IP is getting blocked repeatedly

From Kolmisoft Wiki
Revision as of 15:04, 6 February 2019 by Gilbertas (talk | contribs) (Created page with 'If customer IP is getting blocked repeatedly, even if you unblock it manually or through GUI interface, it usually means that IP is blocked by Fail2Ban. Most like…')
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigationJump to search

If customer IP is getting blocked repeatedly, even if you unblock it manually or through GUI interface, it usually means that IP is blocked by Fail2Ban. Most likely you misconfigured device in customer network send registration requests with wrong password, or trying to call without authentication. You can check this by grepping IP address in Asterisk log file: 

grep -F xx.xx.xx.xx /var/log/asterisk/messages

There xx.xx.xx.xx is customer IP which is getting blocked.

If you see messages like this: 

 NOTICE[3884] chan_sip.c: Registration from '"xxx" <sip:101@MOR.server.ip:5060>' failed for 'xx.xx.xx.xx:38596' - Wrong password
 NOTICE[3884] chan_sip.c: Registration from '"xxx" <sip:101@MOR.server.ip:5060>' failed for 'xx.xx.xx.xx:38596' - Wrong password
 NOTICE[3884] chan_sip.c: Registration from '"xxx" <sip:101@MOR.server.ip:5060>' failed for 'xx.xx.xx.xx:38596' - Wrong password

It means that some device from customer network with IP xx.xx.xx.xx is sending registration with incorrect password. Possible fixes:

  • Inform customer to fix device configuration (enter correct password in device configuration)
  • Add IP into fail2ban whitelist.
Retrieved from "https://wiki.kolmisoft.com/index.php?title=IP_is_getting_blocked_repeatedly&oldid=24402"