<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://wiki.kolmisoft.com/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Gilbertas</id>
	<title>Kolmisoft Wiki - User contributions [en]</title>
	<link rel="self" type="application/atom+xml" href="https://wiki.kolmisoft.com/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Gilbertas"/>
	<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php/Special:Contributions/Gilbertas"/>
	<updated>2026-04-05T05:33:27Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.37.1</generator>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_API_device_rule_create&amp;diff=31453</id>
		<title>MOR API device rule create</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_API_device_rule_create&amp;diff=31453"/>
		<updated>2026-03-12T08:59:06Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
&lt;br /&gt;
[[MOR API]] Create Device rule. &lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
* Call: /api/device_rule_create&lt;br /&gt;
* Methods: POST, GET(if allowed, not recomended)&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
===Parameters===&lt;br /&gt;
&lt;br /&gt;
Parameters which are '''included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* '''device_id''' - Device ID on which this rule will be created. '''Required''',&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
'''Note that parameters are shown in the same order as they have to be when generating the hash. Last parameter in a row is API_Secret_Key'''&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Parameters which are '''not included''' into hash:&lt;br /&gt;
* '''[[MOR API hash construction | hash]]''' - SHA1 hash constructed using '''parameters''' which are listed above. Note that parameters are shown in the same order as they have to be when generating the hash. Last parameter in a row is '''API_Secret_Key''' ([[MOR API hash construction | More described in Constructing hash]]). '''Required'''.&amp;lt;br&amp;gt;&lt;br /&gt;
* '''u''' - username for authentication. '''Required'''.&lt;br /&gt;
* '''name''' - name of Rule. '''Required'''.&lt;br /&gt;
* '''cut''' - cut pattern. '''Required*''' (either cut or add can be missing, but not both)&lt;br /&gt;
* '''add''' - add pattern '''Required*''' (either cut or add can be missing, but not both)&lt;br /&gt;
* '''minlen''' - Min Len value. The default value 1 will be used if the parameter is not specified.&lt;br /&gt;
* '''maxlen''' - Max Len value. The default value 100 will be used if the parameter is not specified.&lt;br /&gt;
* '''pr_type''' - Defines if this is src or dst rule. Allowed values src or dst. Default dst is used if this parameter is not specified.&lt;br /&gt;
* '''change_callerid_name''' - Enable/disable Change CallerID name option. Allowed values 0 or 1. Default 0 is used if this parameter is not specified.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Request===&lt;br /&gt;
&lt;br /&gt;
 HTML POST: http://&amp;lt;SERVER_IP&amp;gt;/billing/api/device_rule_create?u=admin&amp;amp;device_id=2&amp;amp;name=myrule&amp;amp;cut=353&amp;amp;add=0&amp;amp;hash=297dab8c386794b2e947d52affb8f576c643569e&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Returns===&lt;br /&gt;
&lt;br /&gt;
'''Success'''&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;page&amp;gt;&lt;br /&gt;
   &amp;lt;status&amp;gt;&lt;br /&gt;
     &amp;lt;success&amp;gt;Rule added&amp;lt;/success&amp;gt;&lt;br /&gt;
   &amp;lt;/status&amp;gt;&lt;br /&gt;
 &amp;lt;/page&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
----&lt;br /&gt;
'''Errors'''&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;error&amp;gt;Incorrect hash&amp;lt;/error&amp;gt; - Hash was not correct. Check API_Secret_Key and order or params while concatenating hash_string.&lt;br /&gt;
* &amp;lt;error&amp;gt;Add failed&amp;lt;/error&amp;gt; - rule was not created.&lt;br /&gt;
* &amp;lt;error&amp;gt;Device was not found&amp;lt;/error&amp;gt; - Device id incorrect or User does not have permission to manage it.&lt;br /&gt;
* &amp;lt;error&amp;gt;name cannot be blank&amp;lt;/error&amp;gt; - incorrect or missing name parameter.&lt;br /&gt;
* &amp;lt;error&amp;gt;both add and cut cannot be blank&amp;lt;/error&amp;gt; - Cut and add pattern is missing. Only one of the can be blank.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[MOR API]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_API_device_rule_create&amp;diff=31452</id>
		<title>MOR API device rule create</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_API_device_rule_create&amp;diff=31452"/>
		<updated>2026-03-12T08:48:23Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
&lt;br /&gt;
[[MOR API]] Create Device rule. &lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
* Call: /api/device_rule_create&lt;br /&gt;
* Methods: POST, GET(if allowed, not recomended)&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
===Parameters===&lt;br /&gt;
&lt;br /&gt;
Parameters which are '''included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* '''device_id''' - Device ID on which this rule will be created. '''Required''',&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
'''Note that parameters are shown in the same order as they have to be when generating the hash. Last parameter in a row is API_Secret_Key'''&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Parameters which are '''not included''' into hash:&lt;br /&gt;
* '''[[MOR API hash construction | hash]]''' - SHA1 hash constructed using '''parameters''' which are listed above. Note that parameters are shown in the same order as they have to be when generating the hash. Last parameter in a row is '''API_Secret_Key''' ([[MOR API hash construction | More described in Constructing hash]]). '''Required'''.&amp;lt;br&amp;gt;&lt;br /&gt;
* '''u''' - username for authentication. '''Required'''.&lt;br /&gt;
* '''name''' - name of Rule. '''Required'''.&lt;br /&gt;
* '''cut''' - cut pattern. '''Required*''' (either cut or add can be missing, but not both)&lt;br /&gt;
* '''add''' - add pattern '''Required*''' (either cut or add can be missing, but not both)&lt;br /&gt;
* '''minlen''' - Min Len value. The default value 1 will be used if the parameter is not specified.&lt;br /&gt;
* '''maxlen''' - Max Len value. The default value 100 will be used if the parameter is not specified.&lt;br /&gt;
* '''pr_type''' - Defines if this is src or dst rule. Allowed values src or dst. Default dst is used if this parameter is not specified.&lt;br /&gt;
* '''change_callerid_name''' - Enable/disable Change CallerID name option. Allowed values 0 or 1. Default 0 is used if this parameter is not specified.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Request===&lt;br /&gt;
&lt;br /&gt;
 HTML POST: http://&amp;lt;SERVER_IP&amp;gt;/billing/api/device_rule_create?u=admin&amp;amp;device=2&amp;amp;name=myrule&amp;amp;cut=353&amp;amp;add=0&amp;amp;hash=297dab8c386794b2e947d52affb8f576c643569e&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Returns===&lt;br /&gt;
&lt;br /&gt;
'''Success'''&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;page&amp;gt;&lt;br /&gt;
   &amp;lt;status&amp;gt;&lt;br /&gt;
     &amp;lt;success&amp;gt;Rule added&amp;lt;/success&amp;gt;&lt;br /&gt;
   &amp;lt;/status&amp;gt;&lt;br /&gt;
 &amp;lt;/page&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
----&lt;br /&gt;
'''Errors'''&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;error&amp;gt;Incorrect hash&amp;lt;/error&amp;gt; - Hash was not correct. Check API_Secret_Key and order or params while concatenating hash_string.&lt;br /&gt;
* &amp;lt;error&amp;gt;Add failed&amp;lt;/error&amp;gt; - rule was not created.&lt;br /&gt;
* &amp;lt;error&amp;gt;Device was not found&amp;lt;/error&amp;gt; - Device id incorrect or User does not have permission to manage it.&lt;br /&gt;
* &amp;lt;error&amp;gt;name cannot be blank&amp;lt;/error&amp;gt; - incorrect or missing name parameter.&lt;br /&gt;
* &amp;lt;error&amp;gt;both add and cut cannot be blank&amp;lt;/error&amp;gt; - Cut and add pattern is missing. Only one of the can be blank.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[MOR API]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31433</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31433"/>
		<updated>2026-03-09T11:46:07Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Send email notifications when IP is blocked=&lt;br /&gt;
&lt;br /&gt;
Fail2ban can be configured to send an email when an IP is blocked. Fail2ban will use the default MTA on the system, so mta (by default, postfix) has to be configured correctly for email to reach the destination.&lt;br /&gt;
&lt;br /&gt;
This guide will show how to configure fail2ban to send the email through the mta. The configuration of the mta (sendmail, postfix) itself is not discussed here.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Add initial configuration options to send emails ==&lt;br /&gt;
&lt;br /&gt;
Firstly, let's update the fail2ban config to the latest version from the MOR:&lt;br /&gt;
&lt;br /&gt;
 mor_version=$(grep -P &amp;quot;^MOR_VERSION\s*=\s*&amp;quot; /etc/mor/system.conf | awk -F'=' '{print $2}' | xargs)&lt;br /&gt;
 svn update /usr/src/mor/${mor_version}/helpers/fail2ban&lt;br /&gt;
 /usr/src/mor/${mor_version}/helpers/fail2ban/fail2ban_update.sh&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Create a local default config jail file (if it is not already present) /etc/fail2ban/jail.d/customdefault.local and add email configuration variables:&lt;br /&gt;
&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 destemail = recipient1@email.com&lt;br /&gt;
 sender = from@fromdomain.com&lt;br /&gt;
 sendername = Fail2Ban&lt;br /&gt;
 mta = sendmail&lt;br /&gt;
&lt;br /&gt;
If you need to send to several destinations, use the comma&lt;br /&gt;
 destemail = recipient1@email.com, recipient2@email.com, recipient3@email.com&lt;br /&gt;
&lt;br /&gt;
Replace destemail with the correct destination email(s) and sender with the correct From email address.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from any jail ==&lt;br /&gt;
&lt;br /&gt;
In the file /etc/fail2ban/jail.d/customdefault.local (created in the previous step), append the line:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
[[Fail2Ban_on_X18#Manually_block_the_IP_to_the_jail | Manual blocking]] can be used to test if an email arrives after the IP is blocked.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from a specific jail ==&lt;br /&gt;
&lt;br /&gt;
Do not add (remove if already added) action line in the file /etc/fail2ban/jail.d/customdefault.local&lt;br /&gt;
&lt;br /&gt;
Create a local jail file (if it is not already present) and add an action line to it. For example, to send email notifications only for IPs blocked in ssh jail:&lt;br /&gt;
&lt;br /&gt;
1. Create (if it does not already exist) the file ssh-iptables:&lt;br /&gt;
 touch /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add the following contents:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
You can repeat this for any jails you want to send email notifications to.&lt;br /&gt;
&lt;br /&gt;
All available jails can be listed with this command:&lt;br /&gt;
 fail2ban-client status &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Available email notifcations==&lt;br /&gt;
In the example we used:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Here we used action_m action. Available actions are:&lt;br /&gt;
* '''action_m''' - send email &lt;br /&gt;
* '''action_mw''' - send email + whois information about the IP&lt;br /&gt;
* '''action_mwl''' - send email + whois information about the IP + log lines where IP was blocked&lt;br /&gt;
&lt;br /&gt;
So if you need additional information, you can replace action_m with action_mw or action_mwl.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Blocked IPs]]&lt;br /&gt;
* [[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31432</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31432"/>
		<updated>2026-03-09T11:45:16Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Send email notifications when IP is blocked=&lt;br /&gt;
&lt;br /&gt;
Fail2ban can be configured to send an email when an IP is blocked. Fail2ban will use the default MTA on the system, so mta (by default, postfix) has to be configured correctly for email to reach the destination.&lt;br /&gt;
&lt;br /&gt;
This guide will show how to configure fail2ban to send the email through the mta. The configuration of the mta (sendmail, postfix) itself is not discussed here.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Add initial configuration options to send emails ==&lt;br /&gt;
&lt;br /&gt;
Firstly, let's update the fail2ban config to the latest version from the MOR:&lt;br /&gt;
&lt;br /&gt;
 mor_version=$(grep -P &amp;quot;^MOR_VERSION\s*=\s*&amp;quot; /etc/mor/system.conf | awk -F'=' '{print $2}' | xargs)&lt;br /&gt;
 svn update /usr/src/mor/${mor_version}/helpers/fail2ban&lt;br /&gt;
 /usr/src/mor/${mor_version}/helpers/fail2ban/fail2ban_update.sh&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Create a local default config jail file (if it is not already present) /etc/fail2ban/jail.d/customdefault.local and add email configuration variables:&lt;br /&gt;
&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 destemail = recipient1@email.com&lt;br /&gt;
 sender = from@fromdomain.com&lt;br /&gt;
 sendername = Fail2Ban&lt;br /&gt;
 mta = sendmail&lt;br /&gt;
&lt;br /&gt;
If you need to send to several destinations, use the comma&lt;br /&gt;
 destemail = recipient1@email.com, recipient2@email.com, recipient3@email.com&lt;br /&gt;
&lt;br /&gt;
Replace destemail with the correct destination email(s) and sender with the correct From email address.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from any jail ==&lt;br /&gt;
&lt;br /&gt;
In the file /etc/fail2ban/jail.d/customdefault.local (created in the previous step), append the line:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
[[Fail2Ban_on_X18#Manually_block_the_IP_to_the_jail | Manual blocking]] can be used to test if an email arrives after the IP is blocked.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from a specific jail ==&lt;br /&gt;
&lt;br /&gt;
Do not add (remove if already added) action line in the file /etc/fail2ban/jail.d/customdefault.local&lt;br /&gt;
&lt;br /&gt;
Create a local jail file (if it is not already present) and add an action line to it. For example, to send email notifications only for IPs blocked in ssh jail:&lt;br /&gt;
&lt;br /&gt;
1. Create (if it does not already exist) the file ssh-iptables:&lt;br /&gt;
 /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add the following contents:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
You can repeat this for any jails you want to send email notifications to.&lt;br /&gt;
&lt;br /&gt;
All available jails can be listed with this command:&lt;br /&gt;
 fail2ban-client status &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Available email notifcations==&lt;br /&gt;
In the example we used:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Here we used action_m action. Available actions are:&lt;br /&gt;
* '''action_m''' - send email &lt;br /&gt;
* '''action_mw''' - send email + whois information about the IP&lt;br /&gt;
* '''action_mwl''' - send email + whois information about the IP + log lines where IP was blocked&lt;br /&gt;
&lt;br /&gt;
So if you need additional information, you can replace action_m with action_mw or action_mwl.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Blocked IPs]]&lt;br /&gt;
* [[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31431</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31431"/>
		<updated>2026-03-09T11:37:08Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Send email notifications when IP is blocked=&lt;br /&gt;
&lt;br /&gt;
Fail2ban can be configured to send an email when an IP is blocked. Fail2ban will use the default MTA on the system, so mta (by default, postfix) has to be configured correctly for email to reach the destination.&lt;br /&gt;
&lt;br /&gt;
This guide will show how to configure fail2ban to send the email through the mta. The configuration of the mta (sendmail, postfix) itself is not discussed here.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Add initial configuration options to send emails ==&lt;br /&gt;
&lt;br /&gt;
Firstly, let's update the fail2ban config to the latest version from the MOR:&lt;br /&gt;
&lt;br /&gt;
 mor_version=$(grep -P &amp;quot;^MOR_VERSION\s*=\s*&amp;quot; /etc/mor/system.conf | awk -F'=' '{print $2}' | xargs)&lt;br /&gt;
 svn update /usr/src/mor/${mor_version}/helpers/fail2ban&lt;br /&gt;
 /usr/src/mor/${mor_version}/helpers/fail2ban/fail2ban_update.sh&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Create a local default config jail file (if it is not already present) /etc/fail2ban/jail.d/customdefault.local and add email configuration variables:&lt;br /&gt;
&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 destemail = recipient1@email.com&lt;br /&gt;
 sender = from@fromdomain.com&lt;br /&gt;
 sendername = Fail2Ban&lt;br /&gt;
 mta = sendmail&lt;br /&gt;
&lt;br /&gt;
If you need to send to several destinations, use the comma&lt;br /&gt;
 destemail = recipient1@email.com, recipient2@email.com, recipient3@email.com&lt;br /&gt;
&lt;br /&gt;
Replace destemail with the correct destination email(s) and sender with the correct From email address.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from any jail ==&lt;br /&gt;
&lt;br /&gt;
In the file /etc/fail2ban/jail.d/customdefault.local (created in the previous step), append the line:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from a specific jail ==&lt;br /&gt;
&lt;br /&gt;
Do not add (remove if already added) action line in the file /etc/fail2ban/jail.d/customdefault.local&lt;br /&gt;
&lt;br /&gt;
Create a local jail file (if it is not already present) and add an action line to it. For example, to send email notifications only for IPs blocked in ssh jail:&lt;br /&gt;
&lt;br /&gt;
1. Create (if it does not already exist) the file ssh-iptables:&lt;br /&gt;
 /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add the following contents:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
You can repeat this for any jails you want to send email notifications to.&lt;br /&gt;
&lt;br /&gt;
All available jails can be listed with this command:&lt;br /&gt;
 fail2ban-client status &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Available email notifcations==&lt;br /&gt;
In the example we used:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Here we used action_m action. Available actions are:&lt;br /&gt;
* '''action_m''' - send email &lt;br /&gt;
* '''action_mw''' - send email + whois information about the IP&lt;br /&gt;
* '''action_mwl''' - send email + whois information about the IP + log lines where IP was blocked&lt;br /&gt;
&lt;br /&gt;
So if you need additional information, you can replace action_m with action_mw or action_mwl.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Blocked IPs]]&lt;br /&gt;
* [[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31430</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31430"/>
		<updated>2026-03-09T11:36:30Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Send email notifications when IP is blocked=&lt;br /&gt;
&lt;br /&gt;
Fail2ban can be configured to send an email when an IP is blocked. Fail2ban will use the default MTA on the system, so mta (by default, postfix) has to be configured correctly for email to reach the destination.&lt;br /&gt;
&lt;br /&gt;
This guide will show how to configure fail2ban to send the email through the mta. The configuration of the mta (sendmail, postfix) itself is not discussed here.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Add initial configuration options to send emails ==&lt;br /&gt;
&lt;br /&gt;
Firstly, let's update the fail2ban config to the latest version from the MOR:&lt;br /&gt;
&lt;br /&gt;
 mor_version=$(grep -P &amp;quot;^MOR_VERSION\s*=\s*&amp;quot; /etc/mor/system.conf | awk -F'=' '{print $2}' | xargs)&lt;br /&gt;
 svn update /usr/src/mor/${mor_version}/helpers/fail2ban&lt;br /&gt;
 /usr/src/mor/${mor_version}/helpers/fail2ban/fail2ban_update.sh&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Create a local default config jail file (if it is not already present) /etc/fail2ban.d/jail.d/customdefault.local and add email configuration variables:&lt;br /&gt;
&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 destemail = recipient1@email.com&lt;br /&gt;
 sender = from@fromdomain.com&lt;br /&gt;
 sendername = Fail2Ban&lt;br /&gt;
 mta = sendmail&lt;br /&gt;
&lt;br /&gt;
If you need to send to several destinations, use the comma&lt;br /&gt;
 destemail = recipient1@email.com, recipient2@email.com, recipient3@email.com&lt;br /&gt;
&lt;br /&gt;
Replace destemail with the correct destination email(s) and sender with the correct From email address.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from any jail ==&lt;br /&gt;
&lt;br /&gt;
In the file /etc/fail2ban/jail.d/customdefault.local (created in the previous step), append the line:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from a specific jail ==&lt;br /&gt;
&lt;br /&gt;
Do not add (remove if already added) action line in the file /etc/fail2ban.d/jail.d/customdefault.local&lt;br /&gt;
&lt;br /&gt;
Create a local jail file (if it is not already present) and add an action line to it. For example, to send email notifications only for IPs blocked in ssh jail:&lt;br /&gt;
&lt;br /&gt;
1. Create (if it does not already exist) the file ssh-iptables:&lt;br /&gt;
 /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add the following contents:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
You can repeat this for any jails you want to send email notifications to.&lt;br /&gt;
&lt;br /&gt;
All available jails can be listed with this command:&lt;br /&gt;
 fail2ban-client status &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Available email notifcations==&lt;br /&gt;
In the example we used:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Here we used action_m action. Available actions are:&lt;br /&gt;
* '''action_m''' - send email &lt;br /&gt;
* '''action_mw''' - send email + whois information about the IP&lt;br /&gt;
* '''action_mwl''' - send email + whois information about the IP + log lines where IP was blocked&lt;br /&gt;
&lt;br /&gt;
So if you need additional information, you can replace action_m with action_mw or action_mwl.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Blocked IPs]]&lt;br /&gt;
* [[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31429</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31429"/>
		<updated>2026-03-09T11:32:09Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Send email notifications when IP is blocked=&lt;br /&gt;
&lt;br /&gt;
Fail2ban can be configured to send an email when an IP is blocked. Fail2ban will use the default MTA on the system, so mta (by default, postfix) has to be configured correctly for email to reach the destination.&lt;br /&gt;
&lt;br /&gt;
This guide will show how to configure fail2ban to send the email through the mta. The configuration of the mta (sendmail, postfix) itself is not discussed here.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Add initial configuration options to send emails ==&lt;br /&gt;
&lt;br /&gt;
Firstly, let's update the fail2ban config to the latest version from the MOR:&lt;br /&gt;
&lt;br /&gt;
 mor_version=$(grep -P &amp;quot;^MOR_VERSION\s*=\s*&amp;quot; /etc/mor/system.conf | awk -F'=' '{print $2}' | xargs)&lt;br /&gt;
 svn update /usr/src/mor/${mor_version}/helpers/fail2ban&lt;br /&gt;
 /usr/src/mor/${mor_version}/helpers/fail2ban/fail2ban_update.sh&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Create a local default config jail file (if it is not already present) /etc/fail2ban.d/jail.d/customdefault.local and add email configuration variables:&lt;br /&gt;
&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 destemail = recipient1@email.com&lt;br /&gt;
 sender = from@fromdomain.com&lt;br /&gt;
 sendername = Fail2Ban&lt;br /&gt;
 mta = sendmail&lt;br /&gt;
&lt;br /&gt;
If you need to send to several destinations, use the comma&lt;br /&gt;
 destemail = recipient1@email.com, recipient2@email.com, recipient3@email.com&lt;br /&gt;
&lt;br /&gt;
Replace destemail with the correct destination email(s) and sender with the correct From email address.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from any jail ==&lt;br /&gt;
&lt;br /&gt;
In the file /etc/fail2ban.d/jail.d/customdefault.local (created in the previous step), append the line:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from a specific jail ==&lt;br /&gt;
&lt;br /&gt;
Do not add (remove if already added) action line in the file /etc/fail2ban.d/jail.d/customdefault.local&lt;br /&gt;
&lt;br /&gt;
Create a local jail file (if it is not already present) and add an action line to it. For example, to send email notifications only for IPs blocked in ssh jail:&lt;br /&gt;
&lt;br /&gt;
1. Create (if it does not already exist) the file ssh-iptables:&lt;br /&gt;
 /etc/fail2ban.d/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add the following contents:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
You can repeat this for any jails you want to send email notifications to.&lt;br /&gt;
&lt;br /&gt;
All available jails can be listed with this command:&lt;br /&gt;
 fail2ban-client status &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Available email notifcations==&lt;br /&gt;
In the example we used:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Here we used action_m action. Available actions are:&lt;br /&gt;
* '''action_m''' - send email &lt;br /&gt;
* '''action_mw''' - send email + whois information about the IP&lt;br /&gt;
* '''action_mwl''' - send email + whois information about the IP + log lines where IP was blocked&lt;br /&gt;
&lt;br /&gt;
So if you need additional information, you can replace action_m with action_mw or action_mwl.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Blocked IPs]]&lt;br /&gt;
* [[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31428</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31428"/>
		<updated>2026-03-09T11:26:53Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Send email notifications when IP is blocked=&lt;br /&gt;
&lt;br /&gt;
Fail2ban can be configured to send an email when an IP is blocked. Fail2ban will use the default MTA on the system, so mta (by default, postfix) has to be configured correctly for email to reach the destination.&lt;br /&gt;
&lt;br /&gt;
This guide will show how to configure fail2ban to send the email through the mta. The configuration of the mta (sendmail, postfix) itself is not discussed here.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Add initial configuration options to send emails ==&lt;br /&gt;
&lt;br /&gt;
Create a local default config jail file (if it is not already present) /etc/fail2ban.d/jail.d/customdefault.local and add email configuration variables:&lt;br /&gt;
&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 destemail = recipient1@email.com&lt;br /&gt;
 sender = from@fromdomain.com&lt;br /&gt;
 sendername = Fail2Ban&lt;br /&gt;
 mta = sendmail&lt;br /&gt;
&lt;br /&gt;
If you need to send to several destinations, use the comma&lt;br /&gt;
 destemail = recipient1@email.com, recipient2@email.com, recipient3@email.com&lt;br /&gt;
&lt;br /&gt;
Replace destemail with the correct destination email(s) and sender with the correct From email address.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from any jail ==&lt;br /&gt;
&lt;br /&gt;
In the file /etc/fail2ban.d/jail.d/customdefault.local (created in the previous step), append the line:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from a specific jail ==&lt;br /&gt;
&lt;br /&gt;
Do not add (remove if already added) action line in the file /etc/fail2ban.d/jail.d/customdefault.local&lt;br /&gt;
&lt;br /&gt;
Create a local jail file (if it is not already present) and add an action line to it. For example, to send email notifications only for IPs blocked in ssh jail:&lt;br /&gt;
&lt;br /&gt;
1. Create (if it does not already exist) the file ssh-iptables:&lt;br /&gt;
 /etc/fail2ban.d/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add the following contents:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
You can repeat this for any jails you want to send email notifications to.&lt;br /&gt;
&lt;br /&gt;
All available jails can be listed with this command:&lt;br /&gt;
 fail2ban-client status &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Available email notifcations==&lt;br /&gt;
In the example we used:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Here we used action_m action. Available actions are:&lt;br /&gt;
* '''action_m''' - send email &lt;br /&gt;
* '''action_mw''' - send email + whois information about the IP&lt;br /&gt;
* '''action_mwl''' - send email + whois information about the IP + log lines where IP was blocked&lt;br /&gt;
&lt;br /&gt;
So if you need additional information, you can replace action_m with action_mw or action_mwl.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Blocked IPs]]&lt;br /&gt;
* [[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31427</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31427"/>
		<updated>2026-03-09T10:23:20Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Send email notifications when IP is blocked=&lt;br /&gt;
&lt;br /&gt;
Fail2ban can be configured to send an email when an IP is blocked. Fail2ban will use the default MTA on the system, so mta (by default, postfix) has to be configured correctly for email to reach the destination.&lt;br /&gt;
&lt;br /&gt;
This guide will show how to configure fail2ban to send the email through the mta. The configuration of the mta (sendmail, postfix) itself is not discussed here.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Add initial configuration options to send emails ==&lt;br /&gt;
&lt;br /&gt;
Create/add email sending config to /etc/fail2ban.d/jail.d/customdefault.jail&lt;br /&gt;
&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 destemail = recipient1@email.com&lt;br /&gt;
 sender = from@fromdomain.com&lt;br /&gt;
 sendername = Fail2Ban&lt;br /&gt;
 mta = sendmail&lt;br /&gt;
&lt;br /&gt;
If you need to send to several destinations, use the comma&lt;br /&gt;
 destemail = recipient1@email.com, recipient2@email.com, recipient3@email.com&lt;br /&gt;
&lt;br /&gt;
Replace destimail with the correct destination email(s)  and sender with the correct From email address.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from any jail ==&lt;br /&gt;
&lt;br /&gt;
In the file /etc/fail2ban.d/jail.d/customdefault.local (created in the previous step), append the line:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Restart fail2ban&lt;br /&gt;
 systemcl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from a specific jail ==&lt;br /&gt;
&lt;br /&gt;
Do not add/remove action line /etc/fail2ban.d/jail.d/customdefault.local&lt;br /&gt;
&lt;br /&gt;
Create a local jail file (if it is not already present) and add an action line to it. For example, email notifications only for IPs blocked in ssh jail:&lt;br /&gt;
&lt;br /&gt;
1. Create (if it does not already exist) the file ssh-iptables:&lt;br /&gt;
 /etc/fail2ban.d/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add the following contents:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
You can repeat this for any jails you want to send email notifications to.&lt;br /&gt;
&lt;br /&gt;
All available jails can be listed with this command:&lt;br /&gt;
 fail2ban-client status &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Available email notifcations==&lt;br /&gt;
In the example we used:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Here we used action_m action. Available actions are:&lt;br /&gt;
* '''action_m''' - send email &lt;br /&gt;
* '''action_mw''' - send email + whois information about the IP&lt;br /&gt;
* '''action_mwl''' - send email + whois information about the IP + log lines where IP was blocked&lt;br /&gt;
&lt;br /&gt;
So if you need additional information, you can replace action_m with action_mw or action_mwl&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Blocked IPs]]&lt;br /&gt;
* [[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31426</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31426"/>
