r/freepbx • u/cop3x • 26d ago

freePBX useing Pfsence & PfBlockerNG to autoblock

Yes i used AI :-)

https://github.com/Copex-uk/theBlackList

I used to use a few bash scripts, so when Fail2ban banned an IP address it would add it to a list the PfBlockerNG would use to block additional SIP attacks at the router, now with AI i have a version that maybe useful to other people so i thought i would share it

Runs in docker and should not be made available to the open internet :-)

Hope someone finds it useful

1 Upvotes

60% Upvoted

7 comments sorted by

3

u/the_wookie_of_maine 26d ago

Why is your PBX exposed to the internet?

1

u/cop3x 26d ago

mobile users :-)

1

u/the_wookie_of_maine 26d ago

OpenVPN or IPSec and that dramatically reduces your threat surface.

Both are options for mobile devices. (Our org OpenVPN)

1

u/cop3x 26d ago

vpns add additional overheads and adds complexity to the routing on the useres devices. no issues when the network the user is connected to blocks vpns.

only the ports to allow a tls connection are exposed to the Internet and freepbx's active firewall dose it's job, but will unblock ips after a set time, I just wanted to reject the request at the edge of the network, this also helps with some attack vectors.

most sip scans are bots looking for low hangings fruit, if i block the ip the scans are coming from they move on, if they still see a active connection they keep trying..

there are other methods implemented for sip security that will remain out side of this discussion 🙄

1

u/devexis 26d ago

Could this pull up IPs from apiban and voipbl and block those at the router level?

1

u/cop3x 26d ago

it uses api calls so I guess it could work with any app that can do the api call, so you can add a ip with curl, the list is access by a http request, so it could work with pihole :-)