

Add some information to your /etc/asterisk/sip_nat.conf file

####NEED TO CHECK PERMISSIONS ????HOW

sudo joe /etc/asterisk/sip_nat.conf..................(your password is linuxmce)
nat=yes
externip=your.external.dotted.IPaddess

fromdomain=YOUR DynDNS name in full
localnet=192.168.80.0/255.255.255.0

::::'''save and exit'''

=='''ALL'''==

Check your /etc/asterisk/rtp.conf file

sudo joe /etc/asterisk/rtp.conf

It should contain these two lines:

rtpstart=10001

rtpend=20000

"If the port values are any different, change them. N.B. These MUST match what you opened in your firewall, and DO NOT start with port 10000, because it conflicts with usage in FreePBX Webmin
Some people feel the need to open fewer than 10,000 ports. I don't recommend this because six months from now when you start having audio problems you may not remember that you opened fewer than the recommended number of ports, and may spend hours troubleshooting the issue. But if you are simply obsessive about open ports, remember that each open SIP connection may require as many as FOUR concurrent ports, so don't cut it down to some ridiculously small number. For the non-paranoid, I suggest sticking with the recommendations above (and remember, if a hacker is looking at ports on your system, he's going to scan ALL of them, so having fewer UDP ports open really doesn't make you any more secure)."

::::'''save & exit'''

='''Keeping Asterisk current'''=
You can use this sh script. run it from the crontab, maybe every 4 hours and on boot..

#!/bin/sh

# get current ip of the router

CURRENT_IP=`/usr/bin/lynx -dump http://www.netins.net/dialup/tools/my_ip.shtml | grep -A2 "Your current IP Address is:" | tail -n2 | tr -d ' '`

# update the sip_nat.conf and re-read configs

echo "externip=$CURRENT_IP" > /tmp/sip_nat.conf

echo "localnet=192.168.80.0/255.255.255.0" >> /tmp/sip_nat.conf

echo "externrefresh=5" >> /tmp/sip_nat.conf

echo "localnet=192.168.80.0/255.255.255.0" >> /tmp/sip_nat.conf

cat /tmp/sip_nat.conf > /etc/asterisk/sip_nat.conf

chown asterisk.asterisk /etc/asterisk/sip_nat.conf

asterisk -rx reload

PERL SCRIPT from/www.freepbx.org/support/documentation/howtos/howto-resolving-audio-problems

when i tried this it threw errors.....needs a linux man for this section}}}

=='''YOU'RE ALMOST DONE !'''==

exit Konsole
GOTO ... pluto admin/wizard /advanced/config./phone setup

if the orange bar is showing in FreePBX '''click it'''

GOTO pluto admin/wizard/restart/ '''click reboot'''

GET TEA...(smoke/ have sex etc)

pickup cell/landline
dial the local number sipgate gave you.....the rest , if it works should be obvious

==TROUBLESHOOTING==

if it does'nt work
{A run perl checkip.pl}

1 check your ISP hasn't changed your IP address
2 check everything, form square one for typos
3 goto Dyndns and run their name resolver
4 consider posting in user forum-- AFTER you've had a break, freshened up, and RECHECKED EVERYTHING CAREFULLY

=='''ONCE YOU'RE RUNNING'''==
TEST TEST TEST
*read up on dial plans and tweak to your own desires
*read up on extensions/mds/voicemail/IVRs and configure to your own desires

'''PLEASE'''
*.....keep it simple and test each step as you go -it makes troubleshooting so much easier
*--- take notes, post/wiki any new knowledge

=='''LINKS'''==

BT HomeHub.........................http://www.frequencycast.co.uk/homehub.html
WIKI...............................http://wiki.linuxmce.org/index.php/Category:Phone_Lines
:::::::::::::::::::::::::::::::::::http://wiki.linuxmce.org/index.php/LinuxMCE_telecom_features

FreePBX.............................http://www.freepbx.org/support/documentation
other voip providers/setups.........http://www.freepbx.org/support/documentation/howtos/howto-setting-up-voip-provider-trunks

THE O'reiley book..................http://www.digium.com/elqNow/elqRedir.htm?ref=http://downloads.oreilly.com/books/9780596510480.pdf

[[Category: Telecom]]
[[Category: Phone Lines]]
[[Category: Tutorials]]
[[Category: VOIP Setups]]

A
<nowiki>Insert non-formatted text here</nowiki>