		<updated>2026-03-09T10:21:38Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Send email notifications when IP is blocked=&lt;br /&gt;
&lt;br /&gt;
Fail2ban can be configured to send an email when an IP is blocked. Fail2ban will use the default MTA on the system, so mta (by default, postfix) has to be configured correctly for email to reach the destination.&lt;br /&gt;
&lt;br /&gt;
This guide will show how to configure fail2ban to send the email through the mta. The configuration of the mta (sendmail, postfix) itself is not discussed here.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Add initial configuration options to send emails ==&lt;br /&gt;
&lt;br /&gt;
Create/add email sending config to /etc/fail2ban.d/jail.d/customdefault.jail&lt;br /&gt;
&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 destemail = recipient1@email.com&lt;br /&gt;
 sender = from@fromdomain.com&lt;br /&gt;
 sendername = Fail2Ban&lt;br /&gt;
 mta = sendmail&lt;br /&gt;
&lt;br /&gt;
If you need to send to several destinations, use the comma&lt;br /&gt;
 destemail = recipient1@email.com, recipient2@email.com, recipient3@email.com&lt;br /&gt;
&lt;br /&gt;
Replace destimail with the correct destination email(s)  and sender with the correct From email address.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email IP is blocked from any jail ==&lt;br /&gt;
&lt;br /&gt;
In the file /etc/fail2ban.d/jail.d/customdefault.local (created in the previous step), append the line:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from a specific jail ==&lt;br /&gt;
&lt;br /&gt;
Do not add/remove action line /etc/fail2ban.d/jail.d/customdefault.local&lt;br /&gt;
&lt;br /&gt;
Create a local jail file (if it is not already present) and add an action line to it. For example, email notifications only for IPs blocked in ssh jail:&lt;br /&gt;
&lt;br /&gt;
1. Create (if it does not already exist) the file ssh-iptables:&lt;br /&gt;
 /etc/fail2ban.d/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add the following contents:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
You can repeat this for any jails you want to send email notifications to.&lt;br /&gt;
&lt;br /&gt;
All available jails can be listed with this command:&lt;br /&gt;
 fail2ban-client status &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Available email notifcations==&lt;br /&gt;
In the example we used:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Here we used action_m action. Available actions are:&lt;br /&gt;
* action_m - send email &lt;br /&gt;
* action_mw - send email + whois information about the IP&lt;br /&gt;
* action_mwl - send email + whois information about the IP + log lines where IP was blocked&lt;br /&gt;
&lt;br /&gt;
So if you need additional information, you can replace action_m with action_mw or action_mwl&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Blocked IPs]]&lt;br /&gt;
* [[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31425</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=31425"/>
		<updated>2026-03-09T10:20:53Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Send email notifications when IP is blocked=&lt;br /&gt;
&lt;br /&gt;
Fail2ban can be configured to send an email when an IP is blocked. Fail2ban will use the default MTA on the system, so mta (by default, postfix) has to be configured correctly for email to reach the destination.&lt;br /&gt;
&lt;br /&gt;
This guide will show how to configure fail2ban to send the email through the mta. The configuration of the mta (sendmail, postfix) itself is not discussed here.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
 == Add initial configuration options to send emails ==&lt;br /&gt;
&lt;br /&gt;
Create/add email sending config to /etc/fail2ban.d/jail.d/customdefault.jail&lt;br /&gt;
&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 destemail = recipient1@email.com&lt;br /&gt;
 sender = from@fromdomain.com&lt;br /&gt;
 sendername = Fail2Ban&lt;br /&gt;
 mta = sendmail&lt;br /&gt;
&lt;br /&gt;
If you need to send to several destinations, use the comma&lt;br /&gt;
 destemail = recipient1@email.com, recipient2@email.com, recipient3@email.com&lt;br /&gt;
&lt;br /&gt;
Replace destimail with the correct destination email(s)  and sender with the correct From email address.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email IP is blocked from any jail ==&lt;br /&gt;
&lt;br /&gt;
In the file /etc/fail2ban.d/jail.d/customdefault.local (created in the previous step), append the line:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Send email when IP is blocked from a specific jail ==&lt;br /&gt;
&lt;br /&gt;
Do not add/remove action line /etc/fail2ban.d/jail.d/customdefault.local&lt;br /&gt;
&lt;br /&gt;
Create a local jail file (if it is not already present) and add an action line to it. For example, email notifications only for IPs blocked in ssh jail:&lt;br /&gt;
&lt;br /&gt;
1. Create (if it does not already exist) the file ssh-iptables:&lt;br /&gt;
 /etc/fail2ban.d/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add the following contents:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
You can repeat this for any jails you want to send email notifications to.&lt;br /&gt;
&lt;br /&gt;
All available jails can be listed with this command:&lt;br /&gt;
 fail2ban-client status &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Available email notifcations==&lt;br /&gt;
In the example we used:&lt;br /&gt;
 action = %(action_m)s[actionstart=&amp;quot;&amp;quot;, actionstop=&amp;quot;&amp;quot;]&lt;br /&gt;
&lt;br /&gt;
Here we used action_m action. Available actions are:&lt;br /&gt;
* action_m - send email &lt;br /&gt;
* action_mw - send email + whois information about the IP&lt;br /&gt;
* action_mwl - send email + whois information about the IP + log lines where IP was blocked&lt;br /&gt;
&lt;br /&gt;
So if you need additional information, you can replace action_m with action_mw or action_mwl&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Blocked IPs]]&lt;br /&gt;
* [[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=M4_API_user_create&amp;diff=31291</id>
		<title>M4 API user create</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=M4_API_user_create&amp;diff=31291"/>
		<updated>2026-03-03T16:48:58Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
&lt;br /&gt;
[[M4 API]] Create a new user from params. &lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
* Call: /api/user_create&lt;br /&gt;
* Methods: POST, GET(if allowed, not recomended)&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
===Parameters===&lt;br /&gt;
&lt;br /&gt;
Parameters which are '''included''' into hash:&lt;br /&gt;
* '''u''' - username for authentication. '''Required'''.&lt;br /&gt;
* '''username''' - New user username. '''Required'''.&lt;br /&gt;
* '''password''' - New user password. '''Required'''.&lt;br /&gt;
&lt;br /&gt;
Parameters which are '''not included''' into hash:&lt;br /&gt;
* user_status - possible values: '''testing''', '''disabled''', '''enabled''', '''pending''', '''suspended''', '''daily_limit_exceeded''', '''vendor''', '''prepaid'''.&lt;br /&gt;
* '''first_name''' - New user first name.&lt;br /&gt;
* '''last_name''' - New user last name. &lt;br /&gt;
* '''main_email''' - New user main email.&lt;br /&gt;
* '''call_limit''' - Call limit (how many simultaneous Calls the new User can make by default?)&lt;br /&gt;
* '''currency_id''' - Currency ID from database.&lt;br /&gt;
* '''country_id''' - New user country (please check table below).&lt;br /&gt;
* '''mob_phone''' - Mobile phone number.&lt;br /&gt;
* '''phone - Phone number. &lt;br /&gt;
* '''fax''' - Fax. &lt;br /&gt;
* '''client_id''' - Company/Personal ID.&lt;br /&gt;
* '''vat_number''' - TAX Registration Number.&lt;br /&gt;
* '''county'''&lt;br /&gt;
* '''state'''&lt;br /&gt;
* '''city'''&lt;br /&gt;
* '''postcode''' - Postcode/ZIP.&lt;br /&gt;
* '''address'''&lt;br /&gt;
* '''accounting_number''' - Accounting Number&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Request===&lt;br /&gt;
&lt;br /&gt;
 HTML POST: http://&amp;lt;SERVER_IP&amp;gt;/billing/api/user_create?u=admin&amp;amp;username=user_one&amp;amp;password=Str0ngP@ss&amp;amp;test=1&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
User will be created according to used params and default User settings.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
===Returns===&lt;br /&gt;
&lt;br /&gt;
'''Success'''&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;page&amp;gt;&lt;br /&gt;
    &amp;lt;status&amp;gt;&lt;br /&gt;
        &amp;lt;success&amp;gt;User was created successfully&amp;lt;/success&amp;gt;&lt;br /&gt;
    &amp;lt;user&amp;gt;&lt;br /&gt;
        &amp;lt;user_id&amp;gt;x&amp;lt;/user_id&amp;gt;&lt;br /&gt;
        &amp;lt;username&amp;gt;user_one&amp;lt;/username&amp;gt;&lt;br /&gt;
    &amp;lt;/user&amp;gt;&lt;br /&gt;
    &amp;lt;/status&amp;gt;&lt;br /&gt;
 &amp;lt;/page&amp;gt;&lt;br /&gt;
----&lt;br /&gt;
'''Errors'''&lt;br /&gt;
* Username has already been taken&lt;br /&gt;
* Password must be longer than x characters&lt;br /&gt;
* Username must be longer than x characters&lt;br /&gt;
* Password must contain at least one numeric value, capital and lowercase symbol &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== List of Country IDs ===&lt;br /&gt;
&lt;br /&gt;
1 - Afghanistan&lt;br /&gt;
&lt;br /&gt;
2 - Albania&lt;br /&gt;
&lt;br /&gt;
3 - Algeria&lt;br /&gt;
&lt;br /&gt;
4 - American Samoa&lt;br /&gt;
&lt;br /&gt;
5 - Andorra&lt;br /&gt;
&lt;br /&gt;
6 - Angola &lt;br /&gt;
&lt;br /&gt;
7 - Anguilla &lt;br /&gt;
&lt;br /&gt;
8 - Antarctica &lt;br /&gt;
&lt;br /&gt;
9 - Antigua And Barbuda&lt;br /&gt;
&lt;br /&gt;
10 - Argentina&lt;br /&gt;
&lt;br /&gt;
11 - Armenia&lt;br /&gt;
&lt;br /&gt;
12 - Aruba&lt;br /&gt;
&lt;br /&gt;
13 - Australia&lt;br /&gt;
&lt;br /&gt;
14 - Austria&lt;br /&gt;
&lt;br /&gt;
15 - Azerbaijan &lt;br /&gt;
&lt;br /&gt;
16 - Bahamas&lt;br /&gt;
&lt;br /&gt;
17 - Bahrain&lt;br /&gt;
&lt;br /&gt;
18 - Bangladesh &lt;br /&gt;
&lt;br /&gt;
19 - Barbados &lt;br /&gt;
&lt;br /&gt;
20 - Belarus&lt;br /&gt;
&lt;br /&gt;
21 - Belgium&lt;br /&gt;
&lt;br /&gt;
22 - Belize &lt;br /&gt;
&lt;br /&gt;
23 - Benin&lt;br /&gt;
&lt;br /&gt;
24 - Bermuda&lt;br /&gt;
&lt;br /&gt;
25 - Bhutan &lt;br /&gt;
&lt;br /&gt;
26 - Bolivia&lt;br /&gt;
&lt;br /&gt;
27 - Bosnia And Herzegovina &lt;br /&gt;
&lt;br /&gt;
28 - Botswana &lt;br /&gt;
&lt;br /&gt;
30 - Brazil &lt;br /&gt;
&lt;br /&gt;
32 - Brunei Darussalam&lt;br /&gt;
&lt;br /&gt;
33 - Bulgaria &lt;br /&gt;
&lt;br /&gt;
34 - Burkina Faso &lt;br /&gt;
&lt;br /&gt;
35 - Burundi&lt;br /&gt;
&lt;br /&gt;
36 - Cambodia &lt;br /&gt;
&lt;br /&gt;
37 - Cameroon &lt;br /&gt;
&lt;br /&gt;
38 - Canada &lt;br /&gt;
&lt;br /&gt;
39 - Cape Verde &lt;br /&gt;
&lt;br /&gt;
40 - Cayman Islands &lt;br /&gt;
&lt;br /&gt;
41 - Central African Republic &lt;br /&gt;
&lt;br /&gt;
42 - Chad &lt;br /&gt;
&lt;br /&gt;
43 - Chile&lt;br /&gt;
&lt;br /&gt;
44 - China&lt;br /&gt;
&lt;br /&gt;
45 - Christmas Island &lt;br /&gt;
&lt;br /&gt;
46 - Cocos (Keeling) Islands&lt;br /&gt;
&lt;br /&gt;
47 - Colombia &lt;br /&gt;
&lt;br /&gt;
48 - Comoros&lt;br /&gt;
&lt;br /&gt;
49 - Congo&lt;br /&gt;
&lt;br /&gt;
50 - Congo, The Democratic Republic Of The&lt;br /&gt;
&lt;br /&gt;
51 - Cook Islands &lt;br /&gt;
&lt;br /&gt;
52 - Costa Rica &lt;br /&gt;
&lt;br /&gt;
53 - Ivory Cost &lt;br /&gt;
&lt;br /&gt;
54 - Croatia&lt;br /&gt;
&lt;br /&gt;
55 - Cuba &lt;br /&gt;
&lt;br /&gt;
56 - Cyprus &lt;br /&gt;
&lt;br /&gt;
57 - Czech Republic &lt;br /&gt;
&lt;br /&gt;
58 - Denmark&lt;br /&gt;
&lt;br /&gt;
59 - Djibouti &lt;br /&gt;
&lt;br /&gt;
60 - Dominica &lt;br /&gt;
&lt;br /&gt;
61 - Dominican Republic &lt;br /&gt;
&lt;br /&gt;
62 - Ecuador&lt;br /&gt;
&lt;br /&gt;
63 - Egypt&lt;br /&gt;
&lt;br /&gt;
64 - El Salvador&lt;br /&gt;
&lt;br /&gt;
65 - Equatorial Guinea&lt;br /&gt;
&lt;br /&gt;
66 - Eritrea&lt;br /&gt;
&lt;br /&gt;
67 - Estonia&lt;br /&gt;
&lt;br /&gt;
68 - Ethiopia &lt;br /&gt;
&lt;br /&gt;
69 - Falkland Islands (Malvinas)&lt;br /&gt;
&lt;br /&gt;
70 - Faroe Islands&lt;br /&gt;
&lt;br /&gt;
71 - Fiji &lt;br /&gt;
&lt;br /&gt;
72 - Finland&lt;br /&gt;
&lt;br /&gt;
73 - France &lt;br /&gt;
&lt;br /&gt;
74 - French Guiana&lt;br /&gt;
&lt;br /&gt;
75 - French Polynesia &lt;br /&gt;
&lt;br /&gt;
77 - Gabon&lt;br /&gt;
&lt;br /&gt;
78 - Gambia &lt;br /&gt;
&lt;br /&gt;
79 - Georgia&lt;br /&gt;
&lt;br /&gt;
80 - Germany&lt;br /&gt;
&lt;br /&gt;
81 - Ghana&lt;br /&gt;
&lt;br /&gt;
82 - Gibraltar&lt;br /&gt;
&lt;br /&gt;
83 - Greece &lt;br /&gt;
&lt;br /&gt;
84 - Greenland&lt;br /&gt;
&lt;br /&gt;
85 - Grenada&lt;br /&gt;
&lt;br /&gt;
86 - Guadeloupe &lt;br /&gt;
&lt;br /&gt;
87 - Guam &lt;br /&gt;
&lt;br /&gt;
88 - Guatemala&lt;br /&gt;
&lt;br /&gt;
89 - Guinea &lt;br /&gt;
&lt;br /&gt;
90 - Guinea-Bissau&lt;br /&gt;
&lt;br /&gt;
91 - Guyana &lt;br /&gt;
&lt;br /&gt;
92 - Haiti&lt;br /&gt;
&lt;br /&gt;
94 - Vatican City &lt;br /&gt;
&lt;br /&gt;
95 - Honduras &lt;br /&gt;
&lt;br /&gt;
96 - Hong Kong&lt;br /&gt;
&lt;br /&gt;
97 - Hungary&lt;br /&gt;
&lt;br /&gt;
98 - Iceland&lt;br /&gt;
&lt;br /&gt;
99 - India&lt;br /&gt;
&lt;br /&gt;
100 - Indonesia&lt;br /&gt;
&lt;br /&gt;
101 - Iran &lt;br /&gt;
&lt;br /&gt;
102 - Iraq &lt;br /&gt;
&lt;br /&gt;
103 - Ireland&lt;br /&gt;
&lt;br /&gt;
104 - Israel &lt;br /&gt;
&lt;br /&gt;
105 - Italy&lt;br /&gt;
&lt;br /&gt;
106 - Jamaica&lt;br /&gt;
&lt;br /&gt;
107 - Japan&lt;br /&gt;
&lt;br /&gt;
108 - Jordan &lt;br /&gt;
&lt;br /&gt;
109 - Kazakhstan &lt;br /&gt;
&lt;br /&gt;
110 - Kenya&lt;br /&gt;
&lt;br /&gt;
111 - Kiribati &lt;br /&gt;
&lt;br /&gt;
112 - Korea, Democratic People's Republic Of &lt;br /&gt;
&lt;br /&gt;
113 - Korea, Republic of &lt;br /&gt;
&lt;br /&gt;
114 - Kuwait &lt;br /&gt;
&lt;br /&gt;
115 - Kyrgyzstan &lt;br /&gt;
&lt;br /&gt;
116 - Laos &lt;br /&gt;
&lt;br /&gt;
117 - Latvia &lt;br /&gt;
&lt;br /&gt;
118 - Lebanon&lt;br /&gt;
&lt;br /&gt;
119 - Lesotho&lt;br /&gt;
&lt;br /&gt;
120 - Liberia&lt;br /&gt;
&lt;br /&gt;
121 - Libyan Arab Jamahiriya &lt;br /&gt;
&lt;br /&gt;
122 - Liechtenstein&lt;br /&gt;
&lt;br /&gt;
123 - Lithuania&lt;br /&gt;
&lt;br /&gt;
124 - Luxembourg &lt;br /&gt;
&lt;br /&gt;
125 - Macao&lt;br /&gt;
&lt;br /&gt;
126 - Macedonia&lt;br /&gt;
&lt;br /&gt;
127 - Madagascar &lt;br /&gt;
&lt;br /&gt;
128 - Malawi &lt;br /&gt;
&lt;br /&gt;
129 - Malaysia &lt;br /&gt;
&lt;br /&gt;
130 - Maldives &lt;br /&gt;
&lt;br /&gt;
131 - Mali &lt;br /&gt;
&lt;br /&gt;
132 - Malta&lt;br /&gt;
&lt;br /&gt;
133 - Marshall islands &lt;br /&gt;
&lt;br /&gt;
134 - Martinique &lt;br /&gt;
&lt;br /&gt;
135 - Mauritania &lt;br /&gt;
&lt;br /&gt;
136 - Mauritius&lt;br /&gt;
&lt;br /&gt;
137 - Mayotte&lt;br /&gt;
&lt;br /&gt;
138 - Mexico &lt;br /&gt;
&lt;br /&gt;
139 - Micronesia &lt;br /&gt;
&lt;br /&gt;
140 - Moldova&lt;br /&gt;
&lt;br /&gt;
141 - Monaco &lt;br /&gt;
&lt;br /&gt;
142 - Mongolia &lt;br /&gt;
&lt;br /&gt;
143 - Montserrat &lt;br /&gt;
&lt;br /&gt;
144 - Morocco&lt;br /&gt;
&lt;br /&gt;
145 - Mozambique &lt;br /&gt;
&lt;br /&gt;
146 - Myanmar&lt;br /&gt;
&lt;br /&gt;
147 - Namibia&lt;br /&gt;
&lt;br /&gt;
148 - Nauru&lt;br /&gt;
&lt;br /&gt;
149 - Nepal&lt;br /&gt;
&lt;br /&gt;
150 - Netherlands&lt;br /&gt;
&lt;br /&gt;
151 - Netherlands Antilles &lt;br /&gt;
&lt;br /&gt;
152 - New Caledonia&lt;br /&gt;
&lt;br /&gt;
153 - New Zealand&lt;br /&gt;
&lt;br /&gt;
154 - Nicaragua&lt;br /&gt;
&lt;br /&gt;
155 - Niger&lt;br /&gt;
&lt;br /&gt;
156 - Nigeria&lt;br /&gt;
&lt;br /&gt;
157 - Niue &lt;br /&gt;
&lt;br /&gt;
158 - Norfolk Island &lt;br /&gt;
&lt;br /&gt;
159 - Northern Mariana Islands &lt;br /&gt;
&lt;br /&gt;
160 - Norway &lt;br /&gt;
&lt;br /&gt;
161 - Oman &lt;br /&gt;
&lt;br /&gt;
162 - Pakistan &lt;br /&gt;
&lt;br /&gt;
163 - Palau&lt;br /&gt;
&lt;br /&gt;
164 - Palestine&lt;br /&gt;
&lt;br /&gt;
165 - Panama &lt;br /&gt;
&lt;br /&gt;
166 - Papua New Guinea &lt;br /&gt;
&lt;br /&gt;
167 - Paraguay &lt;br /&gt;
&lt;br /&gt;
168 - Peru &lt;br /&gt;
&lt;br /&gt;
169 - Philippines&lt;br /&gt;
&lt;br /&gt;
171 - Poland &lt;br /&gt;
&lt;br /&gt;
172 - Portugal &lt;br /&gt;
&lt;br /&gt;
173 - Puerto Rico&lt;br /&gt;
&lt;br /&gt;
174 - Qatar&lt;br /&gt;
&lt;br /&gt;
175 - Reunion&lt;br /&gt;
&lt;br /&gt;
176 - Romania&lt;br /&gt;
&lt;br /&gt;
177 - Russian Federation &lt;br /&gt;
&lt;br /&gt;
178 - Rwanda &lt;br /&gt;
&lt;br /&gt;
179 - Saint Helena &lt;br /&gt;
&lt;br /&gt;
180 - Saint Kitts And Nevis&lt;br /&gt;
&lt;br /&gt;
181 - Saint Lucia&lt;br /&gt;
&lt;br /&gt;
182 - Saint Pierre And Miquelon&lt;br /&gt;
&lt;br /&gt;
183 - Saint Vincent And The Grenadines &lt;br /&gt;
&lt;br /&gt;
184 - Samoa&lt;br /&gt;
&lt;br /&gt;
185 - San Marino &lt;br /&gt;
&lt;br /&gt;
186 - Sao Tome And Principe&lt;br /&gt;
&lt;br /&gt;
187 - Saudi Arabia &lt;br /&gt;
&lt;br /&gt;
188 - Senegal&lt;br /&gt;
&lt;br /&gt;
189 - Seychelles &lt;br /&gt;
&lt;br /&gt;
190 - Sierra Leone &lt;br /&gt;
&lt;br /&gt;
191 - Singapore&lt;br /&gt;
&lt;br /&gt;
192 - Slovakia &lt;br /&gt;
&lt;br /&gt;
193 - Slovenia &lt;br /&gt;
&lt;br /&gt;
194 - Solomon Islands&lt;br /&gt;
&lt;br /&gt;
195 - Somalia&lt;br /&gt;
&lt;br /&gt;
196 - South Africa &lt;br /&gt;
&lt;br /&gt;
198 - Spain&lt;br /&gt;
&lt;br /&gt;
199 - Sri Lanka&lt;br /&gt;
&lt;br /&gt;
200 - Sudan&lt;br /&gt;
&lt;br /&gt;
201 - Suriname &lt;br /&gt;
&lt;br /&gt;
203 - Swaziland&lt;br /&gt;
&lt;br /&gt;
204 - Sweden &lt;br /&gt;
&lt;br /&gt;
205 - Switzerland&lt;br /&gt;
&lt;br /&gt;
206 - Syrian Arab Republic &lt;br /&gt;
&lt;br /&gt;
207 - Taiwan &lt;br /&gt;
&lt;br /&gt;
208 - Tajikistan &lt;br /&gt;
&lt;br /&gt;
209 - Tanzania &lt;br /&gt;
&lt;br /&gt;
210 - Thailand &lt;br /&gt;
&lt;br /&gt;
212 - Togo &lt;br /&gt;
&lt;br /&gt;
213 - Tokelau&lt;br /&gt;
&lt;br /&gt;
214 - Tonga&lt;br /&gt;
&lt;br /&gt;
215 - Trinidad And Tobago&lt;br /&gt;
&lt;br /&gt;
216 - Tunisia&lt;br /&gt;
&lt;br /&gt;
217 - Turkey &lt;br /&gt;
&lt;br /&gt;
218 - Turkmenistan &lt;br /&gt;
&lt;br /&gt;
219 - Turks And Caicos Islands &lt;br /&gt;
&lt;br /&gt;
220 - Tuvalu &lt;br /&gt;
&lt;br /&gt;
221 - Uganda &lt;br /&gt;
&lt;br /&gt;
222 - Ukraine&lt;br /&gt;
&lt;br /&gt;
223 - United Arab Emirates &lt;br /&gt;
&lt;br /&gt;
224 - United Kingdom &lt;br /&gt;
&lt;br /&gt;
225 - United States&lt;br /&gt;
&lt;br /&gt;
227 - Uruguay&lt;br /&gt;
&lt;br /&gt;
228 - Uzbekistan &lt;br /&gt;
&lt;br /&gt;
229 - Vanuatu&lt;br /&gt;
&lt;br /&gt;
230 - Venezuela&lt;br /&gt;
&lt;br /&gt;
231 - Vietnam&lt;br /&gt;
&lt;br /&gt;
232 - Virgin Islands, British&lt;br /&gt;
&lt;br /&gt;
233 - Virgin Islands, U.S. &lt;br /&gt;
&lt;br /&gt;
234 - Wallis And Futuna&lt;br /&gt;
&lt;br /&gt;
236 - Yemen&lt;br /&gt;
&lt;br /&gt;
238 - Zambia &lt;br /&gt;
&lt;br /&gt;
239 - Zimbabwe &lt;br /&gt;
&lt;br /&gt;
240 - Ascension Island &lt;br /&gt;
&lt;br /&gt;
241 - Diego Garcia &lt;br /&gt;
&lt;br /&gt;
242 - Inmarsat &lt;br /&gt;
&lt;br /&gt;
243 - East Timor &lt;br /&gt;
&lt;br /&gt;
246 - Iridium&lt;br /&gt;
&lt;br /&gt;
247 - Serbia and Montenegro&lt;br /&gt;
&lt;br /&gt;
250 - Emsat&lt;br /&gt;
&lt;br /&gt;
251 - Ellipso-3&lt;br /&gt;
&lt;br /&gt;
252 - Globalstar &lt;br /&gt;
&lt;br /&gt;
253 - Montenegro &lt;br /&gt;
&lt;br /&gt;
254 - Kosovo&lt;br /&gt;
&lt;br /&gt;
255 - South Sudan&lt;br /&gt;
&lt;br /&gt;
256 - Thuraya&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:M4 directions id.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[M4 API]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=How_to_change_server_time_zone&amp;diff=30686</id>
		<title>How to change server time zone</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=How_to_change_server_time_zone&amp;diff=30686"/>
		<updated>2025-11-17T07:38:25Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Centos 6 =&lt;br /&gt;
Check current time by entering&lt;br /&gt;
&lt;br /&gt;
 date&lt;br /&gt;
&lt;br /&gt;
into console.&lt;br /&gt;
&lt;br /&gt;
'''Available timezones could be found in /usr/share/zoneinfo'''&lt;br /&gt;
&lt;br /&gt;
You have to choose correct timezone file and copy it on top of /etc/localtime file.&lt;br /&gt;
&lt;br /&gt;
Example if your server is in Dublin , Europe:&lt;br /&gt;
&lt;br /&gt;
 cp /usr/share/zoneinfo/Europe/Dublin /etc/localtime&lt;br /&gt;
&lt;br /&gt;
Update /etc/sysconfig/clock to new timezone, in this example it would look like this:&lt;br /&gt;
 $&amp;gt; cat /etc/sysconfig/clock &lt;br /&gt;
 ZONE=&amp;quot;Europe/Dublin&amp;quot;&lt;br /&gt;
&lt;br /&gt;
Note: if /etc/sysconfig/clock file is not updated, certain commands (for example glibc package update) will revert timezone to the one defined in /etc/sysconfig/clock, so do not skip this step.&lt;br /&gt;
&lt;br /&gt;
Next step, change hardware clock time to your localtime:&lt;br /&gt;
&lt;br /&gt;
 hwclock --systohc&lt;br /&gt;
&lt;br /&gt;
Check hardware clock time by running:&lt;br /&gt;
&lt;br /&gt;
 hwclock --show&lt;br /&gt;
&lt;br /&gt;
Restart rsyslog:&lt;br /&gt;
 service rsyslog restart&lt;br /&gt;
&lt;br /&gt;
Then '''restart asterisk''', if this doesn't help, restart your server.&lt;br /&gt;
&lt;br /&gt;
= Centos 7 =&lt;br /&gt;
1. Check the current timezone with&lt;br /&gt;
 date&lt;br /&gt;
 timedatectl &lt;br /&gt;
2. Get the list of available timezones&lt;br /&gt;
 timedatectl list-timezones&lt;br /&gt;
3. Set timezone from one from the list&lt;br /&gt;
 timedatectl set-timezone Country/City&lt;br /&gt;
4. Verify changes with&lt;br /&gt;
 timedatectl&lt;br /&gt;
5. Restart rsyslog&lt;br /&gt;
  service rsyslog restart&lt;br /&gt;
6. Remove (delete) line&lt;br /&gt;
 ENV['TZ']='GMT'&lt;br /&gt;
From file /home/mor/config/environment.rb&lt;br /&gt;
&lt;br /&gt;
7. Restart httpd&lt;br /&gt;
 service httpd restart&lt;br /&gt;
&lt;br /&gt;
After changes, it is recommended to restart asterisk, httpd, mysqld, or reboot the server.&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
*[[GUI time zone]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=How_to_change_server_time_zone&amp;diff=30685</id>
		<title>How to change server time zone</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=How_to_change_server_time_zone&amp;diff=30685"/>
		<updated>2025-11-17T07:38:08Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Centos 6 =&lt;br /&gt;
Check current time by entering&lt;br /&gt;
&lt;br /&gt;
 date&lt;br /&gt;
&lt;br /&gt;
into console.&lt;br /&gt;
&lt;br /&gt;
'''Available timezones could be found in /usr/share/zoneinfo'''&lt;br /&gt;
&lt;br /&gt;
You have to choose correct timezone file and copy it on top of /etc/localtime file.&lt;br /&gt;
&lt;br /&gt;
Example if your server is in Dublin , Europe:&lt;br /&gt;
&lt;br /&gt;
 cp /usr/share/zoneinfo/Europe/Dublin /etc/localtime&lt;br /&gt;
&lt;br /&gt;
Update /etc/sysconfig/clock to new timezone, in this example it would look like this:&lt;br /&gt;
 $&amp;gt; cat /etc/sysconfig/clock &lt;br /&gt;
 ZONE=&amp;quot;Europe/Dublin&amp;quot;&lt;br /&gt;
&lt;br /&gt;
Note: if /etc/sysconfig/clock file is not updated, certain commands (for example glibc package update) will revert timezone to the one defined in /etc/sysconfig/clock, so do not skip this step.&lt;br /&gt;
&lt;br /&gt;
Next step, change hardware clock time to your localtime:&lt;br /&gt;
&lt;br /&gt;
 hwclock --systohc&lt;br /&gt;
&lt;br /&gt;
Check hardware clock time by running:&lt;br /&gt;
&lt;br /&gt;
 hwclock --show&lt;br /&gt;
&lt;br /&gt;
Restart rsyslog:&lt;br /&gt;
 service rsyslog restart&lt;br /&gt;
&lt;br /&gt;
Then '''restart asterisk''', if this doesn't help, restart your server.&lt;br /&gt;
&lt;br /&gt;
= Centos 7 =&lt;br /&gt;
1. Check the current timezone with&lt;br /&gt;
 date&lt;br /&gt;
 timedatectl &lt;br /&gt;
2. Get the list of available timezones&lt;br /&gt;
 timedatectl list-timezones&lt;br /&gt;
3. Set timezone from one from the list&lt;br /&gt;
 timedatectl set-timezone Country/City&lt;br /&gt;
4. Verify changes with&lt;br /&gt;
 timedatectl&lt;br /&gt;
5. Restart rsyslog&lt;br /&gt;
  service rsyslog restart&lt;br /&gt;
6. Remove (delete) line&lt;br /&gt;
 ENV['TZ']='GMT'&lt;br /&gt;
From file /home/mor/config/environment.rb&lt;br /&gt;
7. Restart httpd&lt;br /&gt;
 service httpd restart&lt;br /&gt;
&lt;br /&gt;
After changes, it is recommended to restart asterisk, httpd, mysqld, or reboot the server.&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
*[[GUI time zone]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=How_to_make_several_connections_from_one_IP&amp;diff=30646</id>
		<title>How to make several connections from one IP</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=How_to_make_several_connections_from_one_IP&amp;diff=30646"/>
		<updated>2025-11-04T14:00:43Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Description =&lt;br /&gt;
&lt;br /&gt;
In order to separate traffic, it is sometimes necessary to make several connections to MOR from one IP (usually a server).&lt;br /&gt;
&lt;br /&gt;
The main rules for how to do this are:&lt;br /&gt;
&lt;br /&gt;
# Devices should be DYNAMIC and should REGISTER to MOR.&lt;br /&gt;
# In [[Device settings | Device settings]] enable Insecure Port and Invite&lt;br /&gt;
# In the INVITE packet from the external server, which device is dialing should be visible in the '''From:''' line. (If the external server is Asterisk, then in the MOR descriptions (in sip.conf file) on the external server, there should be fromuser= lines that point to which device is dialing. ''Check explanation in details below'').&lt;br /&gt;
&lt;br /&gt;
If the devices are not configured properly, then a call from external server to MOR is possible, but only one device will be billed all the time or only one trunk will be active (it depends on the misconfiguration).&lt;br /&gt;
&lt;br /&gt;
Possible error on misconfiguration:&lt;br /&gt;
&lt;br /&gt;
 WARNING[2836]: chan_sip.c:8385 check_auth: username mismatch, have &amp;lt;XXXX&amp;gt;, digest has &amp;lt;YYYY&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= SIP INVITE packet =&lt;br /&gt;
&lt;br /&gt;
As described previously, the correct SIP INVITE packet should be received in order for MOR to authenticate the user correctly.&lt;br /&gt;
&lt;br /&gt;
== Good SIP INVITE packet ==&lt;br /&gt;
&lt;br /&gt;
 INVITE sip:3908155xxxxx@82.215.xxx.xxx SIP/2.0&lt;br /&gt;
 Via: SIP/2.0/UDP 82.215.xxx.xxx:5060;branch=z9hG4bK50ef8b9b;rport&lt;br /&gt;
 From: &amp;quot;39081761xxxxx&amp;quot; &amp;lt;sip:&amp;lt;big&amp;gt;&amp;lt;big&amp;gt;&amp;lt;big&amp;gt;'''1028'''&amp;lt;/big&amp;gt;&amp;lt;/big&amp;gt;&amp;lt;/big&amp;gt;@82.215.xxx.xxx&amp;gt;;tag=as3b117c95&lt;br /&gt;
 To: &amp;lt;sip:390815517304@82.215.xxx.xxx&amp;gt;&lt;br /&gt;
 Contact &amp;lt;sip:1028@82.215.xxxx.xxx&amp;gt;&lt;br /&gt;
 Call-ID: 2f6f09f8498065164a9aadae5ef123cf@82.215.xxx.xxx&lt;br /&gt;
 CSeq: 102 INVITE&lt;br /&gt;
 User-Agent: Asterisk PBX&lt;br /&gt;
 Max-Forwards: 70&lt;br /&gt;
 Date: Fri, 19 Feb 2010 12:28:03 GMT&lt;br /&gt;
 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY&lt;br /&gt;
 Content-Type: application/sdp&lt;br /&gt;
 Content-Length: 242&lt;br /&gt;
&lt;br /&gt;
== Bad SIP INVITE packet ==&lt;br /&gt;
&lt;br /&gt;
 INVITE sip:3908155xxxxx@82.215.xxx.xxx SIP/2.0&lt;br /&gt;
 Via: SIP/2.0/UDP 82.215.xxx.xxx:5060;branch=z9hG4bK7edd0b9e;rport&lt;br /&gt;
 From: &amp;quot;3908176xxxxx&amp;quot; &amp;lt;sip:&amp;lt;big&amp;gt;&amp;lt;big&amp;gt;&amp;lt;big&amp;gt;'''3908176xxxxx'''&amp;lt;/big&amp;gt;&amp;lt;/big&amp;gt;&amp;lt;/big&amp;gt;@82.215.xxx.xxx&amp;gt;;tag=as1b7e883e&lt;br /&gt;
 To: &amp;lt;sip:3908155xxxxx@82.215.xxx.xxx&amp;gt;&lt;br /&gt;
 Contact: &amp;lt;sip:3908176xxxxx@82.215.xxx.xxx&amp;gt;&lt;br /&gt;
 Call-ID: 1efdd14505519d1a6b769e5c269f555d@82.215.xxx.xxx&lt;br /&gt;
 CSeq: 103 INVITE&lt;br /&gt;
 User-Agent: Asterisk PBX&lt;br /&gt;
 Max-Forwards: 70&lt;br /&gt;
 Proxy-Authorization: Digest username=&amp;quot;1028&amp;quot;, realm=&amp;quot;asterisk&amp;quot;, algorithm=MD5, uri=&amp;quot;sip:3908155xxxxx@82.215.xxx.xxx&amp;quot;, nonce=&amp;quot;0f96c765&amp;quot;, response=&amp;quot;df7b502821c03ad43222d007b20dbf84&amp;quot;, opaque=&amp;quot;&amp;quot;&lt;br /&gt;
 Date: Fri, 19 Feb 2010 12:17:41 GMT&lt;br /&gt;
 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY&lt;br /&gt;
 Content-Type: application/sdp&lt;br /&gt;
 Content-Length: 242&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Example =&lt;br /&gt;
&lt;br /&gt;
Let's say we have MOR and another Asterisk server from which we want to configure two connections to MOR.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== MOR configuration ==&lt;br /&gt;
&lt;br /&gt;
First, on MOR we need to describe such connections as Devices for different Users.&lt;br /&gt;
&lt;br /&gt;
We will create two devices, 1028 and 1009, for these connections:&lt;br /&gt;
&lt;br /&gt;
(Important parts are marked in RED)&lt;br /&gt;
&lt;br /&gt;
[[Image:device_from_sameip1.png]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
[[Image:device_from_sameip2.png]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Remote server configuration ==&lt;br /&gt;
&lt;br /&gt;
The remote server in our example is Asterisk, so its configuration should be in sip.conf file, which describes both connections and registers to MOR:&lt;br /&gt;
&lt;br /&gt;
 [general]&lt;br /&gt;
 &lt;br /&gt;
 register =&amp;gt; 1028:ewpjxxxx@82.215.xxx.xxx/1028&lt;br /&gt;
 register =&amp;gt; 1009:ca5hxxxx@82.215.xxx.xxx/1009&lt;br /&gt;
 &lt;br /&gt;
 &lt;br /&gt;
 [authentication]&lt;br /&gt;
 &lt;br /&gt;
 [mor1028]&lt;br /&gt;
 canreinvite=no&lt;br /&gt;
 host=82.215.xxx.xxx&lt;br /&gt;
 user=1028&lt;br /&gt;
 username=1028&lt;br /&gt;
 secret=ewpjxxxx&lt;br /&gt;
 type=peer&lt;br /&gt;
 ''fromuser=1028''&lt;br /&gt;
  &lt;br /&gt;
 [mor1009]&lt;br /&gt;
 canreinvite=no&lt;br /&gt;
 host=82.215.xxx.xxx&lt;br /&gt;
 user=1009&lt;br /&gt;
 username=1009&lt;br /&gt;
 secret=ca5hxxxx&lt;br /&gt;
 type=peer&lt;br /&gt;
 ''fromuser=1009''&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Limitations =&lt;br /&gt;
&lt;br /&gt;
It is not possible to send CallerID from a remote server this way, because &amp;quot;fromuser&amp;quot; overwrites the CallerID field.&lt;br /&gt;
&lt;br /&gt;
You can only hardcode CallerID in MOR for every user account.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Alternative solution =&lt;br /&gt;
&lt;br /&gt;
Add&lt;br /&gt;
 match_auth_username=yes&lt;br /&gt;
to sip.conf [general] section.&lt;br /&gt;
&lt;br /&gt;
And reload the SIP stack:&lt;br /&gt;
 asterisk -rx 'sip reload keeprt'&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_API_users_get&amp;diff=30567</id>
		<title>MOR API users get</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_API_users_get&amp;diff=30567"/>
		<updated>2025-10-09T06:53:04Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;!---This functionality is available from [[MOR 8| MOR 8]]---&amp;gt;&lt;br /&gt;
=Description=&lt;br /&gt;
&lt;br /&gt;
[[MOR API]] for getting list of users&lt;br /&gt;
&lt;br /&gt;
*'''Admin or Accountant with permissions''' can get all users list&lt;br /&gt;
*'''Reseller''' can get his own users list&lt;br /&gt;
*'''Partner''' can get his resellers and users&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
* From '''MOR X8''' call: /api/users_get&lt;br /&gt;
* Methods: POST, GET(if allowed, not recomended)&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Parameters===  &lt;br /&gt;
&lt;br /&gt;
Parameters that are '''included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* u - username to log in. '''Required'''.&lt;br /&gt;
* p - password to log in. '''note''': you can use either '''p''' or '''uniquehash''' to identify the user. One of them is required.&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Parameters that are '''not included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* uniquehash - user's uniquehash. '''note''': you can use either '''p''' or '''uniquehash''' to identify the user. One of them is required.&amp;lt;br&amp;gt;&lt;br /&gt;
*[[MOR API hash construction | hash]] – SHA1 hash constructed using '''API Secret Key''' ([[MOR API hash construction | More described in Constructing hash]]). '''Required'''.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
'''note''': if using the browser's URL bar, then you should encode special symbols (these symbols usually appear in the p parameter). Example:&lt;br /&gt;
* for % use %25.&lt;br /&gt;
* for # use %23.&lt;br /&gt;
* for + use %2B.&lt;br /&gt;
* for &amp;amp; use %26.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Request===&lt;br /&gt;
&lt;br /&gt;
If API Secret Key = secret&lt;br /&gt;
&lt;br /&gt;
You send:&lt;br /&gt;
&lt;br /&gt;
