SOLVED continuous attacks from one IP 185.147.215.13

Status
Not open for further replies.

PJPMontreal

Member
Feb 28, 2020
59
2
8
57
Hi Guys,
I see on Log Viewer a continuous intents to register from this IP 185.147.215.13 which apparently is in Germany.
This IP have nothing to do with my configuration...
Is this something I have to be worry?
How to stop these intents or definitely block this IP in my FusionPBX server.
attack.png
 

PJPMontreal

Member
Feb 28, 2020
59
2
8
57
I suggest you give the docs a read regarding Fail2ban.
https://docs.fusionpbx.com/en/latest/firewall/fail2ban.html
If you are using domain based registrations, you can enable the Freeswitch-ip and auth-challenge-ip rules to cut down on the repeat offenders.
Thanks ad5ou, Would you please point me step by step how to enable Freeswitch-ip and auth-challenge-ip?
Where exactly I can do that... I did read the Fail2ban and still don't get it....
Is on Putty when logged into the root? then which command?
or is something we can do on the FusionPBX menu web interface?
or maybe editing some files on /etc/fail2ban/jail or something using the WinSCP ??
 
Last edited:

krooney

Member
Jun 18, 2018
160
16
18
The link provided by @ad5ou explains exactly what to do to enable it
ssh in your pbx and you must edit nano /etc/fail2ban/jail.local
 

PJPMontreal

Member
Feb 28, 2020
59
2
8
57
Sorry Krooney, but I'm still lost.... in my /etc/fail2ban/jail.local file I can't see any Freeswitch-ip or auth-challenge-ip there to enable
Apologies for my inexperience!
 
Status
Not open for further replies.