NAT/Registration Fail2Ban issue

[CPav]

Hi all,

I've been testing FusionPBX for a couple months and hoping to move into production soon for public use, I have 5 test users who use deskphones and Zoiper/Linphone. This means I have to be somewhat liberal with security, I have to allow access from any public IP.
My server resides behind a NAT firewall which performs 1-to-1 NAT to it's public IP and my sip profiles are configured with their ext-sip IP's. Everything works relatively well except that I have to get most desk phones(at customer premises) to register every 90 seconds, if I have them set for longer periods then either the users firewall or my firewall/pfsense closes the previously opened state-full ports. If I set phone registrations higher then at times when calling one of my subscribers you get their voicemail.
I want to still have fail2ban working to stop possible attacks but obviously with registrations happening so often, especially when a user has two devices registering from the same IP(multi-reg), then their IP gets banned.
I want to either lower the log level of freeswitch or change fail2ban behaviour for registrations but still keep it's effectiveness...while still allowing users to roam and hence access from ever changing public IP's.

My config files:

Fail2ban
failregex = \[WARNING\] sofia_reg.c:\d+ SIP auth challenge \(REGISTER\) on sofia profile \'[^']+\' for \[.*\] from ip <HOST>
\[WARNING\] sofia_reg.c:\d+ SIP auth failure \(INVITE\) on sofia profile \'[^']+\' for \[.*\] from ip <HOST>

maxretry = 20
bantime = 10000000
findtime = 600

Freeswitch logging:

<param name="loglevel" value="debug"/>

What would be the best way to tweak my settings to obtain the desired goal, should I lower the log level so that I'm not seeing the constant registrations?
Or (not likely I'd imagine) remove the "failregex = \[WARNING\] sofia_reg.c:\d+ SIP auth challenge \(REGISTER\) on sofia profile \'[^']+\' for \[.*\] from ip <HOST>"?

Or do I need to find a different method to deploy my server? I.E have the FusionPBX hanging straight on the public network?
Change my NAT options on my SIP profile?
I have on my sip profile:

ext-sip-ip autonat:9.9.9.9(obviously my actual public IP)
Nat-options-ping True
Aggressive-nat-detection true

Looking for any advice here please.

 

[MTR]

I know that there is a way to set up fail2ban that once and ip address has a login that is successful it shuold kind of whitelist that ip address. I am not sure how to configure it.

 

[DigitalDaz]

If you are doing things the recommended way then you will be registering to a domain name rather than an IP, 99.999% of bad gius will be going for the IP. If this is the case then there is already a fail2ban rule for blocking anything that goes to IP it in the jail file and currently disabled, just enable it.

Also, switch out to TCP as the transport, the tunnels will stay open longer.

Also, for pfsense specifically, go to System > Advanced, Firewall/NAT and change the firewall optimization settings to conservative, this will keep the UDP tunnels open longer too.

If the endpoints have the ability to do it, get them to send keepalives, better if NOTIFY or OPTTIONS so that there is two way traffic, then you can increase you registration timers.

 

[MTR]

@DigitalDaz am i correct about that? That we can configure fail2ban to auto whitelist ipaddress?

 

[DigitalDaz]

@DigitalDaz am i correct about that? That we can configure fail2ban to auto whitelist ipaddress?

I'm not aware of this.

 

[CPav]

Thanks DD, I have since set the UDP timeouts on pfsense from their standard 60 and 90s, to 300 and 400s. I will check if the phones in question will allow me to set notify/options settings. And yes I'm using Domain auth.
Regarding configuring for TCP, I'd assume this may cause some extra bandwidth overhead and server CPU resource? Besides gaining better connections through NAT with TCP, does it give me any other benefits?

The phones I'm primarily using are Cisco 7940/7960's running SIP firmware 8-12 if memory serves... I've just had a look through the conf files on my tftp server, I don't believe there's much in the way of notify/options settings. There are however some SIP timers:
timer_t1: 500
timer_t2: 4000
sip_retx: 10
sip_invite_retx: 6
timer_invite_expires: 180 (I've set this manually on some of the phones to 90s due to NAT issues)

 

[CPav]

If you are doing things the recommended way then you will be registering to a domain name rather than an IP, 99.999% of bad gius will be going for the IP. If this is the case then there is already a fail2ban rule for blocking anything that goes to IP it in the jail file and currently disabled, just enable it.

Also, switch out to TCP as the transport, the tunnels will stay open longer.

Also, for pfsense specifically, go to System > Advanced, Firewall/NAT and change the firewall optimization settings to conservative, this will keep the UDP tunnels open longer too.

If the endpoints have the ability to do it, get them to send keepalives, better if NOTIFY or OPTTIONS so that there is two way traffic, then you can increase you registration timers.

Just wanted to say that it looks like the pfsense recommendation by DD hss done the trick, I never set the firewall optimization but as he suggested I upped the udp timeouts on the same page he was reffering to, been working well since!