 HTML POST: http://&amp;lt;SERVER_IP&amp;gt;/billing/api/users_get?u=admin&amp;amp;p=admin1&amp;amp;test=1&amp;amp;hash=c420ef706a02e6449994b7575b25ef5f74cc722b&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Returns===&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;?xml version=&amp;quot;1.0&amp;quot; encoding=&amp;quot;UTF-8&amp;quot;?&amp;gt;&lt;br /&gt;
 &amp;lt;page&amp;gt;&lt;br /&gt;
  &amp;lt;status&amp;gt;&lt;br /&gt;
   &amp;lt;users&amp;gt;&lt;br /&gt;
    &amp;lt;user&amp;gt;&lt;br /&gt;
     &amp;lt;id&amp;gt; ... &amp;lt;/id&amp;gt;&lt;br /&gt;
     &amp;lt;username&amp;gt; ... &amp;lt;/username&amp;gt;&lt;br /&gt;
     &amp;lt;first_name&amp;gt; ... &amp;lt;/first_nam&amp;gt;&lt;br /&gt;
     &amp;lt;last_name&amp;gt; ... &amp;lt;/last_name&amp;gt;&lt;br /&gt;
     &amp;lt;balance&amp;gt; ... &amp;lt;/balance&amp;gt;&lt;br /&gt;
     &amp;lt;blocked&amp;gt; ... &amp;lt;/blocked&amp;gt;&lt;br /&gt;
     &amp;lt;lcr_id&amp;gt; ... &amp;lt;/lcr_id&amp;gt;&lt;br /&gt;
     &amp;lt;tariff_id&amp;gt; ... &amp;lt;/tariff_id&amp;gt;&lt;br /&gt;
     &amp;lt;owner_id&amp;gt; ... &amp;lt;/owner_id&amp;gt;&lt;br /&gt;
     &amp;lt;usertype&amp;gt; ... &amp;lt;/usertype&amp;gt;&lt;br /&gt;
     &amp;lt;hidden&amp;gt; ... &amp;lt;/hidden&amp;gt;&lt;br /&gt;
    &amp;lt;/user&amp;gt;&lt;br /&gt;
   &amp;lt;/users&amp;gt;&lt;br /&gt;
  &amp;lt;/status&amp;gt;&lt;br /&gt;
 &amp;lt;/page&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Errors:'''&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;error&amp;gt;API Requests are disabled&amp;lt;/error&amp;gt; – '''Allow API globally''' setting is unchecked&lt;br /&gt;
* &amp;lt;error&amp;gt;GET Requests are disabled&amp;lt;/error&amp;gt; – '''Allow GET API''' setting is unchecked&lt;br /&gt;
* &amp;lt;error&amp;gt;Access Denied&amp;lt;/error&amp;gt;  – User is not allowed to to get users list or username and password are not correct.&lt;br /&gt;
* &amp;lt;error&amp;gt;Incorrect hash&amp;lt;/error&amp;gt; – Hash was not correct. Check API_Secret_Key and order of parameters while concatenating the hash_string&lt;br /&gt;
* &amp;lt;error&amp;gt;You are not authorized to view this page&amp;lt;/error&amp;gt; – User is not authorized to get users list.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&lt;br /&gt;
  &amp;lt;status&amp;gt;&lt;br /&gt;
    &amp;lt;error&amp;gt;API Requests are disabled&amp;lt;/error&amp;gt;&lt;br /&gt;
  &amp;lt;/status&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[MOR API]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_API_users_get&amp;diff=30566</id>
		<title>MOR API users get</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_API_users_get&amp;diff=30566"/>
		<updated>2025-10-09T06:52:01Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;!---This functionality is available from [[MOR 8| MOR 8]]---&amp;gt;&lt;br /&gt;
=Description=&lt;br /&gt;
&lt;br /&gt;
[[MOR API]] for getting list of users&lt;br /&gt;
&lt;br /&gt;
*'''Admin or Accountant with permissions''' can get all users list&lt;br /&gt;
*'''Reseller''' can get his own users list&lt;br /&gt;
*'''Partner''' can get his resellers and users&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
* From '''MOR X8''' call: /api/users_get&lt;br /&gt;
* Methods: POST, GET(if allowed, not recomended)&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Parameters===  &lt;br /&gt;
&lt;br /&gt;
Parameters that are '''included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* u - username to log in. '''Required'''.&lt;br /&gt;
* p - password to login. '''note''': you can use either '''p''' or '''uniquehash''' to identify the user. One of them is required.&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Parameters that are '''not included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* uniquehash - user's uniquehash. '''note''': you can use either '''p''' or '''uniquehash''' to identify the user. One of them is required.&amp;lt;br&amp;gt;&lt;br /&gt;
*[[MOR API hash construction | hash]] – SHA1 hash constructed using '''API Secret Key''' ([[MOR API hash construction | More described in Constructing hash]]). '''Required'''.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
'''note''': if using the browser's URL bar, then you should encode special symbols (these symbols usually appear in the p parameter). Example:&lt;br /&gt;
* for % use %25.&lt;br /&gt;
* for # use %23.&lt;br /&gt;
* for + use %2B.&lt;br /&gt;
* for &amp;amp; use %26.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Request===&lt;br /&gt;
&lt;br /&gt;
If API Secret Key = secret&lt;br /&gt;
&lt;br /&gt;
You send:&lt;br /&gt;
&lt;br /&gt;
 HTML POST: http://&amp;lt;SERVER_IP&amp;gt;/billing/api/users_get?u=admin&amp;amp;p=admin1&amp;amp;test=1&amp;amp;hash=c420ef706a02e6449994b7575b25ef5f74cc722b&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Returns===&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;?xml version=&amp;quot;1.0&amp;quot; encoding=&amp;quot;UTF-8&amp;quot;?&amp;gt;&lt;br /&gt;
 &amp;lt;page&amp;gt;&lt;br /&gt;
  &amp;lt;status&amp;gt;&lt;br /&gt;
   &amp;lt;users&amp;gt;&lt;br /&gt;
    &amp;lt;user&amp;gt;&lt;br /&gt;
     &amp;lt;id&amp;gt; ... &amp;lt;/id&amp;gt;&lt;br /&gt;
     &amp;lt;username&amp;gt; ... &amp;lt;/username&amp;gt;&lt;br /&gt;
     &amp;lt;first_name&amp;gt; ... &amp;lt;/first_nam&amp;gt;&lt;br /&gt;
     &amp;lt;last_name&amp;gt; ... &amp;lt;/last_name&amp;gt;&lt;br /&gt;
     &amp;lt;balance&amp;gt; ... &amp;lt;/balance&amp;gt;&lt;br /&gt;
     &amp;lt;blocked&amp;gt; ... &amp;lt;/blocked&amp;gt;&lt;br /&gt;
     &amp;lt;lcr_id&amp;gt; ... &amp;lt;/lcr_id&amp;gt;&lt;br /&gt;
     &amp;lt;tariff_id&amp;gt; ... &amp;lt;/tariff_id&amp;gt;&lt;br /&gt;
     &amp;lt;owner_id&amp;gt; ... &amp;lt;/owner_id&amp;gt;&lt;br /&gt;
     &amp;lt;usertype&amp;gt; ... &amp;lt;/usertype&amp;gt;&lt;br /&gt;
     &amp;lt;hidden&amp;gt; ... &amp;lt;/hidden&amp;gt;&lt;br /&gt;
    &amp;lt;/user&amp;gt;&lt;br /&gt;
   &amp;lt;/users&amp;gt;&lt;br /&gt;
  &amp;lt;/status&amp;gt;&lt;br /&gt;
 &amp;lt;/page&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Errors:'''&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;error&amp;gt;API Requests are disabled&amp;lt;/error&amp;gt; – '''Allow API globally''' setting is unchecked&lt;br /&gt;
* &amp;lt;error&amp;gt;GET Requests are disabled&amp;lt;/error&amp;gt; – '''Allow GET API''' setting is unchecked&lt;br /&gt;
* &amp;lt;error&amp;gt;Access Denied&amp;lt;/error&amp;gt;  – User is not allowed to to get users list or username and password are not correct.&lt;br /&gt;
* &amp;lt;error&amp;gt;Incorrect hash&amp;lt;/error&amp;gt; – Hash was not correct. Check API_Secret_Key and order of parameters while concatenating the hash_string&lt;br /&gt;
* &amp;lt;error&amp;gt;You are not authorized to view this page&amp;lt;/error&amp;gt; – User is not authorized to get users list.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&lt;br /&gt;
  &amp;lt;status&amp;gt;&lt;br /&gt;
    &amp;lt;error&amp;gt;API Requests are disabled&amp;lt;/error&amp;gt;&lt;br /&gt;
  &amp;lt;/status&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[MOR API]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_API_users_get&amp;diff=30565</id>
		<title>MOR API users get</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_API_users_get&amp;diff=30565"/>
		<updated>2025-10-09T06:43:02Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;!---This functionality is available from [[MOR 8| MOR 8]]---&amp;gt;&lt;br /&gt;
=Description=&lt;br /&gt;
&lt;br /&gt;
[[MOR API]] for getting list of users&lt;br /&gt;
&lt;br /&gt;
*'''Admin or Accountant with permissions''' can get all users list&lt;br /&gt;
*'''Reseller''' can get his own users list&lt;br /&gt;
*'''Partner''' can get his resellers and users&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
* From '''MOR X8''' call: /api/users_get&lt;br /&gt;
* Methods: POST, GET(if allowed, not recomended)&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Parameters===  &lt;br /&gt;
&lt;br /&gt;
Parameters that are '''included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* u - username to log in. '''Required'''.&lt;br /&gt;
* p - password to login. &lt;br /&gt;
&lt;br /&gt;
Parameters that are '''not included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* uniquehash - user's uniquehash.&lt;br /&gt;
'''note''': you can use either '''p''' or '''uniquehash''' to identify the user. One of them is required&amp;lt;br&amp;gt;&lt;br /&gt;
'''note''': if using the browser's URL bar, then you should encode symbols. Example:&lt;br /&gt;
** for % use %25.&lt;br /&gt;
** for # use %23.&lt;br /&gt;
** for + use %2B.&lt;br /&gt;
** for &amp;amp; use %26.&lt;br /&gt;
&lt;br /&gt;
*[[MOR API hash construction | hash]] – SHA1 hash constructed using '''API Secret Key''' ([[MOR API hash construction | More described in Constructing hash]]). '''Required'''.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Request===&lt;br /&gt;
&lt;br /&gt;
If API Secret Key = secret&lt;br /&gt;
&lt;br /&gt;
You send:&lt;br /&gt;
&lt;br /&gt;
 HTML POST: http://&amp;lt;SERVER_IP&amp;gt;/billing/api/users_get?u=admin&amp;amp;p=admin1&amp;amp;test=1&amp;amp;hash=c420ef706a02e6449994b7575b25ef5f74cc722b&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Returns===&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;?xml version=&amp;quot;1.0&amp;quot; encoding=&amp;quot;UTF-8&amp;quot;?&amp;gt;&lt;br /&gt;
 &amp;lt;page&amp;gt;&lt;br /&gt;
  &amp;lt;status&amp;gt;&lt;br /&gt;
   &amp;lt;users&amp;gt;&lt;br /&gt;
    &amp;lt;user&amp;gt;&lt;br /&gt;
     &amp;lt;id&amp;gt; ... &amp;lt;/id&amp;gt;&lt;br /&gt;
     &amp;lt;username&amp;gt; ... &amp;lt;/username&amp;gt;&lt;br /&gt;
     &amp;lt;first_name&amp;gt; ... &amp;lt;/first_nam&amp;gt;&lt;br /&gt;
     &amp;lt;last_name&amp;gt; ... &amp;lt;/last_name&amp;gt;&lt;br /&gt;
     &amp;lt;balance&amp;gt; ... &amp;lt;/balance&amp;gt;&lt;br /&gt;
     &amp;lt;blocked&amp;gt; ... &amp;lt;/blocked&amp;gt;&lt;br /&gt;
     &amp;lt;lcr_id&amp;gt; ... &amp;lt;/lcr_id&amp;gt;&lt;br /&gt;
     &amp;lt;tariff_id&amp;gt; ... &amp;lt;/tariff_id&amp;gt;&lt;br /&gt;
     &amp;lt;owner_id&amp;gt; ... &amp;lt;/owner_id&amp;gt;&lt;br /&gt;
     &amp;lt;usertype&amp;gt; ... &amp;lt;/usertype&amp;gt;&lt;br /&gt;
     &amp;lt;hidden&amp;gt; ... &amp;lt;/hidden&amp;gt;&lt;br /&gt;
    &amp;lt;/user&amp;gt;&lt;br /&gt;
   &amp;lt;/users&amp;gt;&lt;br /&gt;
  &amp;lt;/status&amp;gt;&lt;br /&gt;
 &amp;lt;/page&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Errors:'''&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;error&amp;gt;API Requests are disabled&amp;lt;/error&amp;gt; – '''Allow API globally''' setting is unchecked&lt;br /&gt;
* &amp;lt;error&amp;gt;GET Requests are disabled&amp;lt;/error&amp;gt; – '''Allow GET API''' setting is unchecked&lt;br /&gt;
* &amp;lt;error&amp;gt;Access Denied&amp;lt;/error&amp;gt;  – User is not allowed to to get users list or username and password are not correct.&lt;br /&gt;
* &amp;lt;error&amp;gt;Incorrect hash&amp;lt;/error&amp;gt; – Hash was not correct. Check API_Secret_Key and order of parameters while concatenating the hash_string&lt;br /&gt;
* &amp;lt;error&amp;gt;You are not authorized to view this page&amp;lt;/error&amp;gt; – User is not authorized to get users list.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&lt;br /&gt;
  &amp;lt;status&amp;gt;&lt;br /&gt;
    &amp;lt;error&amp;gt;API Requests are disabled&amp;lt;/error&amp;gt;&lt;br /&gt;
  &amp;lt;/status&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[MOR API]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_API_users_get&amp;diff=30564</id>
		<title>MOR API users get</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_API_users_get&amp;diff=30564"/>
		<updated>2025-10-09T06:42:39Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;!---This functionality is available from [[MOR 8| MOR 8]]---&amp;gt;&lt;br /&gt;
=Description=&lt;br /&gt;
&lt;br /&gt;
[[MOR API]] for getting list of users&lt;br /&gt;
&lt;br /&gt;
*'''Admin or Accountant with permissions''' can get all users list&lt;br /&gt;
*'''Reseller''' can get his own users list&lt;br /&gt;
*'''Partner''' can get his resellers and users&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
* From '''MOR X8''' call: /api/users_get&lt;br /&gt;
* Methods: POST, GET(if allowed, not recomended)&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Parameters===  &lt;br /&gt;
&lt;br /&gt;
Parameters that are '''included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* u - username to log in. '''Required'''.&lt;br /&gt;
* p - password to login. &lt;br /&gt;
&lt;br /&gt;
Parameters that are '''not included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* uniquehash - user's uniquehash.&lt;br /&gt;
&lt;br /&gt;
'''note''': you can use either '''p''' or '''uniquehash''' to identify the user. One of them is required&amp;lt;br&amp;gt;&lt;br /&gt;
'''note''': if using the browser's URL bar, then you should encode symbols. Example:&lt;br /&gt;
** for % use %25.&lt;br /&gt;
** for # use %23.&lt;br /&gt;
** for + use %2B.&lt;br /&gt;
** for &amp;amp; use %26.&lt;br /&gt;
&lt;br /&gt;
*[[MOR API hash construction | hash]] – SHA1 hash constructed using '''API Secret Key''' ([[MOR API hash construction | More described in Constructing hash]]). '''Required'''.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Request===&lt;br /&gt;
&lt;br /&gt;
If API Secret Key = secret&lt;br /&gt;
&lt;br /&gt;
You send:&lt;br /&gt;
&lt;br /&gt;
 HTML POST: http://&amp;lt;SERVER_IP&amp;gt;/billing/api/users_get?u=admin&amp;amp;p=admin1&amp;amp;test=1&amp;amp;hash=c420ef706a02e6449994b7575b25ef5f74cc722b&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Returns===&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;?xml version=&amp;quot;1.0&amp;quot; encoding=&amp;quot;UTF-8&amp;quot;?&amp;gt;&lt;br /&gt;
 &amp;lt;page&amp;gt;&lt;br /&gt;
  &amp;lt;status&amp;gt;&lt;br /&gt;
   &amp;lt;users&amp;gt;&lt;br /&gt;
    &amp;lt;user&amp;gt;&lt;br /&gt;
     &amp;lt;id&amp;gt; ... &amp;lt;/id&amp;gt;&lt;br /&gt;
     &amp;lt;username&amp;gt; ... &amp;lt;/username&amp;gt;&lt;br /&gt;
     &amp;lt;first_name&amp;gt; ... &amp;lt;/first_nam&amp;gt;&lt;br /&gt;
     &amp;lt;last_name&amp;gt; ... &amp;lt;/last_name&amp;gt;&lt;br /&gt;
     &amp;lt;balance&amp;gt; ... &amp;lt;/balance&amp;gt;&lt;br /&gt;
     &amp;lt;blocked&amp;gt; ... &amp;lt;/blocked&amp;gt;&lt;br /&gt;
     &amp;lt;lcr_id&amp;gt; ... &amp;lt;/lcr_id&amp;gt;&lt;br /&gt;
     &amp;lt;tariff_id&amp;gt; ... &amp;lt;/tariff_id&amp;gt;&lt;br /&gt;
     &amp;lt;owner_id&amp;gt; ... &amp;lt;/owner_id&amp;gt;&lt;br /&gt;
     &amp;lt;usertype&amp;gt; ... &amp;lt;/usertype&amp;gt;&lt;br /&gt;
     &amp;lt;hidden&amp;gt; ... &amp;lt;/hidden&amp;gt;&lt;br /&gt;
    &amp;lt;/user&amp;gt;&lt;br /&gt;
   &amp;lt;/users&amp;gt;&lt;br /&gt;
  &amp;lt;/status&amp;gt;&lt;br /&gt;
 &amp;lt;/page&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Errors:'''&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;error&amp;gt;API Requests are disabled&amp;lt;/error&amp;gt; – '''Allow API globally''' setting is unchecked&lt;br /&gt;
* &amp;lt;error&amp;gt;GET Requests are disabled&amp;lt;/error&amp;gt; – '''Allow GET API''' setting is unchecked&lt;br /&gt;
* &amp;lt;error&amp;gt;Access Denied&amp;lt;/error&amp;gt;  – User is not allowed to to get users list or username and password are not correct.&lt;br /&gt;
* &amp;lt;error&amp;gt;Incorrect hash&amp;lt;/error&amp;gt; – Hash was not correct. Check API_Secret_Key and order of parameters while concatenating the hash_string&lt;br /&gt;
* &amp;lt;error&amp;gt;You are not authorized to view this page&amp;lt;/error&amp;gt; – User is not authorized to get users list.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&lt;br /&gt;
  &amp;lt;status&amp;gt;&lt;br /&gt;
    &amp;lt;error&amp;gt;API Requests are disabled&amp;lt;/error&amp;gt;&lt;br /&gt;
  &amp;lt;/status&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[MOR API]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_API_users_get&amp;diff=30563</id>
		<title>MOR API users get</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_API_users_get&amp;diff=30563"/>
		<updated>2025-10-09T06:42:22Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;!---This functionality is available from [[MOR 8| MOR 8]]---&amp;gt;&lt;br /&gt;
=Description=&lt;br /&gt;
&lt;br /&gt;
[[MOR API]] for getting list of users&lt;br /&gt;
&lt;br /&gt;
*'''Admin or Accountant with permissions''' can get all users list&lt;br /&gt;
*'''Reseller''' can get his own users list&lt;br /&gt;
*'''Partner''' can get his resellers and users&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
* From '''MOR X8''' call: /api/users_get&lt;br /&gt;
* Methods: POST, GET(if allowed, not recomended)&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Parametres===&lt;br /&gt;
&lt;br /&gt;
Parameters that are '''included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* '''dids_id''' – this is id of DID which have to be updated. '''Required'''.&lt;br /&gt;
&lt;br /&gt;
'''Note that parameters are shown in the same order as they have to be when generating the hash. Last parameter in a row is API_Secret_Key'''&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Parameters which are '''not included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* [[MOR API hash construction | hash]] - SHA1 hash constructed using '''dids_id''' and API_Secret_Key ([[MOR API hash construction | More described in Constructing hash]]). '''Required'''.&lt;br /&gt;
* '''u''' – username to login. '''Required'''.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
===Parameters===  &lt;br /&gt;
&lt;br /&gt;
Parameters that are '''included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* u - username to log in. '''Required'''.&lt;br /&gt;
* p - password to login. &lt;br /&gt;
&lt;br /&gt;
Parameters that are '''not included''' into hash:&lt;br /&gt;
&lt;br /&gt;
* uniquehash - user's uniquehash.&lt;br /&gt;
&lt;br /&gt;
'''note''': you can use either '''p''' or '''uniquehash''' to identify the user. One of them is required&amp;lt;br&amp;gt;&lt;br /&gt;
'''note''': if using the browser's URL bar, then you should encode symbols. Example:&lt;br /&gt;
** for % use %25.&lt;br /&gt;
** for # use %23.&lt;br /&gt;
** for + use %2B.&lt;br /&gt;
** for &amp;amp; use %26.&lt;br /&gt;
&lt;br /&gt;
*[[MOR API hash construction | hash]] – SHA1 hash constructed using '''API Secret Key''' ([[MOR API hash construction | More described in Constructing hash]]). '''Required'''.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Request===&lt;br /&gt;
&lt;br /&gt;
If API Secret Key = secret&lt;br /&gt;
&lt;br /&gt;
You send:&lt;br /&gt;
&lt;br /&gt;
 HTML POST: http://&amp;lt;SERVER_IP&amp;gt;/billing/api/users_get?u=admin&amp;amp;p=admin1&amp;amp;test=1&amp;amp;hash=c420ef706a02e6449994b7575b25ef5f74cc722b&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Returns===&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;?xml version=&amp;quot;1.0&amp;quot; encoding=&amp;quot;UTF-8&amp;quot;?&amp;gt;&lt;br /&gt;
 &amp;lt;page&amp;gt;&lt;br /&gt;
  &amp;lt;status&amp;gt;&lt;br /&gt;
   &amp;lt;users&amp;gt;&lt;br /&gt;
    &amp;lt;user&amp;gt;&lt;br /&gt;
     &amp;lt;id&amp;gt; ... &amp;lt;/id&amp;gt;&lt;br /&gt;
     &amp;lt;username&amp;gt; ... &amp;lt;/username&amp;gt;&lt;br /&gt;
     &amp;lt;first_name&amp;gt; ... &amp;lt;/first_nam&amp;gt;&lt;br /&gt;
     &amp;lt;last_name&amp;gt; ... &amp;lt;/last_name&amp;gt;&lt;br /&gt;
     &amp;lt;balance&amp;gt; ... &amp;lt;/balance&amp;gt;&lt;br /&gt;
     &amp;lt;blocked&amp;gt; ... &amp;lt;/blocked&amp;gt;&lt;br /&gt;
     &amp;lt;lcr_id&amp;gt; ... &amp;lt;/lcr_id&amp;gt;&lt;br /&gt;
     &amp;lt;tariff_id&amp;gt; ... &amp;lt;/tariff_id&amp;gt;&lt;br /&gt;
     &amp;lt;owner_id&amp;gt; ... &amp;lt;/owner_id&amp;gt;&lt;br /&gt;
     &amp;lt;usertype&amp;gt; ... &amp;lt;/usertype&amp;gt;&lt;br /&gt;
     &amp;lt;hidden&amp;gt; ... &amp;lt;/hidden&amp;gt;&lt;br /&gt;
    &amp;lt;/user&amp;gt;&lt;br /&gt;
   &amp;lt;/users&amp;gt;&lt;br /&gt;
  &amp;lt;/status&amp;gt;&lt;br /&gt;
 &amp;lt;/page&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Errors:'''&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;error&amp;gt;API Requests are disabled&amp;lt;/error&amp;gt; – '''Allow API globally''' setting is unchecked&lt;br /&gt;
* &amp;lt;error&amp;gt;GET Requests are disabled&amp;lt;/error&amp;gt; – '''Allow GET API''' setting is unchecked&lt;br /&gt;
* &amp;lt;error&amp;gt;Access Denied&amp;lt;/error&amp;gt;  – User is not allowed to to get users list or username and password are not correct.&lt;br /&gt;
* &amp;lt;error&amp;gt;Incorrect hash&amp;lt;/error&amp;gt; – Hash was not correct. Check API_Secret_Key and order of parameters while concatenating the hash_string&lt;br /&gt;
* &amp;lt;error&amp;gt;You are not authorized to view this page&amp;lt;/error&amp;gt; – User is not authorized to get users list.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Example:&lt;br /&gt;
&lt;br /&gt;
  &amp;lt;status&amp;gt;&lt;br /&gt;
    &amp;lt;error&amp;gt;API Requests are disabled&amp;lt;/error&amp;gt;&lt;br /&gt;
  &amp;lt;/status&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[MOR API]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=File:AccountantPermissions.png&amp;diff=30487</id>
		<title>File:AccountantPermissions.png</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=File:AccountantPermissions.png&amp;diff=30487"/>
		<updated>2025-09-10T08:13:48Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: Gilbertas uploaded a new version of File:AccountantPermissions.png&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Accountant_permissions&amp;diff=30486</id>
		<title>Accountant permissions</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Accountant_permissions&amp;diff=30486"/>
		<updated>2025-09-10T08:13:31Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;!---This functionality is available from MOR 8---&amp;gt;&lt;br /&gt;
= Description =&lt;br /&gt;
&lt;br /&gt;
By default, Accountants permissions are all disabled.&lt;br /&gt;
&lt;br /&gt;
It is possible to allow them to make some changes to the system by changing their permissions.&lt;br /&gt;
&lt;br /&gt;
Accountants belong to some Accountant Groups with different permissions.&lt;br /&gt;
&lt;br /&gt;
This makes it possible to create separate Accountant types, such as:&lt;br /&gt;
&lt;br /&gt;
* Financial accountant - which can manage Tariffs/Rates, etc.&lt;br /&gt;
* Network engineer - can manage Devices.&lt;br /&gt;
* Network administrator - can manage Users.&lt;br /&gt;
&lt;br /&gt;
... and so on. Many variations are possible.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;b&amp;gt;Accountant can create other Accountants with  additional permissions &amp;quot;Manage Users&amp;quot;, &amp;quot;Create Users&amp;quot; and &amp;quot;User Type&amp;quot;.&amp;lt;/b&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Accountant Groups = &lt;br /&gt;
&lt;br /&gt;
'''SETTINGS - Setup - Settings -  Accountant permissions'''&lt;br /&gt;
&lt;br /&gt;
Create groups by filling empty fields&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[Image:acc_groups1.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
To change permissions you have to click on [[Image:icon_edit.png]] and reach window like this:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[Image:AccountantPermissions.png]]&lt;br /&gt;
&lt;br /&gt;
* If permission '''Last Calls - Hide Provider Data''' is '''disabled''': Accountant sees all calls for all Providers, however, if Accountant has &amp;quot;Show only assigned providers&amp;quot; enabled, then Accountant only sees calls to those Providers. Provider related data (prices) is visible for all Providers.&lt;br /&gt;
* If permission '''Last Calls - Hide Provider Data''' is '''enabled''': Accountant sees all calls for all Providers, however, if Accountant has &amp;quot;Show only assigned providers&amp;quot; enabled, then Accountant only sees calls to those Providers. Provider related data (prices) is shown for Assigned Providers only.&lt;br /&gt;
* Permission '''Call Tracing Usage''' also enables Call log and PCAP at call info page.&lt;br /&gt;
* Permission '''Device CallerID Random Number from Number Pool''' requires a Number Pool, so if it is set to read or write, '''Manage Number Pools''' permission has to be set accordingly too.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
After you select permissions which you need, go to create Accountants or edit their settings and assign them to an Accountant Permissions Group.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[Image:acc_groups3.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[Responsible Accountant]]&lt;br /&gt;
* [[Users]]&lt;br /&gt;
* [[User Details]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Accountant_permissions&amp;diff=30485</id>
		<title>Accountant permissions</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Accountant_permissions&amp;diff=30485"/>
		<updated>2025-09-10T08:13:15Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;!---This functionality is available from MOR 8---&amp;gt;&lt;br /&gt;
= Description =&lt;br /&gt;
&lt;br /&gt;
By default, Accountants permissions are all disabled.&lt;br /&gt;
&lt;br /&gt;
It is possible to allow them to make some changes to the system by changing their permissions.&lt;br /&gt;
&lt;br /&gt;
Accountants belong to some Accountant Groups with different permissions.&lt;br /&gt;
&lt;br /&gt;
This makes it possible to create separate Accountant types, such as:&lt;br /&gt;
&lt;br /&gt;
* Financial accountant - which can manage Tariffs/Rates, etc.&lt;br /&gt;
* Network engineer - can manage Devices.&lt;br /&gt;
* Network administrator - can manage Users.&lt;br /&gt;
&lt;br /&gt;
... and so on. Many variations are possible.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* &amp;lt;b&amp;gt;Accountant can create other Accountants with  additional permissions &amp;quot;Manage Users&amp;quot;, &amp;quot;Create Users&amp;quot; and &amp;quot;User Type&amp;quot;.&amp;lt;/b&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Accountant Groups = &lt;br /&gt;
&lt;br /&gt;
'''SETTINGS - Setup - Settings -  Accountant permissions'''&lt;br /&gt;
&lt;br /&gt;
Create groups by filling empty fields&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[Image:acc_groups1.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
To change permissions you have to click on [[Image:icon_edit.png]] and reach window like this:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[Image:AccountantPermissions.png]]&lt;br /&gt;
&lt;br /&gt;
* If permission '''Last Calls - Hide Provider Data''' is '''disabled''': Accountant sees all calls for all Providers, however, if Accountant has &amp;quot;Show only assigned providers&amp;quot; enabled, then Accountant only sees calls to those Providers. Provider related data (prices) is visible for all Providers.&lt;br /&gt;
* If permission '''Last Calls - Hide Provider Data''' is '''enabled''': Accountant sees all calls for all Providers, however, if Accountant has &amp;quot;Show only assigned providers&amp;quot; enabled, then Accountant only sees calls to those Providers. Provider related data (prices) is shown for Assigned Providers only.&lt;br /&gt;
* Permission '''Call Tracing Usage''' also enables Call log and PCAP at call info page.&lt;br /&gt;
* Permission '''Device CallerID Random Number from Number Pool''' requires a Number Pool, so if it is set to read or write, 'Manage Number Pools''' permission has to be set accordingly too.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
After you select permissions which you need, go to create Accountants or edit their settings and assign them to an Accountant Permissions Group.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[Image:acc_groups3.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[Responsible Accountant]]&lt;br /&gt;
* [[Users]]&lt;br /&gt;
* [[User Details]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30474</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30474"/>
		<updated>2025-09-05T08:31:15Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
[[Blocked IPs]]&lt;br /&gt;
&lt;br /&gt;
[[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30473</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30473"/>
		<updated>2025-09-05T08:31:05Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
[[Blocked IPs]]&lt;br /&gt;
[[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30472</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30472"/>
		<updated>2025-09-05T08:29:42Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables''' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
[[Blocked IPs]]&lt;br /&gt;
[[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30471</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30471"/>
		<updated>2025-09-05T08:29:16Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds its own chains NOT directly to the INPUT chain, but to the MOR-FAIL2BAN-JUMP chain.&lt;br /&gt;
&lt;br /&gt;
You have a new fail2ban configuration if:&lt;br /&gt;
* File /etc/fail2ban/jail.local exits&lt;br /&gt;
* Beginning of the file /etc/fail2ban/jail.local contains:&lt;br /&gt;
 [DEFAULT]&lt;br /&gt;
 chain = MOR-FAIL2BAN-JUMP&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables'' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
= See Also =&lt;br /&gt;
[[Blocked IPs]]&lt;br /&gt;
[[MOR iptables Chains]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30470</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30470"/>
		<updated>2025-09-05T08:11:53Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds chains to MOR-FAIL2BAN-JUMP, and not directly to the INPUT chain.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables'' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you unblock IP using manual iptables commands, after fail2ban restart, such IP will be blocked again. To permanently unblock an IP, use the methods mentioned above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30469</id>
		<title>Fail2Ban on X18</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Fail2Ban_on_X18&amp;diff=30469"/>
		<updated>2025-09-05T08:10:00Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: Created page with &amp;quot;=Description= In recent MOR X18 versions, Fail2ban has been reworked. Two main differences: * MOR jails are configured in jail.local, system's global jail.conf is left untouched * Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds chains to MOR-FAIL2BAN-JUMP, and not directly to the INPUT chain.  &amp;lt;br&amp;gt;&amp;lt;br&amp;gt; =How to modify MOR jails=   * /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
In recent MOR X18 versions, Fail2ban has been reworked. Two main differences:&lt;br /&gt;
* MOR jails are configured in jail.local, system's global jail.conf is left untouched&lt;br /&gt;
* Fail2ban default chain changed to '''MOR-FAIL2BAN-JUMP'''. Now, Fail2ban adds chains to MOR-FAIL2BAN-JUMP, and not directly to the INPUT chain.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=How to modify MOR jails=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* /etc/fail2ban/jail.conf contains global fail2ban configuration that is included in fail2ban package, we should not change anything here&lt;br /&gt;
* /etc/fail2ban/jail.local contains MOR jails. If this is modified manually, it can be overwritten by the MOR update &lt;br /&gt;
&lt;br /&gt;
This is the order in which fail2ban loads jail configurations from /etc/fail2ban/ directory     &lt;br /&gt;
* jail.conf&lt;br /&gt;
* jail.d/*.conf (in alphabetical order)&lt;br /&gt;
* jail.local&lt;br /&gt;
* jail.d/*.local (in alphabetical order).&lt;br /&gt;
&lt;br /&gt;
So to change the configuration of MOR jail, we should create a .local file in /etc/fail2ban/jail.d&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 1 ==&lt;br /&gt;
&lt;br /&gt;
The asterisk-iptables jail bans an IP address if it attempts to register several times with an incorrect password. By default, IP is banned for all ports. Let's say we want to block only access to ports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/asterisk-iptables.local&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [asterisk-iptables]&lt;br /&gt;
 port = 5060,5061,5065&lt;br /&gt;
 banaction = iptables[type=multiport]&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
We can observe that before the changes, all ports were checked against the f2b-asterisk-iptables chain&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
