Rogue phone caused issues - fixed with rate limiting

[Voipy]

We had an issue with a Fanvil phone sending thousands of subscribe messages, causing a sip flood of sorts. It was a legitimate customer's phone.

As a result, and something that will help in general, I ended up rate limiting in nftables to port 5060. Currently set to 40 packets per second, allowing a burst of 200. This resolved the overload and should be a good additional safeguard in general I reckon. In the absence of something like kamailio in front, it makes sense to have some sanity limit.

For those who think it may help, in /etc/nftables.conf

chain input {
type filter hook input priority filter; policy accept;

iif lo accept
udp dport 5060 ip saddr @sip_abusers drop

udp dport 5060 meter sip_flood_tracker { ip saddr limit rate over 40/second burst 200 packets } update @sip_abusers { ip saddr } drop

ct state established,related accept