Amazing insight everyone! And amazing names too, shoutout
@pbxnerd LOL. I'm currently trunking via SignalWire, I considered Telnyx but I have seen them go down FAR too many times (and for too long, when they do). For context, we're dealing with thousands of high value calls a day so, we literally can't afford downtime. I'm likely add Twilio/others for redundancy.
It might not (definitely
probably not) be best practice, but so far I have been able to filter out MOST inbound attempts in a dialplan
XML:
<context name="default">
<extension name="block_scanners">
<condition field="${sip_user_agent}" expression="(friendly-scanner|sipcli|sipsak|sipvicious|sip-scan|sundayddr|iWar|CSipSimple|sipcli|Asterisk PBX|sipv|VaxIPUserAgent|VaxSIPUserAgent)">
<action application="log" data="ALERT Blocked scanner: ${sip_user_agent} from ${network_addr}"/>
<action application="respond" data="403 Forbidden"/>
<action application="hangup" data="CALL_REJECTED"/>
</condition>
</extension>
<extension name="block_sipvicious_callerid">
<condition field="${caller_id_name}" expression="^(sipvicious|friendly-scanner|sipcli)$">
<action application="log" data="ALERT Blocked scanner in caller ID from ${network_addr}"/>
<action application="respond" data="403 Forbidden"/>
<action application="hangup" data="CALL_REJECTED"/>
</condition>
</extension>
<extension name="block_sequential_extensions">
<condition field="${destination_number}" expression="^(100|101|102|103|1000|1001|1002)$"/>
<condition field="${sip_authorized}" expression="^false$">
<action application="log" data="ALERT Blocked extension probe: ${destination_number} from ${network_addr}"/>
<action application="respond" data="403 Forbidden - Invalid Extension"/>
<action application="hangup" data="CALL_REJECTED"/>
</condition>
</extension>
<extension name="block_spoofed_callid">
<condition field="${sip_call_id}" expression="@0\.0\.0\.0$">
<action application="log" data="ALERT Blocked spoofed call-id from ${network_addr}"/>
<action application="respond" data="403 Forbidden - Invalid Call-ID"/>
<action application="hangup" data="CALL_REJECTED"/>
</condition>
</extension>
<extension name="block_spoofed_from">
<condition field="${sip_from_host}" expression="^0\.0\.0\.0$">
<action application="log" data="ALERT Blocked spoofed from-host from ${network_addr}"/>
<action application="respond" data="403 Forbidden - Invalid From"/>
<action application="hangup" data="CALL_REJECTED"/>
</condition>
</extension>
<extension name="block_default_user">
<condition field="${sip_from_user}" expression="^default$">
<action application="log" data="ALERT Blocked 'default' username from ${network_addr}"/>
<action application="respond" data="403 Forbidden - Invalid User"/>
<action application="hangup" data="CALL_REJECTED"/>
</condition>
</extension>
<extension name="block_international_prefix">
<condition field="${destination_number}" expression="^00">
<action application="log" data="ALERT Blocked international prefix attempt: ${destination_number} from ${network_addr}"/>
<action application="respond" data="403 Forbidden"/>
<action application="hangup" data="CALL_REJECTED"/>
</condition>
</extension>
<!-- Block numeric-only caller IDs (scanners) -->
<extension name="block_numeric_callerid">
<condition field="${caller_id_name}" expression="^\d{4,6}$">
<action application="log" data="ALERT Blocked numeric scanner caller ID: ${caller_id_name} from ${network_addr}"/>
<action application="respond" data="403 Forbidden"/>
<action application="hangup" data="CALL_REJECTED"/>
</condition>
</extension>
<extension name="block_invalid_destination_length">
<!-- Block destinations longer than 11 digits (US E.164 max) -->
<condition field="${destination_number}" expression="^\+?\d{12,}$">
<action application="log" data="ALERT Blocked oversized destination: ${destination_number} from ${network_addr}"/>
<action application="respond" data="403 Forbidden"/>
<action application="hangup" data="CALL_REJECTED"/>
</condition>
</extension>
<extension name="block_long_callerid">
<!-- Block caller IDs longer than 15 digits (E.164 max) -->
<condition field="${caller_id_number}" expression="^\+?\d{16,}$">
<action application="log" data="ALERT Blocked oversized caller ID: ${caller_id_number} from ${network_addr}"/>
<action application="respond" data="403 Forbidden"/>
<action application="hangup" data="CALL_REJECTED"/>
</condition>
</extension>
...
But still, some calls squeak through and appear logged in my postgres database like this one
JSON:
{"id":1628,"uuid":"cef5ed7d-8b8f-48bb-abb7-7d6e3b606d22","caller_id_name":"Ss0599654484##","caller_id_number":"07","destination_number":"14502390262","context":"default","start_stamp":"2025-10-31T11:41:46.947169","answer_stamp":null,"end_stamp":"2025-10-31T11:41:55.687582","duration":9,"billsec":0,"hangup_cause":"ORIGINATOR_CANCEL","queue_name":"","created_at":"2025-10-31T11:41:57.35141","direction":"inbound","connected_agent_id":"","recording_s3_path":"...14502390262-cef5ed7d-8b8f-48bb-abb7-7d6e3b606d22.wav"}
Never hit queue but... yeah I'm assuming there's a better way rather than chasing regex formats... any input would be appreciated.
For what it's worth, I'm I'd be willing to buy beers in exchange for 1-1 FreeSwitch advice with my setup so, if anyone wants to connect with a random nerd from Florida, DM me