After changes, only ports 5060,5061,5065 are blocked&lt;br /&gt;
&lt;br /&gt;
 Chain MOR-FAIL2BAN-JUMP (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 f2b-asterisk-iptables  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061,5065&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Example 2 ==&lt;br /&gt;
&lt;br /&gt;
SSH jail (ssh-iptables) blocks the IP permanently after 3 incorrect password attempts. Let's say we want to block an IP after 5 attempts and only for 15 minutes.&lt;br /&gt;
&lt;br /&gt;
1. Create a file /etc/fail2ban/jail.d/ssh-iptables.local&lt;br /&gt;
2. Add such contents in the file:&lt;br /&gt;
 [ssh-iptables]&lt;br /&gt;
 maxretry = 5&lt;br /&gt;
 bantime = 900&lt;br /&gt;
&lt;br /&gt;
3. Restart fail2ban&lt;br /&gt;
 systemctl restart fail2ban&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Manage Fail2ban jails/ips=&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== List active jails ==&lt;br /&gt;
To list active jails, use the command '''fail2ban-client status'''&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status&lt;br /&gt;
 Status&lt;br /&gt;
 |- Number of jail:      7&lt;br /&gt;
 `- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
Important notes:&lt;br /&gt;
* Jails in iptables will have f2b- prefix, for example '''ssh-iptables'' jail will correspond to '''f2b-ssh-iptables''' chain&lt;br /&gt;
* Iptables chains for jails are created dynamically, after the first IP is blocked for a specific jail. If no IP is blocked, a chain will not exist in iptables. However, if IP was blocked, and later ban expired (or the IP was manually removed), the chain will remain &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Get more information about the jail ==&lt;br /&gt;
&lt;br /&gt;
To list more information for specific jails, use '''fail2ban-client status JAILNAME'''&lt;br /&gt;
&lt;br /&gt;
 [root@node01 ~]# fail2ban-client status ssh-iptables&lt;br /&gt;
 Status for the jail: ssh-iptables&lt;br /&gt;
 |- Filter&lt;br /&gt;
 |  |- Currently failed: 0&lt;br /&gt;
 |  |- Total failed:     0&lt;br /&gt;
 |  `- File list:        /var/log/secure&lt;br /&gt;
 `- Actions&lt;br /&gt;
    |- Currently banned: 1&lt;br /&gt;
    |- Total banned:     1&lt;br /&gt;
    `- Banned IP list:   12.23.44.55&lt;br /&gt;
&lt;br /&gt;
To check banned IPs manually in iptables, use '''iptables -n -L f2b-JAILNANE'''&lt;br /&gt;
 [root@node01 ~]# iptables -n -L f2b-ssh-iptables&lt;br /&gt;
 Chain f2b-ssh-iptables (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 REJECT     0    --  12.23.44.55          0.0.0.0/0            reject-with icmp-port-unreachable&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 [root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually unblock the IP from the jail ==&lt;br /&gt;
To unblock IP from the fail2ban chain, use the command '''fail2ban-client set JAILNAME unbanip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
IPs blocked by fail2ban can also be unblocked from the GUI [[Blocked IPs]] menu.&lt;br /&gt;
&lt;br /&gt;
JAILNAME is the name of the jail without f2b- prefix, so if IP is blocked in iptables in f2b-ssh-iptables, we will use jailname without f2b- prefix '''ssh-iptables'''&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Manually block the IP to the jail ==&lt;br /&gt;
To manually add IP to the jail (for testing or other reasons), use the banip command '''fail2ban-client set JAILNAME banip IPADDRESS'''.&lt;br /&gt;
 fail2ban-client set ssh-iptables banip 22.33.44.55&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* To unblock IP from fail2ban chain, use command '''fail2ban-client set JAILNAMEHERE unbanip IPADDRESS'''. It is important to understand that JAILNAME is not the same as fail2ban chain name in iptbales -L output. In all fail2ban jails included in default MOR installation, jail name is the same as jail definition, so you need only remove f2b from chain name. In other words, if IP 12.23.44.55 is blocked under iptables chain '''f2b-ssh-iptables''', then JAILNAME will be '''ssh-iptables'''&lt;br /&gt;
 fail2ban-client set ssh-iptables unbanip 12.23.44.55&lt;br /&gt;
&lt;br /&gt;
'''Important''' If IP is blocked by fail2ban and you will unblock IP using manual iptables commands, after fail2ban restart such IP will be blocked again. To permanently unblock IP, use command above.&lt;br /&gt;
&lt;br /&gt;
== Check active jails ==&lt;br /&gt;
[root@node01 ~]# fail2ban-client status&lt;br /&gt;
Status&lt;br /&gt;
|- Number of jail:      7&lt;br /&gt;
`- Jail list:   ast-cli-attack, ast-hgc-200, asterisk-iptables, asterisk-manager, mor_api, mor_ddos, ssh-iptables&lt;br /&gt;
[root@node01 ~]# &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
To unblock IP from fail2ban chain, use command fail2ban-client set JAILNAMEHERE unbanip IPADDRESS. It is important to understand that JAILNAME is not the same as fail2ban chain name in iptbales -L output. In all fail2ban jails included in default MOR installation, jail name is the same as jail definition, so you need only remove f2b from chain name. In other words, if IP 12.23.44.55 is blocked under iptables chain f2b-ssh-iptables, then JAILNAME will be ssh-iptables&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== See also ==&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_iptables_Chains&amp;diff=30468</id>
		<title>MOR iptables Chains</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_iptables_Chains&amp;diff=30468"/>
		<updated>2025-09-05T06:53:08Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
During the switch install/update, MOR X18 automatically creates iptables chains to manage the security of the switch&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==Whitelist Chains==&lt;br /&gt;
There are two types of whitelist chains:&lt;br /&gt;
Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:&lt;br /&gt;
&lt;br /&gt;
* MOR-IPAUTH-WHITELIST - this chain contains all IP authenticated devices/providers from the MOR system&lt;br /&gt;
* MOR-WHITELIST-GUI -  this chain contains all IPs whitelisted in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt; Whitelisted IPs&lt;br /&gt;
&lt;br /&gt;
Chains that whitelist MOR system's IPs for specific service port(s) (for example, Elasticsearch, MySQL, Redis, etc.), and block access to that service for all other IPs.&lt;br /&gt;
&lt;br /&gt;
Such chains are added into the MOR-SERVICES-WHITELIST chain, which itself, in turn, is referenced in the INPUT chain&lt;br /&gt;
 [root@node01 ~]# iptables -LMOR-SERVICES-WHITELIST -n&lt;br /&gt;
 Chain MOR-SERVICES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 MOR-ES-WHITELIST  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 MOR-MYSQL-WHITELIST  6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3306&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0&lt;br /&gt;
&lt;br /&gt;
Here, for example, MOR-SERVICES-WHITELIST contains two chains:&lt;br /&gt;
* MOR-ES-WHITELIST - whitelist access to Elasticsearch (TCP ports 9200,9300) for the MOR system IPs&lt;br /&gt;
* MOR-MYSQL-WHITELIST - whitelist access to MySQL  (TCP port 3306 ) for the MOR system IPs&lt;br /&gt;
&lt;br /&gt;
Each chain in turn contains whitelisted IPs and a DROP statement at the end:&lt;br /&gt;
 [root@node01 ~]# iptables -LMOR-ES-WHITELIST -n&lt;br /&gt;
 Chain MOR-ES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 ACCEPT     6    --  YY.YY.YY.YY          0.0.0.0/0            multiport dports 9200,9300 /* VIRTUAL_IP from system.conf */&lt;br /&gt;
 ACCEPT     6    --  XX.XX.XX.XX          0.0.0.0/0            multiport dports 9200,9300 /* External IP */&lt;br /&gt;
 ACCEPT     6    --  127.0.0.1            0.0.0.0/0            multiport dports 9200,9300 /* localhost access */&lt;br /&gt;
 DROP       6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== MOR-IPAUTH-WHITELIST and MOR-PRE-WHITELIST ===&lt;br /&gt;
The MOR-IPAUTH-WHITELIST chain contains all IP-authenticated devices/providers from the MOR system and is the first whitelist chain in the INPUT chain. This means that all IP authenticated devices/providers are whitelisted by default. However, some MOR services contain internal data, and access is limited only by iptables and intended only for internal usage of MOR, so IP authenticated devices/providers should NOT be able to access the data of these services. To achieve this, a special MOR-PRE-WHITELIST chain is created and included as the first rule in the MOR-IPAUTH-WHITELIST chain.&lt;br /&gt;
&lt;br /&gt;
MOR-PRE-WHITELIST chain contains chains for services that are limited only by iptables and is used only internally by MOR. Currently, the following chains are included in MOR-PRE-WHITELIST:&lt;br /&gt;
* MOR-ES-WHITELIST (only in servers where Elasticsearch is installed)&lt;br /&gt;
* MOR-REDIS-WHITELIST (only in servers where Redis is installed)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The combination of MOR-IPAUTH-WHITELIST and MOR-PRE-WHITELIST ensures that IP authenticated devices/providers are whitelisted, but they do not have access to the internal MOR services, where access is controlled only by iptables.&lt;br /&gt;
&lt;br /&gt;
In iptables, it looks like this:&lt;br /&gt;
 [root@localhost ~]# iptables -L MOR-IPAUTH-WHITELIST  -n&lt;br /&gt;
 Chain M2-CONNECT-POINTS-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 MOR-PRE-WHITELIST  all  --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 ACCEPT     all  --  a.a.a.a      0.0.0.0/0            /* Domain abc.com */&lt;br /&gt;
 ACCEPT     all  --  b.b.b.b       0.0.0.0/0            &lt;br /&gt;
 ACCEPT     all  --  c.c.c.c        0.0.0.0/0                     &lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
 [root@localhost ~]# iptables -L MOR-PRE-WHITELIST -n&lt;br /&gt;
 Chain MOR-PRE-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 MOR-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 MOR-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0  &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== MOR-FAIL2BAN-JUMP ==&lt;br /&gt;
MOR-FAIL2BAN-JUMP chain contains all chains added by fail2ban. The chain itself is referenced in the INPUT chain. This allows us to ensure proper order in the INPUT chain, as fail2ban adds chains dynamically on the first blocked IP for the jail.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Blacklist chains ==&lt;br /&gt;
MOR can contain 3 blaklist chains:&lt;br /&gt;
* MOR-BLOCKED-IP-FROM-GUI - this chain contains all IPs whitelisted in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt; Whitelisted IPs&lt;br /&gt;
* MOR-BLOCK-SCANNERS - block SIP traffic for known scanners&lt;br /&gt;
* MOR-BLOCKED-COUNTRIES - chain is used when countries are blocked in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt;  Blocked Countries&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Providers&amp;diff=30424</id>
		<title>Providers</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Providers&amp;diff=30424"/>
		<updated>2025-08-25T09:38:31Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Description =&lt;br /&gt;
&lt;br /&gt;
In the old PSTN world, Providers were called Trunks. Providers are your route out of your VoIP network to the outside world.&lt;br /&gt;
&lt;br /&gt;
Providers can be one of several types: ZAP, SIP, IAX2, and H323. The type determines which technology is used to connect to the Provider.&lt;br /&gt;
&lt;br /&gt;
At the very start, you need to create a Provider through which you will dial out to PSTN or other VoIP networks.&lt;br /&gt;
&lt;br /&gt;
Every Provider will charge you for calling a destination through his service (although the rate might be zero). The rate to every destination is different. Because of this, we need to have a Tariff (or Price List) for each Provider. This Tariff will tell our billing what price we will pay to a destination when using this Provider's services. In other words, this will be our Selfcost.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
Go to '''SETTINGS –&amp;gt; Billing –&amp;gt; Providers'''.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:providers_path.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Here you can see a list of all Providers:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:providers_list.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
* Click [[image:add.png]] '''New Provider''' to create new Provider, enter the Name for a new Provider, select its Technology, Tariff, Asterisk server which should be used for this provider and click Create.&lt;br /&gt;
* Click [[image:icon_edit.png]] icon to change settings for old Provider.&lt;br /&gt;
&amp;lt;!---This functionality is available from MOR X4---&amp;gt;&lt;br /&gt;
* Click [[Image:icon_check.png]] icon to disable Provider and it will not be used while it is cross in Active column. It affects only outgoing calls. Incoming calls from this provider will be accepted.&lt;br /&gt;
* Click [[Image:icon_cross.png]] icon to enable Provider if you want to use it again. &lt;br /&gt;
* Click [[Image:icon_vcard.png]] icon to access [[Provider Contact Info]].&lt;br /&gt;
* Click [[Image:icon_list.png]] icon to access [[Provider assigned to LCRs list]].&lt;br /&gt;
NOTE: &lt;br /&gt;
* You can't create a new Provider if there are no Tariffs available for Providers.&lt;br /&gt;
* A Provider is also able to send calls, not just receive them. More info [[Configure Provider which can make calls | here]]. In case you want to sell services to a provider you have to create such a provider.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Settings ==&lt;br /&gt;
&lt;br /&gt;
=== General ===&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:Prov addon.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
* '''Name''' – a name for the provider, for informational purposes.&lt;br /&gt;
* '''Technology''' – out of SIP/IAX2/ZAP/H323, choose which technology your provider uses - that is, the way you connect to the provider.&lt;br /&gt;
* '''DTMF Mode''' – the available options are inband, info, RFC2833, and auto. Choose the one used by your provider.&lt;br /&gt;
* '''Location''' – which Localization rules are set to apply to INCOMING calls COMING FROM this provider.&lt;br /&gt;
* '''Automatic Number Identification''' - used in a special case explained here: [[Provider with ANI]]&lt;br /&gt;
* '''Ringing Timeout''' – this setting lets you set for how long this provider should be dialed before giving up. The default value is 60 seconds, and the minimum value is 30 seconds.&lt;br /&gt;
* '''Call Timeout''' – this setting lets you set the duration of the whole call: ringing and the period after connection. &lt;br /&gt;
* '''Device ID''' – informational data. &lt;br /&gt;
* '''Call limit''' – explained here: [[Simultaneous call limitation]].&lt;br /&gt;
* '''Hidden?''' – [[Hide_provider|hide/unhide provider]]&lt;br /&gt;
&amp;lt;!---This functionality is available from MOR 12---&amp;gt;&lt;br /&gt;
* '''Balance''' – provider balance. Provider balance increases when calls are made via that provider. Currently it is not available to decrease provider's balance. You can read more about [[Provider Billing Addon|Provider Billing Addon here]].&lt;br /&gt;
&amp;lt;!---This functionality is available from MOR x4---&amp;gt;&lt;br /&gt;
* '''Balance limit''' – this is the limit of balance that can be reached by the provider. After he reaches the specified balance, calls aren't sent through this provider anymore.  Balance limit value of zero means that balance is unlimited.&lt;br /&gt;
* '''Responsible Accountant''' – dropdown to choose Provider's responsible accountant.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Tariffs ===&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:Mor_prov_tariffs.png]]&lt;br /&gt;
* '''Default Tariff''' – the list of rates the provider charges you.&lt;br /&gt;
* '''Use Tariffs by CLIs''' – disabled by default. When enabling this option, the system asks to choose tariff and number pool. If CLI is found in the number pool, the provider tariff will be changed to the chosen one.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Authentication ===&lt;br /&gt;
&lt;br /&gt;
==== For ZAP providers ====&lt;br /&gt;
&lt;br /&gt;
* '''Channel''' – which channel (or channel group) to use on a PRI/BRI/PSTN card. Channels and groups should be configured in zapata.conf.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==== For SIP/IAX2 providers ====&lt;br /&gt;
&lt;br /&gt;
* '''Login''' – username if your provider asks for it.&lt;br /&gt;
* '''Password''' – password used for authentication by your provider (characters '''@ : /''' are not allowed when Register option is enabled)&lt;br /&gt;
* '''Authenticate by IP''' – just check the checkbox (Login/Password can be left empty).&lt;br /&gt;
** Make sure you put the correct Hostname/[[IP address]]!&lt;br /&gt;
* '''Register''' – should we register MOR to the provider? (option is not visible when '''Dynamic''' is selected in '''Network related''' section)&lt;br /&gt;
* '''Register extension''' – if the provider asks to use an extension for registration (usually they don't), enter it here.&lt;br /&gt;
&lt;br /&gt;
Explanation of how registration works:&lt;br /&gt;
&lt;br /&gt;
If you want to register '''MOR to the provider''', then enter Login/Password provided by the provider and press the '''Register'''.&lt;br /&gt;
&lt;br /&gt;
If you want to register '''Provider to the MOR''', then enter Login/Password which you will provide to the provider, and select '''Dynamic''' in network settings.&amp;lt;br&amp;gt;&lt;br /&gt;
More details on how to configure Dynamic Provider can be found [[Configure Provider with dynamic IP | here]].&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Provider CallerID ===&lt;br /&gt;
&lt;br /&gt;
'''CallerID''' – consists of two parts: Name and Number. The &amp;quot;Number&amp;quot; part is transferred by default on all technologies (GSM, PSTN, SIP etc), but the &amp;quot;Name&amp;quot; part only on some. The number you see on your mobile phone when someone is calling you is the &amp;quot;Number&amp;quot; part.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:provider_callerid.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
* '''Name''' – the &amp;quot;Name&amp;quot; part of CallerID. Works only on incoming calls.&lt;br /&gt;
* '''Number''' – the &amp;quot;Number&amp;quot; part of CallerID. Works only on incoming calls.&lt;br /&gt;
* '''Random Number from Number Pool''' – the &amp;quot;Number&amp;quot; part of CallerID selected from [[Number Pool]]&lt;br /&gt;
#Random - Send random CallerID.&lt;br /&gt;
#Pseudorandom with Deviation. Range can vary from 0 to 9999999. If 0 is chosen, then all numbers will be chosen same amount of times. If 9999999 is set, then numbers will be completely random.&lt;br /&gt;
* '''Set PAI from CallerID''' – creates PAI header from CallerID and sends to Provider. Also, '''Privacy: id''' header is added. Example:&lt;br /&gt;
 P-Asserted-Identity: &amp;lt;sip:CallerID@host;user=phone&amp;gt;&lt;br /&gt;
 Privacy: id&lt;br /&gt;
* '''Set RPID from CallerID''' – creates RPID header from CallerID and sends to Provider. Also, '''RPID-Privacy: full''' header is added. Example:&lt;br /&gt;
 Remote-Party-ID: &amp;lt;sip:CallerID@host:5060&amp;gt;;privacy=off;screen=yes&lt;br /&gt;
 RPID-Privacy: full&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Network related ===&lt;br /&gt;
&lt;br /&gt;
* '''Hostname''' – hostname of the provider.&lt;br /&gt;
* '''Server IP''' – the provider's IPv4 or IPv6. The value can be &amp;quot;dynamic&amp;quot;, which means that provider can change its IP. To discover this value, do ping to the provider's hostname. Use command &amp;quot;''dig +short''&amp;quot;. Example ''dig +short google.com''.&lt;br /&gt;
* '''Port''' – port used to connect to the provider (default: 5060 for SIP, 4569 for IAX2, 1720 for H323).&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
====H323 specific network settings====&lt;br /&gt;
&lt;br /&gt;
* '''Fast Start''' – an option specific to H323; it is either on or off.&lt;br /&gt;
* '''h245 Tunneling''' – an option specific to H323; it is either on or of&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
====SIP specific network settings====&lt;br /&gt;
&lt;br /&gt;
* '''Media control''' – canreinvite/transfer. Do you want your server to stay in the media path between your clients and your provider? Disable if you have a lot of 1-second answered calls.&lt;br /&gt;
* '''NAT''' – the available options are: yes, no, never, and route. For a detailed explanation of these settings, refer to [http://www.voip-info.org/wiki-Asterisk+sip+nat here].&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
====IAX2 specific network settings====&lt;br /&gt;
&lt;br /&gt;
* '''IAX2 Trunking Mode''' – enable/disable trunking mode, which allows multiple voice streams to share a single &amp;quot;trunk&amp;quot; to another server, reducing overhead created by IP packets. More details [http://wiki.kolmisoft.com/index.php/Trunks here]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
====SIP and IAX2 specific network settings====&lt;br /&gt;
&lt;br /&gt;
* '''Qualify''' – how often to &amp;quot;ask&amp;quot; the provider about availability. More details [http://www.voip-info.org/wiki/view/Asterisk+sip+qualify here] for SIP providers and [http://www.voip-info.org/wiki/view/Asterisk+iax+qualify here] for IAX2 providers.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Blacklist/Whitelist ===&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:MOR_provider_blacklist_whitelist.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Enable static Source - enables a static Blacklist or a Whitelist for source (CallerID).&lt;br /&gt;
* '''No''' - use neither a Blacklist nor a Whitelist.&lt;br /&gt;
* '''Blacklist''' - set a [[Number Pool]] which is used to block a Provider from receiving specific Source Numbers. When a Source Number (RPID and PAI headers included) is found within a selected [[Number Pool]] this Provider is skipped with a Hangupcause Code ''272''.&lt;br /&gt;
* '''Whitelist''' - set a [[Number Pool]] which is used to allow a Provider to receive only specific Source numbers. When a Source Number (RPID and PAI headers included) is NOT found within a selected [[Number Pool]] this Provider is skipped with a Hangupcause Code ''273''.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Enable static Destination - enables a static Blacklist or a Whitelist for Destination.&lt;br /&gt;
* '''No''' - use neither a Blacklist nor a Whitelist.&lt;br /&gt;
* '''Blacklist''' - set a [[Number Pool]] which is used to block a Provider from sending to specific Destination. When a Destination Number is found within a selected [[Number Pool]] this Provider is skipped with a Hangupcause Code ''281''.&lt;br /&gt;
* '''Whitelist''' - set a [[Number Pool]] which is used to allow a Provider to send only specific Destination. When a Destination Number is NOT found within a selected [[Number Pool]] this Provider is skipped with a Hangupcause Code ''282''.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Servers ===&lt;br /&gt;
Allows to select on which Asterisk servers this provider should be used. It affects outgoing calls only.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Codecs ===&lt;br /&gt;
&lt;br /&gt;
Choose the codecs your provider uses.&lt;br /&gt;
&lt;br /&gt;
NOTE: When no fields are checked, all codecs are available. ([[Image:asterisk_icon.png]] For example, settings in sip.conf or iax.conf are effective).&lt;br /&gt;
&lt;br /&gt;
* '''Enforce same codec as on Leg A''' - this option takes effect only when Device/Provider is used as Terminator. When this option is enabled, system checks what codec is used on Leg A. Then if Leg A codec matches one of codec enabled on Codecs list, system enforces callee to use that codec, by offering only that single codec in SDP data.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== Advanced ===&lt;br /&gt;
&lt;br /&gt;
* '''Grace time''' – if call duration is less than &amp;lt;i&amp;gt;Grace Time&amp;lt;/i&amp;gt;, it will not be accounted.&lt;br /&gt;
* Progressinband:&lt;br /&gt;
**yes – when &amp;quot;RING&amp;quot; event is requested, always send 180 Ringing (if it hasn't been sent yet) followed by 183 Session Progress and in-band audio.&lt;br /&gt;
**no – send 180 Ringing if 183 has not yet been sent, establishing an audio path. If the audio path is established already (with 183), then send in-band ringing (this is the way Asterisk historically behaved because of buggy phones like Polycom's).&lt;br /&gt;
**never – whenever ringing occurs, send &amp;quot;180 ringing&amp;quot; as long as &amp;quot;200 OK&amp;quot; has not yet been sent. This is the default behavior of Asterisk.&lt;br /&gt;
* '''Video support''' – does your provider support Video over IP? More info [http://www.voip-info.org/wiki/view/Asterisk+video here].&lt;br /&gt;
* '''[[Duplicate call prevention | Allow duplicate calls]]''' – the default setting is &amp;quot;no&amp;quot;.&lt;br /&gt;
* '''Interpret NO ANSWER as FAILED''' – default option is no (This will change the provider in LCR like it is failed, in last calls you will see&lt;br /&gt;
the real hangupcause – no answer)&lt;br /&gt;
* '''Interpret BUSY as FAILED''' – default option is no (This will change the provider in LCR like it is failed, in last calls you will see&lt;br /&gt;
the real hangupcause – busy)&lt;br /&gt;
* '''Fake Ring''' – should system generate Fake Ring or not? Use only if your Device/Provider has bad protocol implementation and does not send the RING signal properly.&lt;br /&gt;
* '''Common Use''' – Provider can be used by Resellers which are able to create their own Providers. The reseller will be billed using this Provider. If the provider is marked as common use and is used in one of reseller's LCR or is in Terminators list - admin is not allowed to delete this provider or remove common use option.&lt;br /&gt;
* '''Anti-resale (Auto-answer)''' – when the option is set to YES, MOR answers the call before sending it to the provider in order to generate FAS. Work only when the provider is the originator of the call. This option does not affect billing.&lt;br /&gt;
* '''Anti-resale (Auto-answer) Sound file''' - this setting is visible when the Anti-resale (Auto-answer) is set to '''Yes''' only.&lt;br /&gt;
* '''Transport''' – lets you choose protocol &amp;lt;nowiki&amp;gt;[tcp, udp]&amp;lt;/nowiki&amp;gt; for data transfer. Appears only if Provider is SIP and when Asterisk 1.8 is enabled. Default value: ''udp''. If TCP is used, it has to be [[How_to_enable_TCP_for_Asterisk |enabled in Asterisk]].&lt;br /&gt;
* '''Time limit per day''' - Total time available for provider per day. When limit is reached, call fails with HGC &amp;quot;238 - Provider used its daily call time limit&amp;quot; and another provider in LCR is used (total time is calculated after rounding rules and minimal time adjustment, so if your provider tariff has increment higher than 1 or minimal time set, then total provider time may be different than actual call time). Only available with Provider Billing addon. '''Used minutes are calculated using the server timezone'''.&lt;br /&gt;
* '''Time limit per month''' - Total time available for provider per month in minutes. You can also set day of limit reset (default is 1st day of the month). When limit is reached, call fails with HGC &amp;quot;285 - Provider used its monthly call time limit&amp;quot; and another provider in LCR is used (total time is calculated after rounding rules and minimal time adjustment, so if your provider tariff has increment higher than 1 or minimal time set, then total provider time may be different than actual call time). Only available with Provider Billing addon. '''Used minutes are calculated using the server timezone'''.&lt;br /&gt;
* '''Limit up to X, during Y seconds''' – you can set a limit how many calls (X) can be done in some interval of seconds (Y). [[Last Calls]] will show '''FAILED([[Hangupcause Codes |243]])'''.&lt;br /&gt;
* '''Execute AGI script''' - Execute custom AGI script. More info [http://wiki.kolmisoft.com/index.php/Provider_AGI_script here].&lt;br /&gt;
* '''STIR/SHAKEN Attestation''' - [https://wiki.kolmisoft.com/index.php/MOR_STIR/SHAKEN#Device/Provider_configuration STIR/SHAKEN] attestation level when calling to this Provider. Only available in PJSIP Providers.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Recordings===&lt;br /&gt;
&lt;br /&gt;
This section is available when [[Recordings Addon]] is installed in the system.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== SIP Specific ===&lt;br /&gt;
&lt;br /&gt;
* '''Fromuser''' – [http://www.voip-info.org/wiki/index.php?page=Asterisk+sip+fromuser  more details]&lt;br /&gt;
* '''Fromdomain''' – [http://www.voip-info.org/wiki/index.php?page=Asterisk+sip+fromuser  more details]&lt;br /&gt;
* '''Trustrpid''' – This defines whether or not Remote-Party-ID is trusted. It's defined in http://tools.ietf.org/id/draft-ietf-sip-privacy-04.txt&lt;br /&gt;
* '''Sendrpid''' – defines whether a Remote-Party-ID SIP header should be sent. It defaults to &amp;quot;No&amp;quot;. This field is often used by wholesale VoIP providers to provide calling party identity regardless of the privacy settings (the From SIP header). &lt;br /&gt;
* '''Insecure''' – [http://www.voip-info.org/wiki/index.php?page=Asterisk+sip+insecure  more details]&lt;br /&gt;
* '''T.38 Support''' – should we support T.38 pass-through?&lt;br /&gt;
* '''SIP Session Timers''' - SIP Session Timers provide an end-to-end keep-alive mechanism for active SIP sessions (more info [http://doxygen.asterisk.org/trunk/sip_session_timers.html here]). Possible values are &amp;quot;accept&amp;quot;, &amp;quot;originate&amp;quot;, &amp;quot;refuse&amp;quot;:&lt;br /&gt;
** '''originate''' - request and run session-timers always.&lt;br /&gt;
** '''accept''' - run session-timers only when requested by other UA.&lt;br /&gt;
** '''refuse''' - do not run session timers in any case.&lt;br /&gt;
* '''SIP Session Refresher''' - The session refresher (uac|uas). Defaults to 'uas'.&lt;br /&gt;
** '''uac''' - default to the caller initially refreshing when possible.&lt;br /&gt;
** '''uas''' - default to the callee initially refreshing when possible.&lt;br /&gt;
* '''SIP Session Expires''' - maximum session refresh interval in seconds. Defaults to 1800 secs. &lt;br /&gt;
* '''SIP Min Session''' - minimum session refresh interval in seconds. Defaults to 90 secs.&lt;br /&gt;
* '''[[SIP 302 Reinvite Support]]''' – turns this SIP feature on or off. &lt;br /&gt;
* '''P-Asserted-Identity usage''' – The P-Asserted-Identity header field can be used to convey the proven identity of the originator of a request within a trusted network. If pass_pai =0 in [http://wiki.kolmisoft.com/index.php/Mor.conf Mor.conf] and PAI usage in provider settings =1, then core will add PAI header.&lt;br /&gt;
* '''Periodic check''' - if enabled, periodic SIP OPTIONS requests will be sent to Provider to check if it is reachable. If Periodic Check is enabled and Provider does not respond to OPTIONS request then Provider will be marked as unreachable and will be skipped when making Calls. Once Provider starts to respond to OPTIONS request it will be marked as reachable and Calls will be routed through this Provider. Providers are checked every 5 minutes. Options packets are sent from IP address defined in /etc/asterisk/sip.conf. Some Providers may not respond to OPTIONS even they are Online. If you are getting HGC 247 on attempts to call a Provider that is online, disable this option.&lt;br /&gt;
* '''[http://wiki.kolmisoft.com/index.php/Mobile_Number_Portability_Addon#MNP_tags_in_SIP_INVITE Enable MNP tags]''' - adds MNP tags in SIP INVITE requests (if MNP is configured).&lt;br /&gt;
* '''Localize PAI''' - applies [[Provider_Rules#CallerID_Rules|Provider rules Source]] on PAI header for calls that are terminated by this Provider.&lt;br /&gt;
* '''Pass PAI''' - available options are 'Global', 'Yes', 'No'. Global (default value) means use value from  pass_pai in [[mor.conf]] file. More information available in table [[P-Asserted-Identity#How_P-Asserted-Identity_.28PAI.29_is_handled_in_MOR_X11_and_later_versions|here]].&lt;br /&gt;
* '''PAI Transformation''' - PAI Transformation. More info [https://wiki.kolmisoft.com/index.php/MOR_SIP_Header_Transformations here].&lt;br /&gt;
* '''Usereqphone''' - Yes or No. The default setting is &amp;quot;No&amp;quot;. Option adds ;user=phone in From, To, INVITE and PAI headers.&lt;br /&gt;
