Uploaded image for project: 'FreePBX'
  1. FreePBX
  2. FREEPBX-22196

SIP device with a lot of BLFs can trigger a responsive firewall block

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 15, 16
    • Fix Version/s: 14, 15, 16
    • Component/s: Firewall
    • Labels:
      None
    • Sprint:
      Sprint 45, Sprint 46
    • ToDo:

      Description

      Customer was having issues where legitimate phone registrations thru the responsive firewall were being flagged as abuser by responsive and getting blocked. Thru experimentation, they determined that a single device with a lot of BLF subscriptions might be enough to trigger the block. The sequence of steps goes like this:

      device Sends SIP REGISTER
      Asterisk allows registration
      firewall daemon is not yet aware of the registration due to the lag
      device sends flood of SUBSCRIBE packets
      iptables senses a lot of SIP packets from this device which is not yet whitelisted in responsive and blocks the IP

      from this point on, the responsive block stays in place

        Gliffy Diagrams

          Attachments

          1. Capture.PNG
            Capture.PNG
            66 kB
          2. image-2021-02-15-17-08-00-195.png
            image-2021-02-15-17-08-00-195.png
            50 kB
          3. image-2021-02-22-17-45-47-080.png
            image-2021-02-22-17-45-47-080.png
            51 kB
          4. rfwtshld.PNG
            rfwtshld.PNG
            13 kB
          5. screenshot-1.png
            screenshot-1.png
            6.02 MB

            Activity

              People

              • Assignee:
                kgupta Kapil Gupta
                Reporter:
                lgaetz Lorne Gaetz
              • Votes:
                2 Vote for this issue
                Watchers:
                11 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Feedback Requested:

                  NextupJiraPlusStatus

                  Error rendering 'slack.nextup.jira:nextup-jira-plus-status'. Please contact your Jira administrators.