* '''Custom SIP Header''' - adds custom header to SIP request. Format is '''header: value''' (for example '''x-My-Custom-Header: my value''')&lt;br /&gt;
* '''Custom Destination Header''' - allows to read Destination number from specific SIP header (for example x-DID: 123) instead of SIP URI.&lt;br /&gt;
* '''Privacy CallerID''' - allows to change CallerID (From: &amp;lt;sip:'''xxxxxx'''@yyyyyyy&amp;gt;) when originator sends '''Privacy: id''' or '''Privacy: header'''. If originator does not send '''Privacy: id''' or '''Privacy: header''' or '''Privacy CallerID''' is empty, then SIP From header will not be modified. This option would only work on outbound calls terminated by this Provider.&lt;br /&gt;
* '''Privacy From Domain''' - allows to change Domain (From: &amp;lt;sip:xxxxxx@'''yyyyyyy'''&amp;gt;) when originator sends '''Privacy: id''' or '''Privacy: header'''. If originator does not send '''Privacy: id''' or '''Privacy: header''' or '''Privacy From Domain''' is empty, then SIP From header will not be modified.&lt;br /&gt;
* '''Playback before dial''' - allows to play selected sound file to originator before dialing to Provider. Select 'none' to disable this feature.&lt;br /&gt;
* '''Playback before dial mode''' - controls how '''Playback before dial''' handles media.&lt;br /&gt;
** '''Early media''' - uses '''183 Session Progress''' to send audio to originator. This is preferred way of sending media to originator since it does not require legA call to be answered. One drawback is that not all providers resend SIP 183 early media correctly. In those cases originator will hear silence.&lt;br /&gt;
** '''Answer and play''' - if this mode is selected, then '''MOR will answer legA''' and play media to originator. This way originator should always hear media but there are various drawbacks since legA is already answered. One of drawbacks is that MOR will generate false answer if Provider rejects call. Use this mode only if you know what you are doing.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== VIDEO: How to create Provider ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;html&amp;gt;&lt;br /&gt;
 &amp;lt;iframe width=&amp;quot;640&amp;quot; height=&amp;quot;360&amp;quot; src=&amp;quot;https://www.youtube.com/embed/S7DHLOOMBUs&amp;quot; frameborder=&amp;quot;0&amp;quot;&amp;gt;&amp;lt;/iframe&amp;gt; &lt;br /&gt;
&amp;lt;/html&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[H323 Provider settings]]&lt;br /&gt;
* [[Quick Providers changes]]&lt;br /&gt;
* [[Providers Statistics]]&lt;br /&gt;
* [[NO ANSWER/BUSY interpretation for providers]]&lt;br /&gt;
* [[I have a problem with Provider]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Providers&amp;diff=30423</id>
		<title>Providers</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Providers&amp;diff=30423"/>
		<updated>2025-08-25T09:35:43Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Description =&lt;br /&gt;
&lt;br /&gt;
In the old PSTN world, Providers were called Trunks. Providers are your route out of your VoIP network to the outside world.&lt;br /&gt;
&lt;br /&gt;
Providers can be one of several types: ZAP, SIP, IAX2, and H323. The type determines which technology is used to connect to the Provider.&lt;br /&gt;
&lt;br /&gt;
At the very start, you need to create a Provider through which you will dial out to PSTN or other VoIP networks.&lt;br /&gt;
&lt;br /&gt;
Every Provider will charge you for calling a destination through his service (although the rate might be zero). The rate to every destination is different. Because of this, we need to have a Tariff (or Price List) for each Provider. This Tariff will tell our billing what price we will pay to a destination when using this Provider's services. In other words, this will be our Selfcost.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
Go to '''SETTINGS –&amp;gt; Billing –&amp;gt; Providers'''.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:providers_path.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Here you can see a list of all Providers:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:providers_list.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
* Click [[image:add.png]] '''New Provider''' to create new Provider, enter the Name for a new Provider, select its Technology, Tariff, Asterisk server which should be used for this provider and click Create.&lt;br /&gt;
* Click [[image:icon_edit.png]] icon to change settings for old Provider.&lt;br /&gt;
&amp;lt;!---This functionality is available from MOR X4---&amp;gt;&lt;br /&gt;
* Click [[Image:icon_check.png]] icon to disable Provider and it will not be used while it is cross in Active column. It affects only outgoing calls. Incoming calls from this provider will be accepted.&lt;br /&gt;
* Click [[Image:icon_cross.png]] icon to enable Provider if you want to use it again. &lt;br /&gt;
* Click [[Image:icon_vcard.png]] icon to access [[Provider Contact Info]].&lt;br /&gt;
* Click [[Image:icon_list.png]] icon to access [[Provider assigned to LCRs list]].&lt;br /&gt;
NOTE: &lt;br /&gt;
* You can't create a new Provider if there are no Tariffs available for Providers.&lt;br /&gt;
* A Provider is also able to send calls, not just receive them. More info [[Configure Provider which can make calls | here]]. In case you want to sell services to a provider you have to create such a provider.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Settings ==&lt;br /&gt;
&lt;br /&gt;
=== General ===&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:Prov addon.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
* '''Name''' – a name for the provider, for informational purposes.&lt;br /&gt;
* '''Technology''' – out of SIP/IAX2/ZAP/H323, choose which technology your provider uses - that is, the way you connect to the provider.&lt;br /&gt;
* '''DTMF Mode''' – the available options are inband, info, RFC2833, and auto. Choose the one used by your provider.&lt;br /&gt;
* '''Location''' – which Localization rules are set to apply to INCOMING calls COMING FROM this provider.&lt;br /&gt;
* '''Automatic Number Identification''' - used in a special case explained here: [[Provider with ANI]]&lt;br /&gt;
* '''Ringing Timeout''' – this setting lets you set for how long this provider should be dialed before giving up. The default value is 60 seconds, and the minimum value is 30 seconds.&lt;br /&gt;
* '''Call Timeout''' – this setting lets you set the duration of the whole call: ringing and the period after connection. &lt;br /&gt;
* '''Device ID''' – informational data. &lt;br /&gt;
* '''Call limit''' – explained here: [[Simultaneous call limitation]].&lt;br /&gt;
* '''Hidden?''' – [[Hide_provider|hide/unhide provider]]&lt;br /&gt;
&amp;lt;!---This functionality is available from MOR 12---&amp;gt;&lt;br /&gt;
* '''Balance''' – provider balance. Provider balance increases when calls are made via that provider. Currently it is not available to decrease provider's balance. You can read more about [[Provider Billing Addon|Provider Billing Addon here]].&lt;br /&gt;
&amp;lt;!---This functionality is available from MOR x4---&amp;gt;&lt;br /&gt;
* '''Balance limit''' – this is the limit of balance that can be reached by the provider. After he reaches the specified balance, calls aren't sent through this provider anymore.  Balance limit value of zero means that balance is unlimited.&lt;br /&gt;
* '''Responsible Accountant''' – dropdown to choose Provider's responsible accountant.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Tariffs ===&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:Mor_prov_tariffs.png]]&lt;br /&gt;
* '''Default Tariff''' – the list of rates the provider charges you.&lt;br /&gt;
* '''Use Tariffs by CLIs''' – disabled by default. When enabling this option, the system asks to choose tariff and number pool. If CLI is found in the number pool, the provider tariff will be changed to the chosen one.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Authentication ===&lt;br /&gt;
&lt;br /&gt;
==== For ZAP providers ====&lt;br /&gt;
&lt;br /&gt;
* '''Channel''' – which channel (or channel group) to use on a PRI/BRI/PSTN card. Channels and groups should be configured in zapata.conf.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==== For SIP/IAX2 providers ====&lt;br /&gt;
&lt;br /&gt;
* '''Login''' – username if your provider asks for it.&lt;br /&gt;
* '''Password''' – password used for authentication by your provider (characters '''@ : /''' are not allowed when Register option is enabled)&lt;br /&gt;
* '''Authenticate by IP''' – just check the checkbox (Login/Password can be left empty).&lt;br /&gt;
** Make sure you put the correct Hostname/[[IP address]]!&lt;br /&gt;
* '''Register''' – should we register MOR to the provider? (option is not visible when '''Dynamic''' is selected in '''Network related''' section)&lt;br /&gt;
* '''Register extension''' – if the provider asks to use an extension for registration (usually they don't), enter it here.&lt;br /&gt;
&lt;br /&gt;
Explanation of how registration works:&lt;br /&gt;
&lt;br /&gt;
If you want to register '''MOR to the provider''', then enter Login/Password provided by the provider and press the '''Register'''.&lt;br /&gt;
&lt;br /&gt;
If you want to register '''Provider to the MOR''', then enter Login/Password which you will provide to the provider, and select '''Dynamic''' in network settings.&amp;lt;br&amp;gt;&lt;br /&gt;
More details on how to configure Dynamic Provider can be found [[Configure Provider with dynamic IP | here]].&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Provider CallerID ===&lt;br /&gt;
&lt;br /&gt;
'''CallerID''' – consists of two parts: Name and Number. The &amp;quot;Number&amp;quot; part is transferred by default on all technologies (GSM, PSTN, SIP etc), but the &amp;quot;Name&amp;quot; part only on some. The number you see on your mobile phone when someone is calling you is the &amp;quot;Number&amp;quot; part.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:provider_callerid.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
* '''Name''' – the &amp;quot;Name&amp;quot; part of CallerID. Works only on incoming calls.&lt;br /&gt;
* '''Number''' – the &amp;quot;Number&amp;quot; part of CallerID. Works only on incoming calls.&lt;br /&gt;
* '''Random Number from Number Pool''' – the &amp;quot;Number&amp;quot; part of CallerID selected from [[Number Pool]]&lt;br /&gt;
#Random - Send random CallerID.&lt;br /&gt;
#Pseudorandom with Deviation. Range can vary from 0 to 9999999. If 0 is chosen, then all numbers will be chosen same amount of times. If 9999999 is set, then numbers will be completely random.&lt;br /&gt;
* '''Set PAI from CallerID''' – creates PAI header from CallerID and sends to Provider. Example:&lt;br /&gt;
 P-Asserted-Identity: &amp;lt;sip:CallerID@host;user=phone&amp;gt;&lt;br /&gt;
 Privacy: id&lt;br /&gt;
* '''Set RPID from CallerID''' – creates RPID header from CallerID and sends to Provider. Example:&lt;br /&gt;
 RPID-Privacy: full&lt;br /&gt;
 Remote-Party-ID: &amp;lt;sip:CallerID@host:5060&amp;gt;;privacy=off;screen=yes&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Network related ===&lt;br /&gt;
&lt;br /&gt;
* '''Hostname''' – hostname of the provider.&lt;br /&gt;
* '''Server IP''' – the provider's IPv4 or IPv6. The value can be &amp;quot;dynamic&amp;quot;, which means that provider can change its IP. To discover this value, do ping to the provider's hostname. Use command &amp;quot;''dig +short''&amp;quot;. Example ''dig +short google.com''.&lt;br /&gt;
* '''Port''' – port used to connect to the provider (default: 5060 for SIP, 4569 for IAX2, 1720 for H323).&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
====H323 specific network settings====&lt;br /&gt;
&lt;br /&gt;
* '''Fast Start''' – an option specific to H323; it is either on or off.&lt;br /&gt;
* '''h245 Tunneling''' – an option specific to H323; it is either on or of&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
====SIP specific network settings====&lt;br /&gt;
&lt;br /&gt;
* '''Media control''' – canreinvite/transfer. Do you want your server to stay in the media path between your clients and your provider? Disable if you have a lot of 1-second answered calls.&lt;br /&gt;
* '''NAT''' – the available options are: yes, no, never, and route. For a detailed explanation of these settings, refer to [http://www.voip-info.org/wiki-Asterisk+sip+nat here].&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
====IAX2 specific network settings====&lt;br /&gt;
&lt;br /&gt;
* '''IAX2 Trunking Mode''' – enable/disable trunking mode, which allows multiple voice streams to share a single &amp;quot;trunk&amp;quot; to another server, reducing overhead created by IP packets. More details [http://wiki.kolmisoft.com/index.php/Trunks here]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
====SIP and IAX2 specific network settings====&lt;br /&gt;
&lt;br /&gt;
* '''Qualify''' – how often to &amp;quot;ask&amp;quot; the provider about availability. More details [http://www.voip-info.org/wiki/view/Asterisk+sip+qualify here] for SIP providers and [http://www.voip-info.org/wiki/view/Asterisk+iax+qualify here] for IAX2 providers.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Blacklist/Whitelist ===&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:MOR_provider_blacklist_whitelist.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Enable static Source - enables a static Blacklist or a Whitelist for source (CallerID).&lt;br /&gt;
* '''No''' - use neither a Blacklist nor a Whitelist.&lt;br /&gt;
* '''Blacklist''' - set a [[Number Pool]] which is used to block a Provider from receiving specific Source Numbers. When a Source Number (RPID and PAI headers included) is found within a selected [[Number Pool]] this Provider is skipped with a Hangupcause Code ''272''.&lt;br /&gt;
* '''Whitelist''' - set a [[Number Pool]] which is used to allow a Provider to receive only specific Source numbers. When a Source Number (RPID and PAI headers included) is NOT found within a selected [[Number Pool]] this Provider is skipped with a Hangupcause Code ''273''.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Enable static Destination - enables a static Blacklist or a Whitelist for Destination.&lt;br /&gt;
* '''No''' - use neither a Blacklist nor a Whitelist.&lt;br /&gt;
* '''Blacklist''' - set a [[Number Pool]] which is used to block a Provider from sending to specific Destination. When a Destination Number is found within a selected [[Number Pool]] this Provider is skipped with a Hangupcause Code ''281''.&lt;br /&gt;
* '''Whitelist''' - set a [[Number Pool]] which is used to allow a Provider to send only specific Destination. When a Destination Number is NOT found within a selected [[Number Pool]] this Provider is skipped with a Hangupcause Code ''282''.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Servers ===&lt;br /&gt;
Allows to select on which Asterisk servers this provider should be used. It affects outgoing calls only.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Codecs ===&lt;br /&gt;
&lt;br /&gt;
Choose the codecs your provider uses.&lt;br /&gt;
&lt;br /&gt;
NOTE: When no fields are checked, all codecs are available. ([[Image:asterisk_icon.png]] For example, settings in sip.conf or iax.conf are effective).&lt;br /&gt;
&lt;br /&gt;
* '''Enforce same codec as on Leg A''' - this option takes effect only when Device/Provider is used as Terminator. When this option is enabled, system checks what codec is used on Leg A. Then if Leg A codec matches one of codec enabled on Codecs list, system enforces callee to use that codec, by offering only that single codec in SDP data.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== Advanced ===&lt;br /&gt;
&lt;br /&gt;
* '''Grace time''' – if call duration is less than &amp;lt;i&amp;gt;Grace Time&amp;lt;/i&amp;gt;, it will not be accounted.&lt;br /&gt;
* Progressinband:&lt;br /&gt;
**yes – when &amp;quot;RING&amp;quot; event is requested, always send 180 Ringing (if it hasn't been sent yet) followed by 183 Session Progress and in-band audio.&lt;br /&gt;
**no – send 180 Ringing if 183 has not yet been sent, establishing an audio path. If the audio path is established already (with 183), then send in-band ringing (this is the way Asterisk historically behaved because of buggy phones like Polycom's).&lt;br /&gt;
**never – whenever ringing occurs, send &amp;quot;180 ringing&amp;quot; as long as &amp;quot;200 OK&amp;quot; has not yet been sent. This is the default behavior of Asterisk.&lt;br /&gt;
* '''Video support''' – does your provider support Video over IP? More info [http://www.voip-info.org/wiki/view/Asterisk+video here].&lt;br /&gt;
* '''[[Duplicate call prevention | Allow duplicate calls]]''' – the default setting is &amp;quot;no&amp;quot;.&lt;br /&gt;
* '''Interpret NO ANSWER as FAILED''' – default option is no (This will change the provider in LCR like it is failed, in last calls you will see&lt;br /&gt;
the real hangupcause – no answer)&lt;br /&gt;
* '''Interpret BUSY as FAILED''' – default option is no (This will change the provider in LCR like it is failed, in last calls you will see&lt;br /&gt;
the real hangupcause – busy)&lt;br /&gt;
* '''Fake Ring''' – should system generate Fake Ring or not? Use only if your Device/Provider has bad protocol implementation and does not send the RING signal properly.&lt;br /&gt;
* '''Common Use''' – Provider can be used by Resellers which are able to create their own Providers. The reseller will be billed using this Provider. If the provider is marked as common use and is used in one of reseller's LCR or is in Terminators list - admin is not allowed to delete this provider or remove common use option.&lt;br /&gt;
* '''Anti-resale (Auto-answer)''' – when the option is set to YES, MOR answers the call before sending it to the provider in order to generate FAS. Work only when the provider is the originator of the call. This option does not affect billing.&lt;br /&gt;
* '''Anti-resale (Auto-answer) Sound file''' - this setting is visible when the Anti-resale (Auto-answer) is set to '''Yes''' only.&lt;br /&gt;
* '''Transport''' – lets you choose protocol &amp;lt;nowiki&amp;gt;[tcp, udp]&amp;lt;/nowiki&amp;gt; for data transfer. Appears only if Provider is SIP and when Asterisk 1.8 is enabled. Default value: ''udp''. If TCP is used, it has to be [[How_to_enable_TCP_for_Asterisk |enabled in Asterisk]].&lt;br /&gt;
* '''Time limit per day''' - Total time available for provider per day. When limit is reached, call fails with HGC &amp;quot;238 - Provider used its daily call time limit&amp;quot; and another provider in LCR is used (total time is calculated after rounding rules and minimal time adjustment, so if your provider tariff has increment higher than 1 or minimal time set, then total provider time may be different than actual call time). Only available with Provider Billing addon. '''Used minutes are calculated using the server timezone'''.&lt;br /&gt;
* '''Time limit per month''' - Total time available for provider per month in minutes. You can also set day of limit reset (default is 1st day of the month). When limit is reached, call fails with HGC &amp;quot;285 - Provider used its monthly call time limit&amp;quot; and another provider in LCR is used (total time is calculated after rounding rules and minimal time adjustment, so if your provider tariff has increment higher than 1 or minimal time set, then total provider time may be different than actual call time). Only available with Provider Billing addon. '''Used minutes are calculated using the server timezone'''.&lt;br /&gt;
* '''Limit up to X, during Y seconds''' – you can set a limit how many calls (X) can be done in some interval of seconds (Y). [[Last Calls]] will show '''FAILED([[Hangupcause Codes |243]])'''.&lt;br /&gt;
* '''Execute AGI script''' - Execute custom AGI script. More info [http://wiki.kolmisoft.com/index.php/Provider_AGI_script here].&lt;br /&gt;
* '''STIR/SHAKEN Attestation''' - [https://wiki.kolmisoft.com/index.php/MOR_STIR/SHAKEN#Device/Provider_configuration STIR/SHAKEN] attestation level when calling to this Provider. Only available in PJSIP Providers.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===Recordings===&lt;br /&gt;
&lt;br /&gt;
This section is available when [[Recordings Addon]] is installed in the system.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== SIP Specific ===&lt;br /&gt;
&lt;br /&gt;
* '''Fromuser''' – [http://www.voip-info.org/wiki/index.php?page=Asterisk+sip+fromuser  more details]&lt;br /&gt;
* '''Fromdomain''' – [http://www.voip-info.org/wiki/index.php?page=Asterisk+sip+fromuser  more details]&lt;br /&gt;
* '''Trustrpid''' – This defines whether or not Remote-Party-ID is trusted. It's defined in http://tools.ietf.org/id/draft-ietf-sip-privacy-04.txt&lt;br /&gt;
* '''Sendrpid''' – defines whether a Remote-Party-ID SIP header should be sent. It defaults to &amp;quot;No&amp;quot;. This field is often used by wholesale VoIP providers to provide calling party identity regardless of the privacy settings (the From SIP header). &lt;br /&gt;
* '''Insecure''' – [http://www.voip-info.org/wiki/index.php?page=Asterisk+sip+insecure  more details]&lt;br /&gt;
* '''T.38 Support''' – should we support T.38 pass-through?&lt;br /&gt;
* '''SIP Session Timers''' - SIP Session Timers provide an end-to-end keep-alive mechanism for active SIP sessions (more info [http://doxygen.asterisk.org/trunk/sip_session_timers.html here]). Possible values are &amp;quot;accept&amp;quot;, &amp;quot;originate&amp;quot;, &amp;quot;refuse&amp;quot;:&lt;br /&gt;
** '''originate''' - request and run session-timers always.&lt;br /&gt;
** '''accept''' - run session-timers only when requested by other UA.&lt;br /&gt;
** '''refuse''' - do not run session timers in any case.&lt;br /&gt;
* '''SIP Session Refresher''' - The session refresher (uac|uas). Defaults to 'uas'.&lt;br /&gt;
** '''uac''' - default to the caller initially refreshing when possible.&lt;br /&gt;
** '''uas''' - default to the callee initially refreshing when possible.&lt;br /&gt;
* '''SIP Session Expires''' - maximum session refresh interval in seconds. Defaults to 1800 secs. &lt;br /&gt;
* '''SIP Min Session''' - minimum session refresh interval in seconds. Defaults to 90 secs.&lt;br /&gt;
* '''[[SIP 302 Reinvite Support]]''' – turns this SIP feature on or off. &lt;br /&gt;
* '''P-Asserted-Identity usage''' – The P-Asserted-Identity header field can be used to convey the proven identity of the originator of a request within a trusted network. If pass_pai =0 in [http://wiki.kolmisoft.com/index.php/Mor.conf Mor.conf] and PAI usage in provider settings =1, then core will add PAI header.&lt;br /&gt;
* '''Periodic check''' - if enabled, periodic SIP OPTIONS requests will be sent to Provider to check if it is reachable. If Periodic Check is enabled and Provider does not respond to OPTIONS request then Provider will be marked as unreachable and will be skipped when making Calls. Once Provider starts to respond to OPTIONS request it will be marked as reachable and Calls will be routed through this Provider. Providers are checked every 5 minutes. Options packets are sent from IP address defined in /etc/asterisk/sip.conf. Some Providers may not respond to OPTIONS even they are Online. If you are getting HGC 247 on attempts to call a Provider that is online, disable this option.&lt;br /&gt;
* '''[http://wiki.kolmisoft.com/index.php/Mobile_Number_Portability_Addon#MNP_tags_in_SIP_INVITE Enable MNP tags]''' - adds MNP tags in SIP INVITE requests (if MNP is configured).&lt;br /&gt;
* '''Localize PAI''' - applies [[Provider_Rules#CallerID_Rules|Provider rules Source]] on PAI header for calls that are terminated by this Provider.&lt;br /&gt;
* '''Pass PAI''' - available options are 'Global', 'Yes', 'No'. Global (default value) means use value from  pass_pai in [[mor.conf]] file. More information available in table [[P-Asserted-Identity#How_P-Asserted-Identity_.28PAI.29_is_handled_in_MOR_X11_and_later_versions|here]].&lt;br /&gt;
* '''PAI Transformation''' - PAI Transformation. More info [https://wiki.kolmisoft.com/index.php/MOR_SIP_Header_Transformations here].&lt;br /&gt;
* '''Usereqphone''' - Yes or No. The default setting is &amp;quot;No&amp;quot;. Option adds ;user=phone in From, To, INVITE and PAI headers.&lt;br /&gt;
* '''Custom SIP Header''' - adds custom header to SIP request. Format is '''header: value''' (for example '''x-My-Custom-Header: my value''')&lt;br /&gt;
* '''Custom Destination Header''' - allows to read Destination number from specific SIP header (for example x-DID: 123) instead of SIP URI.&lt;br /&gt;
* '''Privacy CallerID''' - allows to change CallerID (From: &amp;lt;sip:'''xxxxxx'''@yyyyyyy&amp;gt;) when originator sends '''Privacy: id''' or '''Privacy: header'''. If originator does not send '''Privacy: id''' or '''Privacy: header''' or '''Privacy CallerID''' is empty, then SIP From header will not be modified. This option would only work on outbound calls terminated by this Provider.&lt;br /&gt;
* '''Privacy From Domain''' - allows to change Domain (From: &amp;lt;sip:xxxxxx@'''yyyyyyy'''&amp;gt;) when originator sends '''Privacy: id''' or '''Privacy: header'''. If originator does not send '''Privacy: id''' or '''Privacy: header''' or '''Privacy From Domain''' is empty, then SIP From header will not be modified.&lt;br /&gt;
* '''Playback before dial''' - allows to play selected sound file to originator before dialing to Provider. Select 'none' to disable this feature.&lt;br /&gt;
* '''Playback before dial mode''' - controls how '''Playback before dial''' handles media.&lt;br /&gt;
** '''Early media''' - uses '''183 Session Progress''' to send audio to originator. This is preferred way of sending media to originator since it does not require legA call to be answered. One drawback is that not all providers resend SIP 183 early media correctly. In those cases originator will hear silence.&lt;br /&gt;
** '''Answer and play''' - if this mode is selected, then '''MOR will answer legA''' and play media to originator. This way originator should always hear media but there are various drawbacks since legA is already answered. One of drawbacks is that MOR will generate false answer if Provider rejects call. Use this mode only if you know what you are doing.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== VIDEO: How to create Provider ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;html&amp;gt;&lt;br /&gt;
 &amp;lt;iframe width=&amp;quot;640&amp;quot; height=&amp;quot;360&amp;quot; src=&amp;quot;https://www.youtube.com/embed/S7DHLOOMBUs&amp;quot; frameborder=&amp;quot;0&amp;quot;&amp;gt;&amp;lt;/iframe&amp;gt; &lt;br /&gt;
&amp;lt;/html&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[H323 Provider settings]]&lt;br /&gt;
* [[Quick Providers changes]]&lt;br /&gt;
* [[Providers Statistics]]&lt;br /&gt;
* [[NO ANSWER/BUSY interpretation for providers]]&lt;br /&gt;
* [[I have a problem with Provider]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=M4_Iptables_Chains&amp;diff=30422</id>
		<title>M4 Iptables Chains</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=M4_Iptables_Chains&amp;diff=30422"/>
		<updated>2025-08-25T09:15:40Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
During the switch installation or update, M4 automatically creates iptables chains to manage the switch's security.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==Whitelist Chains==&lt;br /&gt;
There are two types of whitelist chains:&lt;br /&gt;
&lt;br /&gt;
Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:&lt;br /&gt;
&lt;br /&gt;
* M2-CONNECT-POINTS-WHITELIST - this chain contains all IP authenticated connection points from the M4 system&lt;br /&gt;
* M2-WHITELIST-GUI -  this chain contains all IPs whitelisted in M4 GUI SECURITY -&amp;gt; Whitelisted IPs&lt;br /&gt;
&lt;br /&gt;
Chains that whitelist M4 system's IPs for specific service port(s) (for example, Elasticsearch, MySQL, Redis, SEMS, etc.), and block access to that service for all other IPs.&lt;br /&gt;
&lt;br /&gt;
Such chains are added into the M2-SERVICES-WHITELIST chain, which itself, in turn, is referenced in the INPUT chain&lt;br /&gt;
&lt;br /&gt;
 [root@localhost ~]# iptables -LM2-SERVICES-WHITELIST -n&lt;br /&gt;
 Chain M2-SERVICES-WHITELIST (0 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 M2-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 M2-SEMS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090&lt;br /&gt;
 M2-MYSQL-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3306&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Here, for example, M2-SERVICES-WHITELIST contains four chains:&lt;br /&gt;
* M2-ES-WHITELIST - whitelist access to Elasticsearch (TCP ports 9200,9300) for the M4 system IPs.&lt;br /&gt;
* M2-MYSQL-WHITELIST - whitelist access to MySQL (TCP port 3306 ) for the M4 system IPs.&lt;br /&gt;
* M2-REDIS-WHITELIST - whitelist access to Redis (TCP ports 6379) for the M4 system IPs.&lt;br /&gt;
* M2-SEMS-WHITELIST - whitelist access to SEMS (TCP port 8090 ) for the M4 system IPs.&lt;br /&gt;
&lt;br /&gt;
Each chain in turn contains whitelisted IPs and a DROP statement at the end:&lt;br /&gt;
 [root@node01 ~]# iptables -LM2-ES-WHITELIST -n&lt;br /&gt;
 Chain M2-ES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 ACCEPT     6    --  YY.YY.YY.YY          0.0.0.0/0            multiport dports 9200,9300 /* VIRTUAL_IP from system.conf */&lt;br /&gt;
 ACCEPT     6    --  XX.XX.XX.XX          0.0.0.0/0            multiport dports 9200,9300 /* External IP */&lt;br /&gt;
 ACCEPT     6    --  127.0.0.1            0.0.0.0/0            multiport dports 9200,9300 /* localhost access */&lt;br /&gt;
 DROP       6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== M2-CONNECT-POINTS-WHITELIST and M2-PRE-WHITELIST ===&lt;br /&gt;
The M2-CONNECT-POINTS-WHITELIST chain contains all IP-authenticated connection points from the M4 system and is the first whitelist chain in the INPUT chain. This means that all IP authenticated connection points are whitelisted by default. However, some M4 services contain internal data, and access is limited only by iptables and intended only for internal usage of M4, so IP authenticated connection points should NOT be able to access the data of these services. To achieve this, a special M2-PRE-WHITELIST chain is created and included as the first rule in the M2-CONNECT-POINTS-WHITELIST chain.&lt;br /&gt;
&lt;br /&gt;
M2-PRE-WHITELIST chain contains chains for services that are limited only by iptables and is used only internally by M4. Currently, the following chains are included in M2-PRE-WHITELIST:&lt;br /&gt;
* M2-ES-WHITELIST (only in servers where Elasticsearch is installed)&lt;br /&gt;
* M2-REDIS-WHITELIST (only in servers where Redis is installed)&lt;br /&gt;
* M2-SEMS-WHITELIST (only in servers where SEMS is installed)&lt;br /&gt;
&lt;br /&gt;
The combination of M2-CONNECT-POINTS-WHITELIST and M2-PRE-WHITELIST ensures that IP authenticated connection points are whitelisted, but they do not have access to the internal M4 services, where access is controlled only by iptables.&lt;br /&gt;
&lt;br /&gt;
In iptables, it looks like this:&lt;br /&gt;
 [root@localhost ~]# iptables -L M2-CONNECT-POINTS-WHITELIST  -n&lt;br /&gt;
 Chain M2-CONNECT-POINTS-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-PRE-WHITELIST  all  --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 ACCEPT     all  --  a.a.a.a      0.0.0.0/0            /* Domain abc.com */&lt;br /&gt;
 ACCEPT     all  --  b.b.b.b       0.0.0.0/0            &lt;br /&gt;
 ACCEPT     all  --  c.c.c.c        0.0.0.0/0                     &lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
 [root@localhost ~]# iptables -L M2-PRE-WHITELIST -n&lt;br /&gt;
 Chain M2-PRE-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-SEMS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090&lt;br /&gt;
 M2-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 M2-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0  &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== M2-FAIL2BAN-JUMP ==&lt;br /&gt;
'''This chain is empty for now.'''&lt;br /&gt;
&lt;br /&gt;
M2-FAIL2BAN-JUMP chain contains all chains added by fail2ban. The chain itself is referenced in the INPUT chain. This allows us to ensure proper order in the INPUT chain, as fail2ban adds chains dynamically on the first blocked IP for the jail.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Blacklist chains ==&lt;br /&gt;
M4 can contain 3 blaklist chains:&lt;br /&gt;
* M2-BLOCKED-IP-FROM-GUI - this chain contains all IPs whitelisted in M4 GUI SECURITY -&amp;gt; Blocked IPs&lt;br /&gt;
* M2-BLOCK-SCANNERS - block SIP traffic for known scanners&lt;br /&gt;
* M2-BLOCKED-COUNTRIES - chain is used when countries are blocked in M4 GUI SECURITY -&amp;gt;  Blocked Countries&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=M4_Iptables_Chains&amp;diff=30421</id>
		<title>M4 Iptables Chains</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=M4_Iptables_Chains&amp;diff=30421"/>
		<updated>2025-08-25T09:12:04Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
During the switch installation or update, M4 automatically creates iptables chains to manage the switch's security.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==Whitelist Chains==&lt;br /&gt;
There are two types of whitelist chains:&lt;br /&gt;
&lt;br /&gt;
Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:&lt;br /&gt;
&lt;br /&gt;
* M2-CONNECT-POINTS-WHITELIST - this chain contains all IP authenticated connection points from the M4 system&lt;br /&gt;
* M2-WHITELIST-GUI -  this chain contains all IPs whitelisted in M4 GUI SECURITY -&amp;gt; Whitelisted IPs&lt;br /&gt;
&lt;br /&gt;
Chains that whitelist M4 system's IPs for specific service port(s) (for example, Elasticsearch, MySQL, Redis, SEMS, etc.), and block access to that service for all other IPs.&lt;br /&gt;
&lt;br /&gt;
Such chains are added into the M2-SERVICES-WHITELIST chain, which itself, in turn, is referenced in the INPUT chain&lt;br /&gt;
&lt;br /&gt;
 [root@localhost ~]# iptables -LM2-SERVICES-WHITELIST -n&lt;br /&gt;
 Chain M2-SERVICES-WHITELIST (0 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 M2-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 M2-SEMS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090&lt;br /&gt;
 M2-MYSQL-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3306&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Here, for example, M2-SERVICES-WHITELIST contains four chains:&lt;br /&gt;
* M2-ES-WHITELIST - whitelist access to Elasticsearch (TCP ports 9200,9300) for the M4 system IPs.&lt;br /&gt;
* M2-MYSQL-WHITELIST - whitelist access to MySQL (TCP port 3306 ) for the M4 system IPs.&lt;br /&gt;
* M2-REDIS-WHITELIST - whitelist access to Redis (TCP ports 6379) for the M4 system IPs.&lt;br /&gt;
* M2-SEMS-WHITELIST - whitelist access to SEMS (TCP port 8090 ) for the M4 system IPs.&lt;br /&gt;
&lt;br /&gt;
Each chain in turn contains whitelisted IPs and a DROP statement at the end:&lt;br /&gt;
 [root@node01 ~]# iptables -LM2-ES-WHITELIST -n&lt;br /&gt;
 Chain M2-ES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 ACCEPT     6    --  YY.YY.YY.YY          0.0.0.0/0            multiport dports 9200,9300 /* VIRTUAL_IP from system.conf */&lt;br /&gt;
 ACCEPT     6    --  XX.XX.XX.XX          0.0.0.0/0            multiport dports 9200,9300 /* External IP */&lt;br /&gt;
 ACCEPT     6    --  127.0.0.1            0.0.0.0/0            multiport dports 9200,9300 /* localhost access */&lt;br /&gt;
 DROP       6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== M2-CONNECT-POINTS-WHITELIST and M2-PRE-WHITELIST ===&lt;br /&gt;
The M2-CONNECT-POINTS-WHITELIST chain contains all IP-authenticated connection points from the M4 system and is the first whitelist chain in the INPUT chain. This means that all IP authenticated connection points are whitelisted by default. However, some M4 services contain internal data, and access is limited only by iptables and intended only for internal usage of M4, IP authenticated connection points should NOT be able to access the data of these services. To achieve this, a special M2-PRE-WHITELIST chain is created and included as the first rule in the M2-CONNECT-POINTS-WHITELIST chain.&lt;br /&gt;
&lt;br /&gt;
M2-PRE-WHITELIST chain contains chains for services that are limited only by iptables and is used only internally by M4. Currently, the following chains are included in M2-PRE-WHITELIST:&lt;br /&gt;
* M2-ES-WHITELIST (only in servers where Elasticsearch is installed)&lt;br /&gt;
* M2-REDIS-WHITELIST (only in servers where Redis is installed)&lt;br /&gt;
* M2-SEMS-WHITELIST (only in servers where SEMS is installed)&lt;br /&gt;
&lt;br /&gt;
The combination of M2-CONNECT-POINTS-WHITELIST and M2-PRE-WHITELIST ensures that IP authenticated connection points are whitelisted, but they do not have access to the internal M4 services, where access is controlled only by iptables.&lt;br /&gt;
&lt;br /&gt;
In iptables, it looks like this:&lt;br /&gt;
 [root@localhost ~]# iptables -L M2-CONNECT-POINTS-WHITELIST  -n&lt;br /&gt;
 Chain M2-CONNECT-POINTS-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-PRE-WHITELIST  all  --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 ACCEPT     all  --  a.a.a.a      0.0.0.0/0            /* Domain abc.com */&lt;br /&gt;
 ACCEPT     all  --  b.b.b.b       0.0.0.0/0            &lt;br /&gt;
 ACCEPT     all  --  c.c.c.c        0.0.0.0/0                     &lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
 [root@localhost ~]# iptables -L M2-PRE-WHITELIST -n&lt;br /&gt;
 Chain M2-PRE-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-SEMS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090&lt;br /&gt;
 M2-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 M2-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0  &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== M2-FAIL2BAN-JUMP ==&lt;br /&gt;
'''This chain is empty for now.'''&lt;br /&gt;
&lt;br /&gt;
M2-FAIL2BAN-JUMP chain contains all chains added by fail2ban. The chain itself is referenced in the INPUT chain. This allows us to ensure proper order in the INPUT chain, as fail2ban adds chains dynamically on the first blocked IP for the jail.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Blacklist chains ==&lt;br /&gt;
M4 can contain 3 blaklist chains:&lt;br /&gt;
* M2-BLOCKED-IP-FROM-GUI - this chain contains all IPs whitelisted in M4 GUI SECURITY -&amp;gt; Blocked IPs&lt;br /&gt;
* M2-BLOCK-SCANNERS - block SIP traffic for known scanners&lt;br /&gt;
* M2-BLOCKED-COUNTRIES - chain is used when countries are blocked in M4 GUI SECURITY -&amp;gt;  Blocked Countries&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=M4_Iptables_Chains&amp;diff=30420</id>
		<title>M4 Iptables Chains</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=M4_Iptables_Chains&amp;diff=30420"/>
		<updated>2025-08-25T09:11:35Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
During the switch installation or update, M4 automatically creates iptables chains to manage the switch's security.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==Whitelist Chains==&lt;br /&gt;
There are two types of whitelist chains:&lt;br /&gt;
&lt;br /&gt;
Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:&lt;br /&gt;
&lt;br /&gt;
* M2-CONNECT-POINTS-WHITELIST - this chain contains all IP authenticated connection points from the M4 system&lt;br /&gt;
* M2-WHITELIST-GUI -  this chain contains all IPs whitelisted in M4 GUI SECURITY -&amp;gt; Whitelisted IPs&lt;br /&gt;
&lt;br /&gt;
Chains that whitelist M4 system's IPs for specific service port(s) (for example, Elasticsearch, MySQL, Redis, SEMS, etc.), and block access to that service for all other IPs.&lt;br /&gt;
&lt;br /&gt;
Such chains are added into the M2-SERVICES-WHITELIST chain, which itself, in turn, is referenced in the INPUT chain&lt;br /&gt;
&lt;br /&gt;
 [root@localhost ~]# iptables -LM2-SERVICES-WHITELIST -n&lt;br /&gt;
 Chain M2-SERVICES-WHITELIST (0 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 M2-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 M2-SEMS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090&lt;br /&gt;
 M2-MYSQL-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3306&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Here, for example, M2-SERVICES-WHITELIST contains four chains:&lt;br /&gt;
* M2-ES-WHITELIST - whitelist access to Elasticsearch (TCP ports 9200,9300) for the M4 system IPs.&lt;br /&gt;
* M2-MYSQL-WHITELIST - whitelist access to MySQL (TCP port 3306 )for the M4 system IPs.&lt;br /&gt;
* M2-REDIS-WHITELIST - whitelist access to Redis (TCP ports 6379) for the M4 system IPs.&lt;br /&gt;
* M2-SEMS-WHITELIST - whitelist access to SEMS (TCP port 8090 )for the M4 system IPs.&lt;br /&gt;
&lt;br /&gt;
Each chain in turn contains whitelisted IPs and a DROP statement at the end:&lt;br /&gt;
 [root@node01 ~]# iptables -LM2-ES-WHITELIST -n&lt;br /&gt;
 Chain M2-ES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 ACCEPT     6    --  YY.YY.YY.YY          0.0.0.0/0            multiport dports 9200,9300 /* VIRTUAL_IP from system.conf */&lt;br /&gt;
 ACCEPT     6    --  XX.XX.XX.XX          0.0.0.0/0            multiport dports 9200,9300 /* External IP */&lt;br /&gt;
 ACCEPT     6    --  127.0.0.1            0.0.0.0/0            multiport dports 9200,9300 /* localhost access */&lt;br /&gt;
 DROP       6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== M2-CONNECT-POINTS-WHITELIST and M2-PRE-WHITELIST ===&lt;br /&gt;
M2-CONNECT-POINTS-WHITELIST chain contains all IP authenticated connection points from the M4 system and is the first whitelist chain in the INPUT chain. This means that all IP authenticated connection points are whitelisted by default. However, some M4 services contain internal data, and access is limited only by iptables and intended only for internal usage of M4, IP authenticated connection points should NOT be able to access the data of these services. To achieve this, a special M2-PRE-WHITELIST chain is created and included as the first rule in the M2-CONNECT-POINTS-WHITELIST chain.&lt;br /&gt;
&lt;br /&gt;
M2-PRE-WHITELIST chain contains chains for services that are limited only by iptables and is used only internally by M4. Currently, the following chains are included in M2-PRE-WHITELIST:&lt;br /&gt;
* M2-ES-WHITELIST (only in servers where Elasticsearch is installed)&lt;br /&gt;
* M2-REDIS-WHITELIST (only in servers where Redis is installed)&lt;br /&gt;
* M2-SEMS-WHITELIST (only in servers where SEMS is installed)&lt;br /&gt;
&lt;br /&gt;
The combination of M2-CONNECT-POINTS-WHITELIST and M2-PRE-WHITELIST ensures that IP authenticated connection points are whitelisted, but they do not have access to the internal M4 services, where access is controlled only by iptables.&lt;br /&gt;
&lt;br /&gt;
In iptables, it looks like this:&lt;br /&gt;
 [root@localhost ~]# iptables -L M2-CONNECT-POINTS-WHITELIST  -n&lt;br /&gt;
 Chain M2-CONNECT-POINTS-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-PRE-WHITELIST  all  --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 ACCEPT     all  --  a.a.a.a      0.0.0.0/0            /* Domain abc.com */&lt;br /&gt;
 ACCEPT     all  --  b.b.b.b       0.0.0.0/0            &lt;br /&gt;
 ACCEPT     all  --  c.c.c.c        0.0.0.0/0                     &lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
 [root@localhost ~]# iptables -L M2-PRE-WHITELIST -n&lt;br /&gt;
 Chain M2-PRE-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-SEMS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090&lt;br /&gt;
 M2-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 M2-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0  &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== M2-FAIL2BAN-JUMP ==&lt;br /&gt;
'''This chain is empty for now.'''&lt;br /&gt;
&lt;br /&gt;
M2-FAIL2BAN-JUMP chain contains all chains added by fail2ban. The chain itself is referenced in the INPUT chain. This allows us to ensure proper order in the INPUT chain, as fail2ban adds chains dynamically on the first blocked IP for the jail.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Blacklist chains ==&lt;br /&gt;
M4 can contain 3 blaklist chains:&lt;br /&gt;
* M2-BLOCKED-IP-FROM-GUI - this chain contains all IPs whitelisted in M4 GUI SECURITY -&amp;gt; Blocked IPs&lt;br /&gt;
* M2-BLOCK-SCANNERS - block SIP traffic for known scanners&lt;br /&gt;
* M2-BLOCKED-COUNTRIES - chain is used when countries are blocked in M4 GUI SECURITY -&amp;gt;  Blocked Countries&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=M4_Iptables_Chains&amp;diff=30419</id>
		<title>M4 Iptables Chains</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=M4_Iptables_Chains&amp;diff=30419"/>
		<updated>2025-08-25T09:11:20Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
During the switch installation or update, M4 automatically creates iptables chains to manage the switch's security.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==Whitelist Chains==&lt;br /&gt;
There are two types of whitelist chains:&lt;br /&gt;
&lt;br /&gt;
Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:&lt;br /&gt;
&lt;br /&gt;
* M2-CONNECT-POINTS-WHITELIST - this chain contains all IP authenticated connection points from the M4 system&lt;br /&gt;
* M2-WHITELIST-GUI -  this chain contains all IPs whitelisted in M4 GUI SECURITY -&amp;gt; Whitelisted IPs&lt;br /&gt;
&lt;br /&gt;
Chains that whitelist M4 system's IPs for specific service port(s) (for example, Elasticsearch, MySQL, Redis, SEMS, etc.), and block access to that service for all other IPs.&lt;br /&gt;
&lt;br /&gt;
Such chains are added into the M2-SERVICES-WHITELIST chain, which itself, in turn, is referenced in the INPUT chain&lt;br /&gt;
[root@localhost ~]# iptables -LM2-SERVICES-WHITELIST -n&lt;br /&gt;
 Chain M2-SERVICES-WHITELIST (0 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 M2-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 M2-SEMS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090&lt;br /&gt;
 M2-MYSQL-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3306&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Here, for example, M2-SERVICES-WHITELIST contains four chains:&lt;br /&gt;
* M2-ES-WHITELIST - whitelist access to Elasticsearch (TCP ports 9200,9300) for the M4 system IPs.&lt;br /&gt;
* M2-MYSQL-WHITELIST - whitelist access to MySQL (TCP port 3306 )for the M4 system IPs.&lt;br /&gt;
* M2-REDIS-WHITELIST - whitelist access to Redis (TCP ports 6379) for the M4 system IPs.&lt;br /&gt;
* M2-SEMS-WHITELIST - whitelist access to SEMS (TCP port 8090 )for the M4 system IPs.&lt;br /&gt;
&lt;br /&gt;
Each chain in turn contains whitelisted IPs and a DROP statement at the end:&lt;br /&gt;
 [root@node01 ~]# iptables -LM2-ES-WHITELIST -n&lt;br /&gt;
 Chain M2-ES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 ACCEPT     6    --  YY.YY.YY.YY          0.0.0.0/0            multiport dports 9200,9300 /* VIRTUAL_IP from system.conf */&lt;br /&gt;
 ACCEPT     6    --  XX.XX.XX.XX          0.0.0.0/0            multiport dports 9200,9300 /* External IP */&lt;br /&gt;
 ACCEPT     6    --  127.0.0.1            0.0.0.0/0            multiport dports 9200,9300 /* localhost access */&lt;br /&gt;
 DROP       6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== M2-CONNECT-POINTS-WHITELIST and M2-PRE-WHITELIST ===&lt;br /&gt;
M2-CONNECT-POINTS-WHITELIST chain contains all IP authenticated connection points from the M4 system and is the first whitelist chain in the INPUT chain. This means that all IP authenticated connection points are whitelisted by default. However, some M4 services contain internal data, and access is limited only by iptables and intended only for internal usage of M4, IP authenticated connection points should NOT be able to access the data of these services. To achieve this, a special M2-PRE-WHITELIST chain is created and included as the first rule in the M2-CONNECT-POINTS-WHITELIST chain.&lt;br /&gt;
&lt;br /&gt;
M2-PRE-WHITELIST chain contains chains for services that are limited only by iptables and is used only internally by M4. Currently, the following chains are included in M2-PRE-WHITELIST:&lt;br /&gt;
* M2-ES-WHITELIST (only in servers where Elasticsearch is installed)&lt;br /&gt;
* M2-REDIS-WHITELIST (only in servers where Redis is installed)&lt;br /&gt;
* M2-SEMS-WHITELIST (only in servers where SEMS is installed)&lt;br /&gt;
&lt;br /&gt;
The combination of M2-CONNECT-POINTS-WHITELIST and M2-PRE-WHITELIST ensures that IP authenticated connection points are whitelisted, but they do not have access to the internal M4 services, where access is controlled only by iptables.&lt;br /&gt;
&lt;br /&gt;
In iptables, it looks like this:&lt;br /&gt;
 [root@localhost ~]# iptables -L M2-CONNECT-POINTS-WHITELIST  -n&lt;br /&gt;
 Chain M2-CONNECT-POINTS-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-PRE-WHITELIST  all  --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 ACCEPT     all  --  a.a.a.a      0.0.0.0/0            /* Domain abc.com */&lt;br /&gt;
 ACCEPT     all  --  b.b.b.b       0.0.0.0/0            &lt;br /&gt;
 ACCEPT     all  --  c.c.c.c        0.0.0.0/0                     &lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
 [root@localhost ~]# iptables -L M2-PRE-WHITELIST -n&lt;br /&gt;
 Chain M2-PRE-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-SEMS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090&lt;br /&gt;
 M2-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 M2-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0  &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== M2-FAIL2BAN-JUMP ==&lt;br /&gt;
'''This chain is empty for now.'''&lt;br /&gt;
&lt;br /&gt;
M2-FAIL2BAN-JUMP chain contains all chains added by fail2ban. The chain itself is referenced in the INPUT chain. This allows us to ensure proper order in the INPUT chain, as fail2ban adds chains dynamically on the first blocked IP for the jail.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Blacklist chains ==&lt;br /&gt;
M4 can contain 3 blaklist chains:&lt;br /&gt;
* M2-BLOCKED-IP-FROM-GUI - this chain contains all IPs whitelisted in M4 GUI SECURITY -&amp;gt; Blocked IPs&lt;br /&gt;
* M2-BLOCK-SCANNERS - block SIP traffic for known scanners&lt;br /&gt;
* M2-BLOCKED-COUNTRIES - chain is used when countries are blocked in M4 GUI SECURITY -&amp;gt;  Blocked Countries&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=M4_Iptables_Chains&amp;diff=30418</id>
		<title>M4 Iptables Chains</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=M4_Iptables_Chains&amp;diff=30418"/>
		<updated>2025-08-25T09:10:52Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: Created page with &amp;quot;=Description= During the switch install/update, M4 automatically creates iptables chains to manage the security of the switch.  &amp;lt;br&amp;gt;&amp;lt;br&amp;gt; ==Whitelist Chains== There are two types of whitelist chains: Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:  * M2-CONNECT-POINTS-WHITELIST - this chain contains all IP authenticated connection points...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
During the switch install/update, M4 automatically creates iptables chains to manage the security of the switch.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==Whitelist Chains==&lt;br /&gt;
There are two types of whitelist chains:&lt;br /&gt;
Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:&lt;br /&gt;
&lt;br /&gt;
* M2-CONNECT-POINTS-WHITELIST - this chain contains all IP authenticated connection points from the M4 system&lt;br /&gt;
* M2-WHITELIST-GUI -  this chain contains all IPs whitelisted in M4 GUI SECURITY -&amp;gt; Whitelisted IPs&lt;br /&gt;
&lt;br /&gt;
Chains that whitelist M4 system's IPs for specific service port(s) (for example, Elasticsearch, MySQL, Redis, SEMS, etc.), and block access to that service for all other IPs.&lt;br /&gt;
&lt;br /&gt;
Such chains are added into the M2-SERVICES-WHITELIST chain, which itself, in turn, is referenced in the INPUT chain&lt;br /&gt;
[root@localhost ~]# iptables -LM2-SERVICES-WHITELIST -n&lt;br /&gt;
 Chain M2-SERVICES-WHITELIST (0 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 M2-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 M2-SEMS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090&lt;br /&gt;
 M2-MYSQL-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3306&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Here, for example, M2-SERVICES-WHITELIST contains four chains:&lt;br /&gt;
* M2-ES-WHITELIST - whitelist access to Elasticsearch (TCP ports 9200,9300) for the M4 system IPs.&lt;br /&gt;
* M2-MYSQL-WHITELIST - whitelist access to MySQL (TCP port 3306 )for the M4 system IPs.&lt;br /&gt;
* M2-REDIS-WHITELIST - whitelist access to Redis (TCP ports 6379) for the M4 system IPs.&lt;br /&gt;
* M2-SEMS-WHITELIST - whitelist access to SEMS (TCP port 8090 )for the M4 system IPs.&lt;br /&gt;
&lt;br /&gt;
Each chain in turn contains whitelisted IPs and a DROP statement at the end:&lt;br /&gt;
 [root@node01 ~]# iptables -LM2-ES-WHITELIST -n&lt;br /&gt;
 Chain M2-ES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 ACCEPT     6    --  YY.YY.YY.YY          0.0.0.0/0            multiport dports 9200,9300 /* VIRTUAL_IP from system.conf */&lt;br /&gt;
 ACCEPT     6    --  XX.XX.XX.XX          0.0.0.0/0            multiport dports 9200,9300 /* External IP */&lt;br /&gt;
 ACCEPT     6    --  127.0.0.1            0.0.0.0/0            multiport dports 9200,9300 /* localhost access */&lt;br /&gt;
 DROP       6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=== M2-CONNECT-POINTS-WHITELIST and M2-PRE-WHITELIST ===&lt;br /&gt;
M2-CONNECT-POINTS-WHITELIST chain contains all IP authenticated connection points from the M4 system and is the first whitelist chain in the INPUT chain. This means that all IP authenticated connection points are whitelisted by default. However, some M4 services contain internal data, and access is limited only by iptables and intended only for internal usage of M4, IP authenticated connection points should NOT be able to access the data of these services. To achieve this, a special M2-PRE-WHITELIST chain is created and included as the first rule in the M2-CONNECT-POINTS-WHITELIST chain.&lt;br /&gt;
&lt;br /&gt;
M2-PRE-WHITELIST chain contains chains for services that are limited only by iptables and is used only internally by M4. Currently, the following chains are included in M2-PRE-WHITELIST:&lt;br /&gt;
* M2-ES-WHITELIST (only in servers where Elasticsearch is installed)&lt;br /&gt;
* M2-REDIS-WHITELIST (only in servers where Redis is installed)&lt;br /&gt;
* M2-SEMS-WHITELIST (only in servers where SEMS is installed)&lt;br /&gt;
&lt;br /&gt;
The combination of M2-CONNECT-POINTS-WHITELIST and M2-PRE-WHITELIST ensures that IP authenticated connection points are whitelisted, but they do not have access to the internal M4 services, where access is controlled only by iptables.&lt;br /&gt;
&lt;br /&gt;
In iptables, it looks like this:&lt;br /&gt;
 [root@localhost ~]# iptables -L M2-CONNECT-POINTS-WHITELIST  -n&lt;br /&gt;
 Chain M2-CONNECT-POINTS-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-PRE-WHITELIST  all  --  0.0.0.0/0            0.0.0.0/0           &lt;br /&gt;
 ACCEPT     all  --  a.a.a.a      0.0.0.0/0            /* Domain abc.com */&lt;br /&gt;
 ACCEPT     all  --  b.b.b.b       0.0.0.0/0            &lt;br /&gt;
 ACCEPT     all  --  c.c.c.c        0.0.0.0/0                     &lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0 &lt;br /&gt;
&lt;br /&gt;
 [root@localhost ~]# iptables -L M2-PRE-WHITELIST -n&lt;br /&gt;
 Chain M2-PRE-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 M2-SEMS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090&lt;br /&gt;
 M2-REDIS-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6379&lt;br /&gt;
 M2-ES-WHITELIST  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 RETURN     all  --  0.0.0.0/0            0.0.0.0/0  &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== M2-FAIL2BAN-JUMP ==&lt;br /&gt;
'''This chain is empty for now.'''&lt;br /&gt;
&lt;br /&gt;
M2-FAIL2BAN-JUMP chain contains all chains added by fail2ban. The chain itself is referenced in the INPUT chain. This allows us to ensure proper order in the INPUT chain, as fail2ban adds chains dynamically on the first blocked IP for the jail.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Blacklist chains ==&lt;br /&gt;
M4 can contain 3 blaklist chains:&lt;br /&gt;
* M2-BLOCKED-IP-FROM-GUI - this chain contains all IPs whitelisted in M4 GUI SECURITY -&amp;gt; Blocked IPs&lt;br /&gt;
* M2-BLOCK-SCANNERS - block SIP traffic for known scanners&lt;br /&gt;
* M2-BLOCKED-COUNTRIES - chain is used when countries are blocked in M4 GUI SECURITY -&amp;gt;  Blocked Countries&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_iptables_Chains&amp;diff=30385</id>
		<title>MOR iptables Chains</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_iptables_Chains&amp;diff=30385"/>
		<updated>2025-07-25T12:54:28Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
During the switch install/update, MOR X18 automatically creates iptables chains to manage the security of the switch&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==Whitelist Chains==&lt;br /&gt;
There are two types of whitelist chains:&lt;br /&gt;
Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:&lt;br /&gt;
&lt;br /&gt;
* MOR-IPAUTH-WHITELIST - this chain contains all IP authenticated devices/providers from the MOR system&lt;br /&gt;
* MOR-WHITELIST-GUI -  this chain contains all IPs whitelisted in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt; Whitelisted IPs&lt;br /&gt;
&lt;br /&gt;
Chains that whitelist MOR system's IPs for specific service port(s) (for example, Elasticsearch, MySQL, Redis, etc.), and block access to that service for all other IPs.&lt;br /&gt;
&lt;br /&gt;
Such chains are added into the MOR-SERVICES-WHITELIST chain, which itself, in turn, is referenced in the INPUT chain&lt;br /&gt;
 [root@node01 ~]# iptables -LMOR-SERVICES-WHITELIST -n&lt;br /&gt;
 Chain MOR-SERVICES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 MOR-ES-WHITELIST  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 MOR-MYSQL-WHITELIST  6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3306&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0&lt;br /&gt;
&lt;br /&gt;
Here, for example, MOR-SERVICES-WHITELIST contains two chains:&lt;br /&gt;
* MOR-ES-WHITELIST - whitelist access to Elasticsearch for the MOR system IPs&lt;br /&gt;
* MOR-MYSQL-WHITELIST - whitelist access to MySQL for the MOR system IPs&lt;br /&gt;
&lt;br /&gt;
Each chain in turn contains whitelisted IPs and DROP statement at the end:&lt;br /&gt;
 [root@node01 ~]# iptables -LMOR-ES-WHITELIST -n&lt;br /&gt;
 Chain MOR-ES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 ACCEPT     6    --  YY.YY.YY.YY          0.0.0.0/0            multiport dports 9200,9300 /* VIRTUAL_IP from system.conf */&lt;br /&gt;
 ACCEPT     6    --  XX.XX.XX.XX          0.0.0.0/0            multiport dports 9200,9300 /* External IP */&lt;br /&gt;
 ACCEPT     6    --  127.0.0.1            0.0.0.0/0            multiport dports 9200,9300 /* localhost access */&lt;br /&gt;
 DROP       6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== MOR-FAIL2BAN-JUMP ==&lt;br /&gt;
'''This chain is empty for now.'''&lt;br /&gt;
&lt;br /&gt;
MOR-FAIL2BAN-JUMP chain will contain all chains added by fail2ban. This allows us to ensure proper order chain order in the INPUT chain, as fail2ban adds chains dynamically on the first blocked IP for the jail.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Blacklist chains ==&lt;br /&gt;
MOR can contain 3 blaklist chains:&lt;br /&gt;
* MOR-BLOCKED-IP-FROM-GUI - this chain contains all IPs whitelisted in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt; Whitelisted IPs&lt;br /&gt;
* MOR-BLOCK-SCANNERS - block SIP traffic for known scanners&lt;br /&gt;
* MOR-BLOCKED-COUNTRIES - chain is used when countries are blocked in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt;  Blocked Countries&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_iptables_Chains&amp;diff=30384</id>
		<title>MOR iptables Chains</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_iptables_Chains&amp;diff=30384"/>
		<updated>2025-07-25T12:54:16Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
During the switch install/update, MOR X18 automatically creates iptables chains to manage the security of the switch&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==Whitelist Chains==&lt;br /&gt;
There are two types of whitelist chains:&lt;br /&gt;
Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:&lt;br /&gt;
&lt;br /&gt;
* MOR-IPAUTH-WHITELIST - this chain contains all IP authenticated devices/providers from the MOR system&lt;br /&gt;
* MOR-WHITELIST-GUI -  this chain contains all IPs whitelisted in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt; Whitelisted IPs&lt;br /&gt;
&lt;br /&gt;
Chains that whitelist MOR system's IPs for specific service port(s) (for example, Elasticsearch, MySQL, Redis, etc.), and block access to that service for all other IPs.&lt;br /&gt;
&lt;br /&gt;
Such chains are added into the MOR-SERVICES-WHITELIST chain, which itself, in turn, is referenced in the INPUT chain&lt;br /&gt;
 [root@node01 ~]# iptables -LMOR-SERVICES-WHITELIST -n&lt;br /&gt;
 Chain MOR-SERVICES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 MOR-ES-WHITELIST  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 MOR-MYSQL-WHITELIST  6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3306&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0&lt;br /&gt;
&lt;br /&gt;
Here, for example, MOR-SERVICES-WHITELIST contains two chains:&lt;br /&gt;
* MOR-ES-WHITELIST - whitelist access to Elasticsearch for the MOR system IPs&lt;br /&gt;
* MOR-MYSQL-WHITELIST - whitelist access to MySQL for the MOR system IPs&lt;br /&gt;
&lt;br /&gt;
Each chain in turn contains whitelisted IPs and DROP statement at the end:&lt;br /&gt;
 [root@node01 ~]# iptables -LMOR-ES-WHITELIST -n&lt;br /&gt;
 Chain MOR-ES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 ACCEPT     6    --  YY.YY.YY.YY          0.0.0.0/0            multiport dports 9200,9300 /* VIRTUAL_IP from system.conf */&lt;br /&gt;
 ACCEPT     6    --  XX.XX.XX.XX          0.0.0.0/0            multiport dports 9200,9300 /* External IP */&lt;br /&gt;
 ACCEPT     6    --  127.0.0.1            0.0.0.0/0            multiport dports 9200,9300 /* localhost access */&lt;br /&gt;
 DROP       6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== MOR-FAIL2BAN-JUMP ==&lt;br /&gt;
'''This chain is empty for now.'''&lt;br /&gt;
MOR-FAIL2BAN-JUMP chain will contain all chains added by fail2ban. This allows us to ensure proper order chain order in the INPUT chain, as fail2ban adds chains dynamically on the first blocked IP for the jail.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Blacklist chains ==&lt;br /&gt;
MOR can contain 3 blaklist chains:&lt;br /&gt;
* MOR-BLOCKED-IP-FROM-GUI - this chain contains all IPs whitelisted in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt; Whitelisted IPs&lt;br /&gt;
* MOR-BLOCK-SCANNERS - block SIP traffic for known scanners&lt;br /&gt;
* MOR-BLOCKED-COUNTRIES - chain is used when countries are blocked in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt;  Blocked Countries&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_iptables_Chains&amp;diff=30383</id>
		<title>MOR iptables Chains</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_iptables_Chains&amp;diff=30383"/>
		<updated>2025-07-25T12:53:54Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
During the switch install/update, MOR X18 automatically creates iptables chains to manage the security of the switch&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==Whitelist Chains==&lt;br /&gt;
There are two types of whitelist chains:&lt;br /&gt;
Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:&lt;br /&gt;
&lt;br /&gt;
* MOR-IPAUTH-WHITELIST - this chain contains all IP authenticated devices/providers from the MOR system&lt;br /&gt;
* MOR-WHITELIST-GUI -  this chain contains all IPs whitelisted in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt; Whitelisted IPs&lt;br /&gt;
&lt;br /&gt;
Chains that whitelist MOR system's IPs for specific service port(s) (for example, Elasticsearch, MySQL, Redis, etc.), and block access to that service for all other IPs.&lt;br /&gt;
&lt;br /&gt;
Such chains are added into the MOR-SERVICES-WHITELIST chain, which itself, in turn, is referenced in the INPUT chain&lt;br /&gt;
 [root@node01 ~]# iptables -LMOR-SERVICES-WHITELIST -n&lt;br /&gt;
 Chain MOR-SERVICES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 MOR-ES-WHITELIST  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 MOR-MYSQL-WHITELIST  6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3306&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0&lt;br /&gt;
&lt;br /&gt;
Here, for example, MOR-SERVICES-WHITELIST contains two chains:&lt;br /&gt;
* MOR-ES-WHITELIST - whitelist access to Elasticsearch for the MOR system IPs&lt;br /&gt;
* MOR-MYSQL-WHITELIST - whitelist access to MySQL for the MOR system IPs&lt;br /&gt;
&lt;br /&gt;
Each chain in turn contains whitelisted IPs and DROP statement at the end:&lt;br /&gt;
 [root@node01 ~]# iptables -LMOR-ES-WHITELIST -n&lt;br /&gt;
 Chain MOR-ES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 ACCEPT     6    --  YY.YY.YY.YY          0.0.0.0/0            multiport dports 9200,9300 /* VIRTUAL_IP from system.conf */&lt;br /&gt;
 ACCEPT     6    --  XX.XX.XX.XX          0.0.0.0/0            multiport dports 9200,9300 /* External IP */&lt;br /&gt;
 ACCEPT     6    --  127.0.0.1            0.0.0.0/0            multiport dports 9200,9300 /* localhost access */&lt;br /&gt;
 DROP       6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== MOR-FAIL2BAN-JUMP ==&lt;br /&gt;
*This chain is empty for now.*&lt;br /&gt;
MOR-FAIL2BAN-JUMP chain will contain all chains added by fail2ban. This allows us to ensure proper order chain order in the INPUT chain, as fail2ban adds chains dynamically on the first blocked IP for the jail.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Blacklist chains ==&lt;br /&gt;
MOR can contain 3 blaklist chains:&lt;br /&gt;
* MOR-BLOCKED-IP-FROM-GUI - this chain contains all IPs whitelisted in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt; Whitelisted IPs&lt;br /&gt;
* MOR-BLOCK-SCANNERS - block SIP traffic for known scanners&lt;br /&gt;
* MOR-BLOCKED-COUNTRIES - chain is used when countries are blocked in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt;  Blocked Countries&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_iptables_Chains&amp;diff=30382</id>
		<title>MOR iptables Chains</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_iptables_Chains&amp;diff=30382"/>
		<updated>2025-07-25T12:53:35Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: Created page with &amp;quot;=Description= During the switch install/update, MOR automatically created iptables chains to manage the security of the switch  &amp;lt;br&amp;gt;&amp;lt;br&amp;gt; ==Whitelist Chains== There are two types of whitelist chains: Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:  * MOR-IPAUTH-WHITELIST - this chain contains all IP authenticated devices/providers from t...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Description=&lt;br /&gt;
During the switch install/update, MOR automatically created iptables chains to manage the security of the switch&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
==Whitelist Chains==&lt;br /&gt;
There are two types of whitelist chains:&lt;br /&gt;
Chains that only have ACCEPT statements, to make sure that IPs are always whitelisted. These chains are added at the very top of the INPUT chain, to make sure that IPs are whitelisted:&lt;br /&gt;
&lt;br /&gt;
* MOR-IPAUTH-WHITELIST - this chain contains all IP authenticated devices/providers from the MOR system&lt;br /&gt;
* MOR-WHITELIST-GUI -  this chain contains all IPs whitelisted in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt; Whitelisted IPs&lt;br /&gt;
&lt;br /&gt;
Chains that whitelist MOR system's IPs for specific service port(s) (for example, Elasticsearch, MySQL, Redis, etc.), and block access to that service for all other IPs.&lt;br /&gt;
&lt;br /&gt;
Such chains are added into the MOR-SERVICES-WHITELIST chain, which itself, in turn, is referenced in the INPUT chain&lt;br /&gt;
 [root@node01 ~]# iptables -LMOR-SERVICES-WHITELIST -n&lt;br /&gt;
 Chain MOR-SERVICES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 MOR-ES-WHITELIST  6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
 MOR-MYSQL-WHITELIST  6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3306&lt;br /&gt;
 RETURN     0    --  0.0.0.0/0            0.0.0.0/0&lt;br /&gt;
&lt;br /&gt;
Here, for example, MOR-SERVICES-WHITELIST contains two chains:&lt;br /&gt;
* MOR-ES-WHITELIST - whitelist access to Elasticsearch for the MOR system IPs&lt;br /&gt;
* MOR-MYSQL-WHITELIST - whitelist access to MySQL for the MOR system IPs&lt;br /&gt;
&lt;br /&gt;
Each chain in turn contains whitelisted IPs and DROP statement at the end:&lt;br /&gt;
 [root@node01 ~]# iptables -LMOR-ES-WHITELIST -n&lt;br /&gt;
 Chain MOR-ES-WHITELIST (1 references)&lt;br /&gt;
 target     prot opt source               destination         &lt;br /&gt;
 ACCEPT     6    --  YY.YY.YY.YY          0.0.0.0/0            multiport dports 9200,9300 /* VIRTUAL_IP from system.conf */&lt;br /&gt;
 ACCEPT     6    --  XX.XX.XX.XX          0.0.0.0/0            multiport dports 9200,9300 /* External IP */&lt;br /&gt;
 ACCEPT     6    --  127.0.0.1            0.0.0.0/0            multiport dports 9200,9300 /* localhost access */&lt;br /&gt;
 DROP       6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 9200,9300&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== MOR-FAIL2BAN-JUMP ==&lt;br /&gt;
*This chain is empty for now.*&lt;br /&gt;
MOR-FAIL2BAN-JUMP chain will contain all chains added by fail2ban. This allows us to ensure proper order chain order in the INPUT chain, as fail2ban adds chains dynamically on the first blocked IP for the jail.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Blacklist chains ==&lt;br /&gt;
MOR can contain 3 blaklist chains:&lt;br /&gt;
* MOR-BLOCKED-IP-FROM-GUI - this chain contains all IPs whitelisted in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt; Whitelisted IPs&lt;br /&gt;
* MOR-BLOCK-SCANNERS - block SIP traffic for known scanners&lt;br /&gt;
* MOR-BLOCKED-COUNTRIES - chain is used when countries are blocked in MOR GUI SETTINGS -&amp;gt; Security -&amp;gt;  Blocked Countries&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=M4_DID_Management&amp;diff=30228</id>
		<title>M4 DID Management</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=M4_DID_Management&amp;diff=30228"/>
		<updated>2025-06-30T11:51:31Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;html&amp;gt;&lt;br /&gt;
&amp;lt;div align=&amp;quot;center&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;iframe width=&amp;quot;640&amp;quot; height=&amp;quot;360&amp;quot; src=&amp;quot;https://www.youtube.com/embed/8W_Ck2nqQHE&amp;quot; title=&amp;quot;YouTube video player&amp;quot; frameborder=&amp;quot;0&amp;quot; allow=&amp;quot;accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture&amp;quot; allowfullscreen&amp;gt;&amp;lt;/iframe&amp;gt;&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&amp;lt;/html&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Supported Functionality =&lt;br /&gt;
&lt;br /&gt;
* DID inventory search/filtering&lt;br /&gt;
* Bulk upload tool&lt;br /&gt;
* DID Status and Assignment visibility&lt;br /&gt;
* Buying/Selling charges support&lt;br /&gt;
* Flexible Inbound routing&lt;br /&gt;
* Route to client PBXs by IP addresses – Trunking&lt;br /&gt;
* Follow me ( Call Forwarding ) style services where the inbound calls can be routed back out to the alternate destination&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Inventory =&lt;br /&gt;
&lt;br /&gt;
[[File:M4_dids_inventory.png]]&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
On this page you can:&lt;br /&gt;
*Add new DID(s).&lt;br /&gt;
*Import DID(s).&lt;br /&gt;
*Export DID(s).&lt;br /&gt;
*Bulk edit DID(s).&lt;br /&gt;
*Search DID(s) using various parameters.&lt;br /&gt;
*Edit DID(s) subscription.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Buying Pricing Groups =&lt;br /&gt;
&lt;br /&gt;
Buying Pricing Groups unifies DIDs bought as a group for the same price from one DID Provider. It allows quickly setting buying prices for the DID or group of DIDs.&lt;br /&gt;
&lt;br /&gt;
In Buying Pricing Groups '''all charges would be paid by Admin to Provider'''&lt;br /&gt;
&lt;br /&gt;
DID Buying Pricing Groups can be accessed at '''Routing -&amp;gt; DIDs - Buying Pricing Groups'''&lt;br /&gt;
&lt;br /&gt;
To Add a new DID Buying Pricing Group, press '''NEW''' and fill in needed data: &amp;lt;br&amp;gt;&lt;br /&gt;
*'''Name'''&lt;br /&gt;
*'''Currency'''&lt;br /&gt;
*'''Activation Fee''' - One-time fee that will be charged when activating DID.&lt;br /&gt;
*'''Periodic Fee''' - Fee that will be charged every period set in '''Charge Plan'''.&lt;br /&gt;
*'''Tariff''' - Tariff which will be used for the call. The call will be charged by CallerID prefix by a tariff rate. &amp;lt;br&amp;gt;&lt;br /&gt;
[[File:Buying Group create.png]]&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
When data is filled, press '''CREATE'''&lt;br /&gt;
&lt;br /&gt;
[[File:Buying Group created.png]]&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It is possible to edit or delete a group by pressing the '''EDIT''' or '''DELETE''' button.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Selling Pricing Groups =&lt;br /&gt;
&lt;br /&gt;
Selling Pricing Groups unifies DIDs sold as a group for the same price. It allows quickly setting selling prices for the DID or group of DIDs.&lt;br /&gt;
&lt;br /&gt;
In Selling Pricing Groups '''all charges would be paid by User to Admin'''&lt;br /&gt;
&lt;br /&gt;
DID Selling Pricing Groups can be accessed at '''Routing -&amp;gt; DIDs - Selling Pricing Groups'''&lt;br /&gt;
&lt;br /&gt;
To Add a new DID Selling Pricing Group, press '''NEW''' and fill in needed data: &amp;lt;br&amp;gt;&lt;br /&gt;
*'''Name'''&lt;br /&gt;
*'''Currency'''&lt;br /&gt;
*'''Overwrite Activation Fee''' - NO / YES . If Yes is chosen, options '''Additional activation fee''' and '''Activation fee markup''' would be changed to '''Activation fee'''.&lt;br /&gt;
*'''Additional Activation Fee''' - Additional one-time fee that will be charged when activating DID. The value is added to '''Buying Activation fee'''.&lt;br /&gt;
*'''Activation Fee Markup''' - Activation Fee Markup is calculated as % from '''Buying Activation fee'''.&lt;br /&gt;
*'''Overwrite Periodic Fee''' - NO / YES . If Yes is chosen, options '''Additional Periodic fee''' and '''Periodic fee markup''' would be changed to '''Periodic fee'''.&lt;br /&gt;
*'''Additional Periodic Fee''' - Additional fee that will be charged every period set in '''Charge Plan'''. The value is added to '''Buying Periodic fee.'''&lt;br /&gt;
*'''Periodic Fee Markup''' - Periodic Fee Markup is calculated as % from '''Buying Periodic fee'''.&lt;br /&gt;
*'''Tariff''' - Tariff which will be used for the call. The call will be charged by CallerID prefix by a tariff rate.&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[[File:Selling group create.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
When data is filled, press '''CREATE'''&lt;br /&gt;
&lt;br /&gt;
[[File:Selling group created.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It is possible to edit or delete a group by pressing the '''EDIT''' or '''DELETE''' button.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Charge Plans =&lt;br /&gt;
Charge Plan is a template for the Subscription - defines what type of Subscription can be used for a service.&lt;br /&gt;
&lt;br /&gt;
More information can be found [[M4 Charge Plans|here]].&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Tags =&lt;br /&gt;
Tags are labels attached to DIDs for the purpose of identification or to give other useful information. Tags help manage groups of DIDs.&lt;br /&gt;
&lt;br /&gt;
DID Tags can be accessed at '''Routing -&amp;gt; DIDs - Tags''' &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
To Add a new DID Tag, press '''NEW''' and fill in its Name and Comment if needed.&amp;lt;br&amp;gt;&lt;br /&gt;
Color gamma can be accessed when pressing on the Color field.&lt;br /&gt;
&lt;br /&gt;
[[File:DID Tags Create.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
When data is filled, press '''CREATE'''&lt;br /&gt;
&lt;br /&gt;
[[File:DID Tag Created.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It is possible to edit or delete Tag by pressing the '''EDIT''' or '''DELETE''' button.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Add new DID(s) =&lt;br /&gt;
&lt;br /&gt;
[[File:M4_add_new_did.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
*'''DID''' - enter DID number.&lt;br /&gt;
*'''Tags''' - select tag.&lt;br /&gt;
*'''Vendor''' - select a supplier.&lt;br /&gt;
*'''Buying''' Pricing Group - select Buying Pricing Group or create a Custom one.&lt;br /&gt;
*'''Comment''' - for notices.&lt;br /&gt;
*'''Customer''' - select a user.&lt;br /&gt;
*'''Selling''' Pricing Group - select Selling Pricing Group or create a Custom one.&lt;br /&gt;
*''' Header Transformation Group ''' - which [[M4 Header Transformation Rules Groups|Header Transformation Rules Group]] to use.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
'''NOTE.''' By pressing '''CREATE AND ACTIVATE FOR USER''' the DID should start working immediately and receive calls.&amp;lt;br&amp;gt;&lt;br /&gt;
The Subscription will be created according to the option set in  MAINTENANCE -&amp;gt; Settings -&amp;gt; SIP Trunking -&amp;gt; Default Billing Settings for DID Subscription.&amp;lt;br&amp;gt;&lt;br /&gt;
Two options are available: '''&amp;quot;DID Selling Pricing Group&amp;quot;''' or '''&amp;quot;Selected Charge Plan&amp;quot;'''.&lt;br /&gt;
&lt;br /&gt;
'''NOTE.''' It is possible to fill Default DIDs settings for new DIDs at Maintenance - Settings - DIDs.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Add new DID(s) as Manager =&lt;br /&gt;
&lt;br /&gt;
[[M4 Managers | Managers]] needs DIDs [[M4_Managers#Manager_Groups | permission]] to manage DIDs.&lt;br /&gt;
&lt;br /&gt;
To simplify the manager's work, the admin can fill DIDs section in [[ M4 Settings#DIDs | settings]].&lt;br /&gt;
&lt;br /&gt;
[[File:M4_settings_DIDs_fill.png]]&lt;br /&gt;
&lt;br /&gt;
When the manager creates a new DID, all settings will already be filled in. &lt;br /&gt;
&lt;br /&gt;
[[File:M4_add_new_did_manager.png]]&lt;br /&gt;
&lt;br /&gt;
The manager will only need to enter the DID number and select the user. The system will select the first user's device (number 3 in the screenshot). The Manager can change the device if needed.&amp;lt;br&amp;gt;&lt;br /&gt;
If the settings are correct, then the Manager needs to press '''CREATE AND ACTIVATE FOR USER''' to create and activate the DID.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= DID(s) edit =&lt;br /&gt;
[[File:M4_dids_edit.png]]&lt;br /&gt;
&lt;br /&gt;
'''Add Diversion Header''' - if enabled, a Diversion header is added calling this DID. The URI will be this DID.&lt;br /&gt;
&lt;br /&gt;
'''Add History-Info Header''' - if enabled, a History-Info header is added calling this DID. The URI will be this DID.&lt;br /&gt;
&lt;br /&gt;
Let's say the DID number is 37011111, and the external number is 37022222&lt;br /&gt;
&lt;br /&gt;
x.x.x.x - IP of the connection point where is DID is forwarded to&lt;br /&gt;
&lt;br /&gt;
y.y.y.y - IP of the TP that will terminate the forwarded external number&lt;br /&gt;
&lt;br /&gt;
z.z.z.z - IP of the M4&lt;br /&gt;
&lt;br /&gt;
If DID 37011111 is forwarded to the connection point, the headers will look like this:&lt;br /&gt;
&lt;br /&gt;
 INVITE sip:37011111@x.x.x.x SIP/2.0&lt;br /&gt;
 ...&lt;br /&gt;
 To: &amp;lt;sip:37011111@x.x.x.x&amp;gt;&lt;br /&gt;
 ...&lt;br /&gt;
 Diversion: &amp;lt;sip:37011111@z.z.z.z&amp;gt;;reason=unconditional;screen=&amp;quot;yes&amp;quot;&lt;br /&gt;
 History-Info: &amp;lt;sip:37011111@z.z.z.z&amp;gt;;index=1&lt;br /&gt;
 ...&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
If DID 37011111 is forwarded to external number 37022222, the headers will look like this:&lt;br /&gt;
 INVITE sip:37022222@y.y.y.y SIP/2.0&lt;br /&gt;
 ...&lt;br /&gt;
 To: &amp;lt;sip:37022222@y.y.y.y&amp;gt;&lt;br /&gt;
 ...&lt;br /&gt;
 Diversion: &amp;lt;sip:37011111@z.z.z.z&amp;gt;;reason=unconditional;screen=&amp;quot;yes&amp;quot;&lt;br /&gt;
 History-Info: &amp;lt;sip:37011111@z.z.z.z&amp;gt;;index=1&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Import =&lt;br /&gt;
&lt;br /&gt;
M4 DIDs can be imported from the CSV file. Import procedure [[M4 DIDs Import from CSV | described here]].&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Export =&lt;br /&gt;
&lt;br /&gt;
DIDs are exported to CSV. The system exports only visible DIDs in the Inventory that are filtered by search parameters.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= DID Search (Refine) =&lt;br /&gt;
&lt;br /&gt;
Filter DIDs by various options:&lt;br /&gt;
&lt;br /&gt;
[[File:Did refine.png]]&lt;br /&gt;
&lt;br /&gt;
When a filter is active, then Inventory stats will show green values for the filtered DIDs ([[M4_DID_Bulk_with_Refine_Example|example]]):&lt;br /&gt;
&lt;br /&gt;
[[File:Did_refine_colors.png]]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= DID bulk management =&lt;br /&gt;
&lt;br /&gt;
In the main DIDs window, click on '''BULK EDIT''' and you will be able to perform various actions.&lt;br /&gt;
&lt;br /&gt;
Bulk management works together with REFINE (Search). First, you find the DIDs you need, then you apply Bulk Action on them.&lt;br /&gt;
&lt;br /&gt;
Find necessary DIDS with REFINE section. Then mark (by pressing the rectangle at the left of the DID) all DIDs or just some of them to apply Bulk Action to them.&lt;br /&gt;
&lt;br /&gt;
Example how to do that [[M4_DID_Bulk_with_Refine_Example | here]]&lt;br /&gt;
&lt;br /&gt;
[[File:M4_dids_bulk1.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Bulk Action''' - Change, Delete or Close Subscription.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Tag Action''' - Add or Delete.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Status''' - Do not Change, Free, Reserved, Archived.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Vendor''' - Change Vendor.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Destination''' - Change Destination.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Buying Pricing Group''' - select and change Buying Pricing Group from the list.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Tags''' - Change Tags.&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Select DIDs to modify and apply the actions. '''Example before changes:'''&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:M4_dids_bulk2.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
'''Example after changes:'''&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:M4_dids_bulk3.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= DIDs Bulk Update from CSV =&lt;br /&gt;
DIDs can be updated from the CSV file. Update procedure [[M4 DIDs Bulk Update from CSV | described here]].&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Making DID Active =&lt;br /&gt;
&lt;br /&gt;
'''Important.''' In order to make DID active and call it, it must have an assigned subscription.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= See also =&lt;br /&gt;
* [[M4 Subscriptions|Subscriptions]]&lt;br /&gt;
** [[M4 Charge Plans|Charge Plans]]&lt;br /&gt;
* [[M4 Services|Services]]&lt;br /&gt;
** [[M4 DID Management|DIDs]]&lt;br /&gt;
*** [[M4 DIDs Import from CSV|DID Import from CSV]]&lt;br /&gt;
** [[M4 Flat-Rates|Flat-Rates]]&lt;br /&gt;
** [[M4 Custom Services|Custom Services]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=M4_DID_Management&amp;diff=30227</id>
		<title>M4 DID Management</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=M4_DID_Management&amp;diff=30227"/>
		<updated>2025-06-30T11:50:59Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;html&amp;gt;&lt;br /&gt;
&amp;lt;div align=&amp;quot;center&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;iframe width=&amp;quot;640&amp;quot; height=&amp;quot;360&amp;quot; src=&amp;quot;https://www.youtube.com/embed/8W_Ck2nqQHE&amp;quot; title=&amp;quot;YouTube video player&amp;quot; frameborder=&amp;quot;0&amp;quot; allow=&amp;quot;accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture&amp;quot; allowfullscreen&amp;gt;&amp;lt;/iframe&amp;gt;&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&amp;lt;/html&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Supported Functionality =&lt;br /&gt;
&lt;br /&gt;
* DID inventory search/filtering&lt;br /&gt;
* Bulk upload tool&lt;br /&gt;
* DID Status and Assignment visibility&lt;br /&gt;
* Buying/Selling charges support&lt;br /&gt;
* Flexible Inbound routing&lt;br /&gt;
* Route to client PBXs by IP addresses – Trunking&lt;br /&gt;
* Follow me ( Call Forwarding ) style services where the inbound calls can be routed back out to the alternate destination&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Inventory =&lt;br /&gt;
&lt;br /&gt;
[[File:M4_dids_inventory.png]]&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
On this page you can:&lt;br /&gt;
*Add new DID(s).&lt;br /&gt;
*Import DID(s).&lt;br /&gt;
*Export DID(s).&lt;br /&gt;
*Bulk edit DID(s).&lt;br /&gt;
*Search DID(s) using various parameters.&lt;br /&gt;
*Edit DID(s) subscription.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Buying Pricing Groups =&lt;br /&gt;
&lt;br /&gt;
Buying Pricing Groups unifies DIDs bought as a group for the same price from one DID Provider. It allows quickly setting buying prices for the DID or group of DIDs.&lt;br /&gt;
&lt;br /&gt;
In Buying Pricing Groups '''all charges would be paid by Admin to Provider'''&lt;br /&gt;
&lt;br /&gt;
DID Buying Pricing Groups can be accessed at '''Routing -&amp;gt; DIDs - Buying Pricing Groups'''&lt;br /&gt;
&lt;br /&gt;
To Add a new DID Buying Pricing Group, press '''NEW''' and fill in needed data: &amp;lt;br&amp;gt;&lt;br /&gt;
*'''Name'''&lt;br /&gt;
*'''Currency'''&lt;br /&gt;
*'''Activation Fee''' - One-time fee that will be charged when activating DID.&lt;br /&gt;
*'''Periodic Fee''' - Fee that will be charged every period set in '''Charge Plan'''.&lt;br /&gt;
*'''Tariff''' - Tariff which will be used for the call. The call will be charged by CallerID prefix by a tariff rate. &amp;lt;br&amp;gt;&lt;br /&gt;
[[File:Buying Group create.png]]&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
When data is filled, press '''CREATE'''&lt;br /&gt;
&lt;br /&gt;
[[File:Buying Group created.png]]&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It is possible to edit or delete a group by pressing the '''EDIT''' or '''DELETE''' button.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Selling Pricing Groups =&lt;br /&gt;
&lt;br /&gt;
Selling Pricing Groups unifies DIDs sold as a group for the same price. It allows quickly setting selling prices for the DID or group of DIDs.&lt;br /&gt;
&lt;br /&gt;
In Selling Pricing Groups '''all charges would be paid by User to Admin'''&lt;br /&gt;
&lt;br /&gt;
DID Selling Pricing Groups can be accessed at '''Routing -&amp;gt; DIDs - Selling Pricing Groups'''&lt;br /&gt;
&lt;br /&gt;
To Add a new DID Selling Pricing Group, press '''NEW''' and fill in needed data: &amp;lt;br&amp;gt;&lt;br /&gt;
*'''Name'''&lt;br /&gt;
*'''Currency'''&lt;br /&gt;
*'''Overwrite Activation Fee''' - NO / YES . If Yes is chosen, options '''Additional activation fee''' and '''Activation fee markup''' would be changed to '''Activation fee'''.&lt;br /&gt;
*'''Additional Activation Fee''' - Additional one-time fee that will be charged when activating DID. The value is added to '''Buying Activation fee'''.&lt;br /&gt;
*'''Activation Fee Markup''' - Activation Fee Markup is calculated as % from '''Buying Activation fee'''.&lt;br /&gt;
*'''Overwrite Periodic Fee''' - NO / YES . If Yes is chosen, options '''Additional Periodic fee''' and '''Periodic fee markup''' would be changed to '''Periodic fee'''.&lt;br /&gt;
*'''Additional Periodic Fee''' - Additional fee that will be charged every period set in '''Charge Plan'''. The value is added to '''Buying Periodic fee.'''&lt;br /&gt;
*'''Periodic Fee Markup''' - Periodic Fee Markup is calculated as % from '''Buying Periodic fee'''.&lt;br /&gt;
*'''Tariff''' - Tariff which will be used for the call. The call will be charged by CallerID prefix by a tariff rate.&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[[File:Selling group create.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
When data is filled, press '''CREATE'''&lt;br /&gt;
&lt;br /&gt;
[[File:Selling group created.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It is possible to edit or delete a group by pressing the '''EDIT''' or '''DELETE''' button.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Charge Plans =&lt;br /&gt;
Charge Plan is a template for the Subscription - defines what type of Subscription can be used for a service.&lt;br /&gt;
&lt;br /&gt;
More information can be found [[M4 Charge Plans|here]].&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Tags =&lt;br /&gt;
Tags are labels attached to DIDs for the purpose of identification or to give other useful information. Tags help manage groups of DIDs.&lt;br /&gt;
&lt;br /&gt;
DID Tags can be accessed at '''Routing -&amp;gt; DIDs - Tags''' &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
To Add a new DID Tag, press '''NEW''' and fill in its Name and Comment if needed.&amp;lt;br&amp;gt;&lt;br /&gt;
Color gamma can be accessed when pressing on the Color field.&lt;br /&gt;
&lt;br /&gt;
[[File:DID Tags Create.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
When data is filled, press '''CREATE'''&lt;br /&gt;
&lt;br /&gt;
[[File:DID Tag Created.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It is possible to edit or delete Tag by pressing the '''EDIT''' or '''DELETE''' button.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Add new DID(s) =&lt;br /&gt;
&lt;br /&gt;
[[File:M4_add_new_did.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
*'''DID''' - enter DID number.&lt;br /&gt;
*'''Tags''' - select tag.&lt;br /&gt;
*'''Vendor''' - select a supplier.&lt;br /&gt;
*'''Buying''' Pricing Group - select Buying Pricing Group or create a Custom one.&lt;br /&gt;
*'''Comment''' - for notices.&lt;br /&gt;
*'''Customer''' - select a user.&lt;br /&gt;
*'''Selling''' Pricing Group - select Selling Pricing Group or create a Custom one.&lt;br /&gt;
*''' Header Transformation Group ''' - which [[M4 Header Transformation Rules Groups|Header Transformation Rules Group]] to use.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
'''NOTE.''' By pressing '''CREATE AND ACTIVATE FOR USER''' the DID should start working immediately and receive calls.&amp;lt;br&amp;gt;&lt;br /&gt;
The Subscription will be created according to the option set in  MAINTENANCE -&amp;gt; Settings -&amp;gt; SIP Trunking -&amp;gt; Default Billing Settings for DID Subscription.&amp;lt;br&amp;gt;&lt;br /&gt;
Two options are available: '''&amp;quot;DID Selling Pricing Group&amp;quot;''' or '''&amp;quot;Selected Charge Plan&amp;quot;'''.&lt;br /&gt;
&lt;br /&gt;
'''NOTE.''' It is possible to fill Default DIDs settings for new DIDs at Maintenance - Settings - DIDs.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Add new DID(s) as Manager =&lt;br /&gt;
&lt;br /&gt;
[[M4 Managers | Managers]] needs DIDs [[M4_Managers#Manager_Groups | permission]] to manage DIDs.&lt;br /&gt;
&lt;br /&gt;
To simplify the manager's work, the admin can fill DIDs section in [[ M4 Settings#DIDs | settings]].&lt;br /&gt;
&lt;br /&gt;
[[File:M4_settings_DIDs_fill.png]]&lt;br /&gt;
&lt;br /&gt;
When the manager creates a new DID, all settings will already be filled in. &lt;br /&gt;
&lt;br /&gt;
[[File:M4_add_new_did_manager.png]]&lt;br /&gt;
&lt;br /&gt;
The manager will only need to enter the DID number and select the user. The system will select the first user's device (number 3 in the screenshot). The Manager can change the device if needed.&amp;lt;br&amp;gt;&lt;br /&gt;
If the settings are correct, then the Manager needs to press '''CREATE AND ACTIVATE FOR USER''' to create and activate the DID.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= DID(s) edit =&lt;br /&gt;
[[File:M4_dids_edit.png]]&lt;br /&gt;
&lt;br /&gt;
'''Add Diversion Header''' - if enabled, a Diversion header is added calling this DID. The URI will be this DID.&lt;br /&gt;
&lt;br /&gt;
'''Add History-Info Header''' - if enabled, a History-Info header is added calling this DID. The URI will be this DID.&lt;br /&gt;
&lt;br /&gt;
Let's say DID number is 37011111, and the external number is 37022222&lt;br /&gt;
x.x.x.x - IP of the connection point where is DID is forwarded to&lt;br /&gt;
y.y.y.y - IP of the TP that will terminate forwarded external number&lt;br /&gt;
z.z.z.z - IP of the M4&lt;br /&gt;
&lt;br /&gt;
If DID 37011111 is forwarded to the connection point, the headers will look like this:&lt;br /&gt;
&lt;br /&gt;
 INVITE sip:37011111@x.x.x.x SIP/2.0&lt;br /&gt;
 ...&lt;br /&gt;
 To: &amp;lt;sip:37011111@x.x.x.x&amp;gt;&lt;br /&gt;
 ...&lt;br /&gt;
 Diversion: &amp;lt;sip:37011111@z.z.z.z&amp;gt;;reason=unconditional;screen=&amp;quot;yes&amp;quot;&lt;br /&gt;
 History-Info: &amp;lt;sip:37011111@z.z.z.z&amp;gt;;index=1&lt;br /&gt;
 ...&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
If DID 37011111 is forwarded to external number 37022222, the headers will look like this:&lt;br /&gt;
 INVITE sip:37022222@y.y.y.y SIP/2.0&lt;br /&gt;
 ...&lt;br /&gt;
 To: &amp;lt;sip:37022222@y.y.y.y&amp;gt;&lt;br /&gt;
 ...&lt;br /&gt;
 Diversion: &amp;lt;sip:37011111@z.z.z.z&amp;gt;;reason=unconditional;screen=&amp;quot;yes&amp;quot;&lt;br /&gt;
 History-Info: &amp;lt;sip:37011111@z.z.z.z&amp;gt;;index=1&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Import =&lt;br /&gt;
&lt;br /&gt;
M4 DIDs can be imported from the CSV file. Import procedure [[M4 DIDs Import from CSV | described here]].&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Export =&lt;br /&gt;
&lt;br /&gt;
DIDs are exported to CSV. The system exports only visible DIDs in the Inventory that are filtered by search parameters.&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= DID Search (Refine) =&lt;br /&gt;
&lt;br /&gt;
Filter DIDs by various options:&lt;br /&gt;
&lt;br /&gt;
[[File:Did refine.png]]&lt;br /&gt;
&lt;br /&gt;
When a filter is active, then Inventory stats will show green values for the filtered DIDs ([[M4_DID_Bulk_with_Refine_Example|example]]):&lt;br /&gt;
&lt;br /&gt;
[[File:Did_refine_colors.png]]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= DID bulk management =&lt;br /&gt;
&lt;br /&gt;
In the main DIDs window, click on '''BULK EDIT''' and you will be able to perform various actions.&lt;br /&gt;
&lt;br /&gt;
Bulk management works together with REFINE (Search). First, you find the DIDs you need, then you apply Bulk Action on them.&lt;br /&gt;
&lt;br /&gt;
Find necessary DIDS with REFINE section. Then mark (by pressing the rectangle at the left of the DID) all DIDs or just some of them to apply Bulk Action to them.&lt;br /&gt;
&lt;br /&gt;
Example how to do that [[M4_DID_Bulk_with_Refine_Example | here]]&lt;br /&gt;
&lt;br /&gt;
[[File:M4_dids_bulk1.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Bulk Action''' - Change, Delete or Close Subscription.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Tag Action''' - Add or Delete.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Status''' - Do not Change, Free, Reserved, Archived.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Vendor''' - Change Vendor.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Destination''' - Change Destination.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Buying Pricing Group''' - select and change Buying Pricing Group from the list.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Tags''' - Change Tags.&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Select DIDs to modify and apply the actions. '''Example before changes:'''&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:M4_dids_bulk2.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
'''Example after changes:'''&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:M4_dids_bulk3.png]] &amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= DIDs Bulk Update from CSV =&lt;br /&gt;
DIDs can be updated from the CSV file. Update procedure [[M4 DIDs Bulk Update from CSV | described here]].&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Making DID Active =&lt;br /&gt;
&lt;br /&gt;
'''Important.''' In order to make DID active and call it, it must have an assigned subscription.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= See also =&lt;br /&gt;
* [[M4 Subscriptions|Subscriptions]]&lt;br /&gt;
** [[M4 Charge Plans|Charge Plans]]&lt;br /&gt;
* [[M4 Services|Services]]&lt;br /&gt;
** [[M4 DID Management|DIDs]]&lt;br /&gt;
*** [[M4 DIDs Import from CSV|DID Import from CSV]]&lt;br /&gt;
** [[M4 Flat-Rates|Flat-Rates]]&lt;br /&gt;
** [[M4 Custom Services|Custom Services]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=M4_Emails&amp;diff=30139</id>
		<title>M4 Emails</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=M4_Emails&amp;diff=30139"/>
		<updated>2025-05-29T09:01:29Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=What are Emails?=&lt;br /&gt;
&lt;br /&gt;
This function is used to send emails to your clients. It can be used to send commercials, notes about service unavailability, or anything else – maybe Christmas greetings!&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Where I can find Emails?=&lt;br /&gt;
&lt;br /&gt;
This function can be found in '''MAINTENANCE –&amp;gt; Emails'''&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Here you see emails that are templates for emails about various system messages.&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
* '''invoices''' - customer will get his [[Invoices|Invoice]] files when they are will be sent [[Invoices#Send_invoices_by_email_.28manual.29|manually]].&lt;br /&gt;
* '''warning_balance_email''' - User will get when balance becomes lower than [[Warning balance]].&lt;br /&gt;
* '''block_when_no_balance''' - will be sent after the account is blocked due to insufficient balance.&lt;br /&gt;
* '''password_reminder''' - will be sent after M4 has received a [[MOR forgot user password|User password reminder]] request.&lt;br /&gt;
* '''warning_balance_email_local''' - Admin or/and Manager gets a warning when Users' balance becomes lower than [[Warning balance]].&lt;br /&gt;
*'''payment_confirmation''' - User will get when payment is made.&lt;br /&gt;
*'''warning_balance_email_local2''' - User will get when balance becomes higher than [[Warning balance]].&lt;br /&gt;
* '''server_low_free_space''' - will be sent when free space is too low in some of the Servers. Information about the Server and the remaining free space will be provided.&lt;br /&gt;
* '''cdr_export_success''' - will be sent after CDR export.&lt;br /&gt;
* '''cdr_export_error''' - will be sent if CDR export would end with an error.&lt;br /&gt;
* '''auto_aggregate_report''' -  Auto - emails for Aggregate Templates&lt;br /&gt;
* '''tariff_rate_notification''' -  emails for Rate Notifications&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Tariff Rate Notification template=&lt;br /&gt;
&lt;br /&gt;
[[File:Tariff_rate_notification_template.png]]&lt;br /&gt;
&lt;br /&gt;
* '''From''' - works like &amp;quot;Email From&amp;quot;. By default empty.&lt;br /&gt;
&lt;br /&gt;
Supported variables:&lt;br /&gt;
&lt;br /&gt;
* '''&amp;lt;%= rate_notification_url_agree %&amp;gt;'''&lt;br /&gt;
* '''&amp;lt;%= rate_notification_url_disagree %&amp;gt;'''&lt;br /&gt;
* '''&amp;lt;%= user_currency %&amp;gt;'''&lt;br /&gt;
* '''&amp;lt;%= rate_notification_tariff_name %&amp;gt;''' - Rate notification tariff name.&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=How to Edit Emails?=&lt;br /&gt;
&lt;br /&gt;
Press the Edit button and fill necessary information. You can use different variables.&lt;br /&gt;
Full list of [[Email_variables|email variables]] can be found [[Email_variables|HERE]]&lt;br /&gt;
&lt;br /&gt;
[[File:M2 emails edit button.png]]&lt;br /&gt;
&lt;br /&gt;
[[File:M2 email edit.png]]&lt;br /&gt;
&lt;br /&gt;
=How to Create New Email=&lt;br /&gt;
&lt;br /&gt;
In main Emails window press '''ADD NEW EMAIL'''&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Simple Email==&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:New m2 email simple.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
=Invoice Email Supported Variables=&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
*'''&amp;lt;%= username %&amp;gt;''' - User Username&lt;br /&gt;
*'''&amp;lt;%= first_name %&amp;gt;''' - User first name&lt;br /&gt;
*'''&amp;lt;%= last_name %&amp;gt;''' - User Last name&lt;br /&gt;
*'''&amp;lt;%= full_name %&amp;gt;''' - User full name&lt;br /&gt;
*'''&amp;lt;%= balance %&amp;gt;'''  - User balance&lt;br /&gt;
*'''&amp;lt;%= balance_range_min %&amp;gt;''' - User minimal balance range&lt;br /&gt;
*'''&amp;lt;%= balance_range_max %&amp;gt;''' - User maximum balance range&lt;br /&gt;
*'''&amp;lt;%= user_email %&amp;gt;''' - User email&lt;br /&gt;
*'''&amp;lt;%= currency %&amp;gt;''' - Currency&lt;br /&gt;
*'''&amp;lt;%= email %&amp;gt;''' - User email&lt;br /&gt;
*'''&amp;lt;%= company_email %&amp;gt;''' - Company email&lt;br /&gt;
*'''&amp;lt;%= invoice_price %&amp;gt;''' - Invoice price&lt;br /&gt;
*'''&amp;lt;%= invoice_price_with_tax %&amp;gt;''' - Invoice price with tax&lt;br /&gt;
*'''&amp;lt;%= invoice_currency %&amp;gt;''' - Invoice currency&lt;br /&gt;
*'''&amp;lt;%= invoice_period_start %&amp;gt;''' - Invoice period start&lt;br /&gt;
*'''&amp;lt;%= invoice_period_end %&amp;gt;''' - Invoice period end&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
=2FA variables=&lt;br /&gt;
* '''&amp;lt;%= two_fa_code %&amp;gt;''' - two factors authentication code&lt;br /&gt;
* '''&amp;lt;%= user_edit_url %&amp;gt;''' - URL to users settings page&lt;br /&gt;
* '''&amp;lt;%= current_time %&amp;gt;''' - current date and time&lt;br /&gt;
* '''&amp;lt;%= two_fa_code_attempt %&amp;gt;''' - number of attempt&lt;br /&gt;
* '''&amp;lt;%= two_fa_login_status %&amp;gt;''' - login status&lt;br /&gt;
* '''&amp;lt;%= two_fa_login_ip %&amp;gt;''' - IP which tries to login&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
=Adding an image=&lt;br /&gt;
It is possible to add an image or logo of your company to the email.&lt;br /&gt;
&lt;br /&gt;
In a template you should put an HTML code: &lt;br /&gt;
 &amp;lt;img src=&amp;quot;https://link_to_your_image.jpg&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It is also possible to configure its height, width, border, etc: &lt;br /&gt;
 &amp;lt;img src=&amp;quot;https://link_to_your_image.jpg&amp;quot; height=&amp;quot;50px&amp;quot; width=&amp;quot;247px&amp;quot; border=&amp;quot;0&amp;quot;/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= How to get the default email templates =&lt;br /&gt;
&lt;br /&gt;
In case you changed them and want to revert, you can find all default email templates in our demo: &lt;br /&gt;
* MOR: https://demo.kolmisoft.com/billing&lt;br /&gt;
* M4: https://m4demo.kolmisoft.com/billing&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=M4_Rate_Notifications&amp;diff=30138</id>
		<title>M4 Rate Notifications</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=M4_Rate_Notifications&amp;diff=30138"/>
		<updated>2025-05-28T09:37:27Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Introduction =&lt;br /&gt;
&lt;br /&gt;
Whenever there are Rate updates or changes in the Tariff some sort of communication must be made with Users that are using those Rates. Rate Notifications functionality eases manual tasks by allowing users to quickly and automatically create Jobs that inform Users about upcoming (depending on 'effective from' the value in the future) Rate prices and also await their confirmation whether they agree or disagree with them. &lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Workflow schema =&lt;br /&gt;
&lt;br /&gt;
The workflow can be visualized using the following schema:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification1.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Rate Notifications Templates =&lt;br /&gt;
&lt;br /&gt;
[[File:RateNotificationTemplate1.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
The data is generated into an XLSX file. The system contains a '''Default''' template, which is assigned for all users.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotificationTemplate2.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
It is possible to create a custom template file and use it for customers by clicking '''ADD NEW TEMPLATE''' and filling cells by your needs or uploading an XLSX Template file. &lt;br /&gt;
*Note: If a row has a value, the column near it cannot be blank.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotificationTemplate3.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
It is also possible to assign Rate Notification Template for a User in his settings.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotificationTemplate4.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Rate Notifications =&lt;br /&gt;
&lt;br /&gt;
Rate Notifications is the primary page of the functionality, it displays unique Tariff - User associations to whom Notification can be sent.&amp;lt;br&amp;gt;&lt;br /&gt;
This page can be found in Menu -&amp;gt; BILLING -&amp;gt; Tariffs -&amp;gt; Rate Notifications&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification2.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Associated Tariff - User objects are shown only when the following conditions are met:&lt;br /&gt;
* Tariff is Sell type;&lt;br /&gt;
* User's Connection Point is assigned Sell Tariff in Origination Point settings;&lt;br /&gt;
* Tariff was modified and does not have any Rate Notification Job created for specific Tariff - User;&lt;br /&gt;
* Tariff was modified and a specific Tariff - User Rate Notification was created prior to Tariff modifications.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Creating Rate Notification =&lt;br /&gt;
&lt;br /&gt;
In order to create new Rate Notification Jobs, check wanted Tariff - User associations and press Set.&amp;lt;br&amp;gt;&lt;br /&gt;
All required Notifications can be selected by clicking the header checkbox. &lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification3.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
After selection, another page will be loaded with options for these specific Notifications.&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;quot;Selected Tariffs - Users&amp;quot; displays marked associations to whom Notifications will be sent. &lt;br /&gt;
&amp;quot;Options&amp;quot; has several settings:&lt;br /&gt;
* Template - Rate Notification Template.&lt;br /&gt;
* Email Template: which Template will be used for email? The default &amp;quot;tariff_rate_notification&amp;quot; template is already present in the system and can be modified to fit specific needs. &lt;br /&gt;
** Additional possible variables:&lt;br /&gt;
*** rate_notification_tariff_name - Rate Notification's Tariff name&lt;br /&gt;
*** rate_notification_url_agree - Rate Notification's Agreement link&lt;br /&gt;
*** rate_notification_url_disagree - Rate Notifications' Disagreement link&lt;br /&gt;
*** rate_notification_decreases_effective_from - Rate Notifications' Decreases Effective From date&lt;br /&gt;
*** rate_notification_increases_effective_from - Rate Notifications' Increases Effective From date&lt;br /&gt;
* Rate Notification Type: &lt;br /&gt;
** Delta Only: future Rates only. &lt;br /&gt;
** Full: all future and currently active Rates. &lt;br /&gt;
* Agreement Timeout in days: timeout after which Notification will be automatically marked as disagreed (ignored) if the User did not respond. A Timeout adds a specified day's value to the Notification created time. &lt;br /&gt;
* If Client ignores Rate Notification - possible actions are: Block increased destinations after the timeout, allow increased destinations after the timeout.&lt;br /&gt;
* Decreases Effective From - select date and time.&lt;br /&gt;
* Increases Effective From - select date and time.&lt;br /&gt;
* Filename - Name of the notification file.&lt;br /&gt;
* Send Email:&lt;br /&gt;
** Every day: send an email every day until either the Agreement link is pressed or Agreement Timeout is reached&lt;br /&gt;
** Once: send email only one time.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification4.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
After pressing the Create button, Jobs will be created and the Rate Notification Jobs page will be loaded. &lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification5.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Rate Notification Jobs =&lt;br /&gt;
&lt;br /&gt;
Rate Notification Jobs is the page where the system will automatically gather required Rates data, send emails, and awaits Users' response.&amp;lt;br&amp;gt;&lt;br /&gt;
This page can be found in Menu -&amp;gt; BILLING -&amp;gt; Tariffs -&amp;gt; Rate Notifications -&amp;gt; Jobs&lt;br /&gt;
&lt;br /&gt;
Jobs have the following states:&amp;lt;br&amp;gt;&lt;br /&gt;
'''Assigned'''&amp;lt;br&amp;gt;&lt;br /&gt;
After Rate Notification is created a new Job appears as assigned. &lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification6.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Date Generated'''&amp;lt;br&amp;gt;&lt;br /&gt;
The system checks for all newly assigned Jobs and generates required data in XLSX format, which can be downloaded from the list. The same exact file will be attached to the email.&amp;lt;br&amp;gt;&lt;br /&gt;
Rates will be converted using the default currency. To prevent conversion, setting - &amp;quot;Use Tariff currency in the CSV export&amp;quot; must be enabled.&amp;lt;br&amp;gt;&lt;br /&gt;
This setting can be found in Maintenance -&amp;gt; Settings -&amp;gt; Various -&amp;gt; Use Tariff currency in CSV export.&amp;lt;br&amp;gt; &lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification7.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Email Sent'''&amp;lt;br&amp;gt;&lt;br /&gt;
All Jobs that have successfully generated data will send emails to Users with unique agree and disagree links which can be clicked on only once and within the specified timeout.&amp;lt;br&amp;gt;&lt;br /&gt;
'''Email will not be sent if there were no changes in rates!'''&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification8.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Completed'''&amp;lt;br&amp;gt;&lt;br /&gt;
Depending on the User's actions, the Job can be either agreed upon, disagreed with, or ignored. The list will display specific responses and the time it was responded to. Also, an additional email will be sent to Admin informing Rate Notification Job response status.&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification9.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
= Examples =&lt;br /&gt;
&lt;br /&gt;
== Type: Full, Rate Notification Agreed ==&lt;br /&gt;
&lt;br /&gt;
The user have tariff with some rates:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification10.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Admin uploads new rates with some changes on prices and Effective from date in the future:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification11.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
In Billing &amp;gt; Tariffs &amp;gt; Rate Notifications, Admin now can see a new entries. Admin selects new entry and clicks “SET”:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification12.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Then Admin selects “Full” to display old rates and new rates and click “Create”:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification13.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
New Rate Notification is created:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification14.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
The user gets email with two links:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification15.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
and file with rates comparison:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification16.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
After checking new rates, the User clicks on the first link in the email to agree with the new rates:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification17.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Now, Admin gets an email about new rates being confirmed:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification18.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
And also sees the update status in the Rate Notifications Jobs list:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification19.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Type: Delta Only, Rate Notification Disagreed ==&lt;br /&gt;
&lt;br /&gt;
The user has tariff with some rates&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification20.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Admin uploads new rates with some changes on prices and the Effective from date in the future.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
In Billing &amp;gt; Tariffs &amp;gt; Rate Notifications, Admin can now see new entries. Admin selects new entry and clicks “SET”:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification21.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Then Admin selects “Delta” to display only new rates and presses “Create”:&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification22.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
Tariff Rate Notification Job(s) successfully created.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification23.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After this, the user gets an email with two links with rates to compare:&lt;br /&gt;
&lt;br /&gt;
Dear Partner,&amp;lt;br&amp;gt;&lt;br /&gt;
Please review the attached Tariff Rate changes.&amp;lt;br&amp;gt;&lt;br /&gt;
To confirm upcoming rate changes, please click the link below:&amp;lt;br&amp;gt;&lt;br /&gt;
http://123.123.123.123/billing/tariff_rate_notification_jobs/agree?id=1128bccbac519a04a4866c785f84f873eec6d5fd&amp;lt;br&amp;gt;&lt;br /&gt;
If You do not agree with the changes, please click the link below:&amp;lt;br&amp;gt;&lt;br /&gt;
http://123.123.123.123/billing/tariff_rate_notification_jobs/disagree?id=bcc02d82cf9d919af38bb4e4677685eeb0b382a8&amp;lt;br&amp;gt;&lt;br /&gt;
Thank you for your cooperation.&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification24.png]]&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
For example, the User disagrees and presses the second link. He can see the notification that Tariff Rate changes successfully disagreed.&lt;br /&gt;
&lt;br /&gt;
After that Admin will receive an email that the client disagreed and will see the same status in Tariff Job.&lt;br /&gt;
&lt;br /&gt;
Tariff Rate Notification ID: 2 was disagreed with by the client.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
[[File:RateNotification25.png]]&lt;br /&gt;
&lt;br /&gt;
When the User disagrees with the provided rates or ignores them, the system creates a Custom Tariff from the tariff assigned to Origination Point.&lt;br /&gt;
&lt;br /&gt;
Custom Tariff includes increased rates, but these rates are blocked and calls will not pass over these destinations.&lt;br /&gt;
&lt;br /&gt;
This Custom Tariff is assigned to Origination Point.&lt;br /&gt;
&lt;br /&gt;
'''Note''':&lt;br /&gt;
&lt;br /&gt;
1. If Origination Point already has Custom Tariff assigned, Custom Tariff from Rate Notification will be applied.&lt;br /&gt;
&lt;br /&gt;
2. If Origination Point has assigned a Conditional Tariff and the User disagrees with the provided rates or ignores them, Custom Tariff is created, but is not assigned to Origination Point.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=Two_SIP_listening_ports_for_single_Asterisk&amp;diff=30129</id>
		<title>Two SIP listening ports for single Asterisk</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=Two_SIP_listening_ports_for_single_Asterisk&amp;diff=30129"/>
		<updated>2025-05-20T14:05:12Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;There is no way to make a single instance of Asterisk listen on multiple ports.  However, you can use an iptables REDIRECT to achieve the same functionality.&lt;br /&gt;
&lt;br /&gt;
To redirect a single port with iptables:&lt;br /&gt;
&lt;br /&gt;
  iptables -t nat -A PREROUTING -i eth0 -p udp --dport 5062 -j REDIRECT --to-ports 5060&lt;br /&gt;
&lt;br /&gt;
This example redirects UPD port 5062 to port 5060, which effectively allows Asterisk to listen on both of them.&lt;br /&gt;
&lt;br /&gt;
Do not forget to use the name of the network interface in this command yours, instead of eth0, if you have another.&lt;br /&gt;
&lt;br /&gt;
Remember to save the rule so that it would survive a reboot:&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
From: http://lists.digium.com/pipermail/asterisk-users/2008-November/221970.html&lt;br /&gt;
&lt;br /&gt;
To check if rule is added:&lt;br /&gt;
&lt;br /&gt;
 iptables -L -t nat -n&lt;br /&gt;
&lt;br /&gt;
'''If Virtual IP is used''', then above will not work.&lt;br /&gt;
&lt;br /&gt;
Use this rule instead:&lt;br /&gt;
&lt;br /&gt;
   iptables -t nat -A PREROUTING -d 192.168.1.180 -p udp --dport 5062 -j  DNAT --to-destination 192.168.1.180:5060&lt;br /&gt;
&lt;br /&gt;
replace 192.168.1.180 with Virtual IP.&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_forward_Q.850_Reason_header&amp;diff=30102</id>
		<title>MOR forward Q.850 Reason header</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_forward_Q.850_Reason_header&amp;diff=30102"/>
		<updated>2025-04-17T12:58:58Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= About =&lt;br /&gt;
By default, MOR does not generate and/or forward Q.850 Reason header&lt;br /&gt;
&lt;br /&gt;
== How to enable ==&lt;br /&gt;
&lt;br /&gt;
Add the following line in /etc/asterisk/sip.conf:&lt;br /&gt;
 use_q850_reason=yes&lt;br /&gt;
&lt;br /&gt;
Execute command (this does NOT interrupt calls):&lt;br /&gt;
 asterisk -rx 'sip reload keeprt'&lt;br /&gt;
&lt;br /&gt;
== Important ==&lt;br /&gt;
With this setting enabled:&lt;br /&gt;
* If the Provider does not send Q.850 reason header, Asterisk (MOR) will add this header using internal Asterisk ISDN &amp;lt;--&amp;gt; SIP mapping.&lt;br /&gt;
&lt;br /&gt;
* If the Provider sends Q.850 reason header for a failed call, then:&lt;br /&gt;
** MOR hangup cause code in Last Calls will reflect Q.850 code. For example, by default, Asterisk maps SIP 503 to ISDN code 34, so if the Provider rejected the call with SIP 503, Last Call will show HGC 34. However, with this option enabled, if the Provider rejects the call with SIP 503, and adds, for example, Reason:Q.850;cause=27, MOR will show hangupcause 27 in Last Calls, not 34.&lt;br /&gt;
** If the Provider adds text in the Reason header, for example, 'Reason: Q.850;cause=21;text=&amp;quot;Call rejected&amp;quot;', Asterisk (MOR) will forward to the originating device Reason header without text part, like this 'Reason: Q.850;cause=21'. Text part will be forwarded in a separate header X-Asterisk-HangupCause, in this example 'X-Asterisk-HangupCause: Call Rejected'.&lt;br /&gt;
&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Hangupcause Codes]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_forward_Q.850_Reason_header&amp;diff=30101</id>
		<title>MOR forward Q.850 Reason header</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_forward_Q.850_Reason_header&amp;diff=30101"/>
		<updated>2025-04-17T12:58:48Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= About =&lt;br /&gt;
By default, MOR does not generate and/or forward Q.850 Reason header&lt;br /&gt;
&lt;br /&gt;
== How to enable ==&lt;br /&gt;
&lt;br /&gt;
Add the following line in /etc/asterisk/sip.conf:&lt;br /&gt;
 use_q850_reason=yes&lt;br /&gt;
&lt;br /&gt;
Execute command (this does NOT interrupt calls):&lt;br /&gt;
 asterisk -rx 'sip reload keeprt'&lt;br /&gt;
&lt;br /&gt;
== Important ==&lt;br /&gt;
With this setting enabled:&lt;br /&gt;
* If the Provider does not send Q.850 reason header, Asterisk (MOR) will add this header using internal Asterisk ISDN &amp;lt;--&amp;gt; SIP mapping.&lt;br /&gt;
&lt;br /&gt;
* If the Provider sends Q.850 reason header for a failed call, then:&lt;br /&gt;
** MOR hangup cause code in Last Calls will reflect Q.850 code. For example, by default, Asterisk maps SIP 503 to ISDN code 34, so if the Provider rejected the call with SIP 503, Last Call will show HGC 34. However, with this option enabled, if the Provider rejects the call with SIP 503, and adds, for example, Reason:Q.850;cause=27, MOR will show hangupcause 27 in Last Calls, not 34.&lt;br /&gt;
** If the Provider adds text in the Reason header, for example, 'Reason: Q.850;cause=21;text=&amp;quot;Call rejected&amp;quot;', Asterisk (MOR) will forward to the originating device Reason header without text part, like this 'Reason: Q.850;cause=21'. Text part will be forwarded in a separate header X-Asterisk-HangupCause, in this example 'X-Asterisk-HangupCause: Call Rejected'&lt;br /&gt;
.&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Hangupcause Codes]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=MOR_forward_Q.850_Reason_header&amp;diff=30100</id>
		<title>MOR forward Q.850 Reason header</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=MOR_forward_Q.850_Reason_header&amp;diff=30100"/>
		<updated>2025-04-17T12:57:59Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: Created page with &amp;quot;= About = By default, MOR does not generate and/or forward Q.850 Reason header  == How to enable ==  Add the following line in /etc/asterisk/sip.conf:  use_q850_reason=yes  Execute command (this does NOT interrupt calls):  asterisk -rx 'sip reload keeprt'  == Important == With this setting enabled: * If the Provider does not send Q.850 reason header, Asterisk (MOR) will add this header using internal Asterisk ISDN &amp;lt;--&amp;gt; SIP mapping.  * If the Provider sends Q.850 reason h...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= About =&lt;br /&gt;
By default, MOR does not generate and/or forward Q.850 Reason header&lt;br /&gt;
&lt;br /&gt;
== How to enable ==&lt;br /&gt;
&lt;br /&gt;
Add the following line in /etc/asterisk/sip.conf:&lt;br /&gt;
 use_q850_reason=yes&lt;br /&gt;
&lt;br /&gt;
Execute command (this does NOT interrupt calls):&lt;br /&gt;
 asterisk -rx 'sip reload keeprt'&lt;br /&gt;
&lt;br /&gt;
== Important ==&lt;br /&gt;
With this setting enabled:&lt;br /&gt;
* If the Provider does not send Q.850 reason header, Asterisk (MOR) will add this header using internal Asterisk ISDN &amp;lt;--&amp;gt; SIP mapping.&lt;br /&gt;
&lt;br /&gt;
* If the Provider sends Q.850 reason header for a failed call, then:&lt;br /&gt;
** MOR hangup cause code in Last Calls will reflect Q.850 code. For example, by default, Asterisk maps SIP 503 to ISDN code 34, so if the Provider rejected the call with SIP 503, Last Call will show HGC 34. However, with this option enabled, if the Provider rejects the call with SIP 503, and adds, for example, Reason:Q.850;cause=27, MOR will show hangupcause 27 in Last Calls, not 34.&lt;br /&gt;
** If the Provider adds text in the Reason header, for example, 'Reason: Q.850;cause=21;text=&amp;quot;Call rejected&amp;quot;', Asterisk (MOR) will forward to the originating device Reason header without text part, like this 'Reason: Q.850;cause=21'. Text part will be forwarded in a separate header 'X-Asterisk-HangupCause: Call Rejected'&lt;br /&gt;
&lt;br /&gt;
= See Also =&lt;br /&gt;
* [[Hangupcause Codes]]&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
	<entry>
		<id>https://wiki.kolmisoft.com/index.php?title=CDR_Rerating&amp;diff=30099</id>
		<title>CDR Rerating</title>
		<link rel="alternate" type="text/html" href="https://wiki.kolmisoft.com/index.php?title=CDR_Rerating&amp;diff=30099"/>
		<updated>2025-04-16T09:58:47Z</updated>

		<summary type="html">&lt;p&gt;Gilbertas: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Description = &lt;br /&gt;
&lt;br /&gt;
This function is used when you change Tariff/Rate for some customer and you want to recalculate price for his Calls in the past. You need to select User, Period and system recalculates all prices for all Calls in selected period for selected User. It affects balance of User and statistics will show information with new prices.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
=Usage=&lt;br /&gt;
&lt;br /&gt;
Go to '''SETTINGS –&amp;gt; Billing –&amp;gt; CDR –&amp;gt; Rerating''':&lt;br /&gt;
&lt;br /&gt;
[[File:Mor_rerating_filters.png]]&lt;br /&gt;
&lt;br /&gt;
Select date interval and User (or multiple Users) whose Calls you want to rerate. You can select All Users and include calls of Reseller Users.&lt;br /&gt;
&lt;br /&gt;
Also you are able to set '''Ghost Time''' percent, this value will increase user_billsec and/or reseller_billsec and price which depends on changed user_billsec and/or reseller_billsec. Ghost Time will be calculated just from initial billsec,  and if you will rerate two times with same percentage value, on second time nothing will change. 0 leaves or returns initial user_billsec and/or reseller price. By default Ghost Time is applied '''before''' Tariff rounding. If you need to apply Ghost Time on top of Tariff rounding, add additional setting in /etc/mor/system.conf:&lt;br /&gt;
&lt;br /&gt;
 rerating_apply_ghost_time_after_rounding = 1&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
Table below will show which data of Calls will be affected according each selection scenario.&lt;br /&gt;
&amp;lt;br&amp;gt;&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; border=&amp;quot;1&amp;quot; style=&amp;quot;border-collapse: separate; border-spacing: 0; border-width: 1px; border-style: solid; border-color: #C0C0C0; padding: 0&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! &lt;br /&gt;
! One of Admin Users&lt;br /&gt;
! One of Admin Resellers&lt;br /&gt;
! &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;All Users&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&lt;br /&gt;
! One of particular Reseller Users&lt;br /&gt;
! All Users (Reseller Users Included)&lt;br /&gt;
|-&lt;br /&gt;
| user_billsec, &lt;br /&gt;
user_rate, &lt;br /&gt;
user_price&lt;br /&gt;
| &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;+&lt;br /&gt;
| &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;-&lt;br /&gt;
| &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;+ &lt;br /&gt;
&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;(just for Admin Users Calls)&lt;br /&gt;
| &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;+&lt;br /&gt;
| &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;+&lt;br /&gt;
|-&lt;br /&gt;
| reseller_billsec, &lt;br /&gt;
reseller_rate, &lt;br /&gt;
reseller_price&lt;br /&gt;
| &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;-&lt;br /&gt;
| &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;+ &lt;br /&gt;
&amp;amp;nbsp;(for Calls of All Reseller Users)&lt;br /&gt;
| &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;+&lt;br /&gt;
| &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;-&lt;br /&gt;
| &amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;+ &lt;br /&gt;
|}&lt;br /&gt;
'''NOTE''' If in Call of Reseller User will be used one of [[Common Use Providers]] Tariff to rerate Reseller Price will be taken form ADDONS -&amp;gt; Resellers -&amp;gt; Common use Providers. If in Call of Reseller User will be used one of Provider which belongs just to Reseller, Provider Price will be rerated by that Provider tariff.&lt;br /&gt;
&amp;lt;br&amp;gt; &amp;lt;br&amp;gt;&amp;lt;!---Nuo x6 lieka tik FAST rerating ir test mode---&amp;gt; &lt;br /&gt;
&lt;br /&gt;
== Rerate all users == &lt;br /&gt;
&amp;lt;!---This functionality is available from MOR 11---&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Select 'All Users' from User selection to rerate all Users at once in selected period.&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
== Tariff from Localization ==&lt;br /&gt;
&lt;br /&gt;
If call's prefix is in Localization Rule which has some Tariff, this Tariff is used to count call's price instead of User's Tariff.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;&amp;lt;br&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Other notes=&lt;br /&gt;
&lt;br /&gt;
* For Flat Rate calls, Re-rate will only affect Reseller and Provider billing data.&lt;br /&gt;
&lt;br /&gt;
* Re-rate does not work when call's DID, LCR or Owner Device is changed by Localization rules.&lt;br /&gt;
&lt;br /&gt;
* Re-rate will take a Rate where [[Rate Effective From | Effective From]] is less than or equal to calldate in re-rated CDR. For example, if the re-rated call has a calldate 2024-04-05 00:00:00, a Rate with an [[Rate Effective From | Effective From]]  must exist with a date less than or equal to 2024-04-05 00:00:00; otherwise, re-rating will not work.&lt;br /&gt;
&lt;br /&gt;
* Min duration, Increment and Connection Fee are also changed during Re-rating. Admin still see original duration. Rounded duration is visible under User account.&lt;br /&gt;
&lt;br /&gt;
* Provider Billing details will be rerated.&lt;/div&gt;</summary>
		<author><name>Gilbertas</name></author>
	</entry>
</feed>