Difference between revisions of "IP is getting blocked repeatedly"
From Kolmisoft Wiki
Jump to navigationJump to search
(Created page with 'If customer IP is getting blocked repeatedly, even if you unblock it manually or through GUI interface, it usually means that IP is blocked by Fail2Ban. Most like…') |
|||
| Line 12: | Line 12: | ||
* Inform customer to fix device configuration (enter correct password in device configuration) | * Inform customer to fix device configuration (enter correct password in device configuration) | ||
* Add IP into [[How to add Fail2ban exception for my IP|fail2ban whitelist]]. | * Add IP into [[How to add Fail2ban exception for my IP|fail2ban whitelist]]. | ||
<br><br> | |||
=See Also= | |||
* [[Blocked IPs]] | |||
* [[How to add Fail2ban exception for my IP]] | |||
Latest revision as of 15:04, 6 February 2019
If customer IP is getting blocked repeatedly, even if you unblock it manually or through GUI interface, it usually means that IP is blocked by Fail2Ban. Most likely you misconfigured device in customer network send registration requests with wrong password, or trying to call without authentication. You can check this by grepping IP address in Asterisk log file:
grep -F xx.xx.xx.xx /var/log/asterisk/messages
There xx.xx.xx.xx is customer IP which is getting blocked.
If you see messages like this:
NOTICE[3884] chan_sip.c: Registration from '"xxx" <sip:101@MOR.server.ip:5060>' failed for 'xx.xx.xx.xx:38596' - Wrong password NOTICE[3884] chan_sip.c: Registration from '"xxx" <sip:101@MOR.server.ip:5060>' failed for 'xx.xx.xx.xx:38596' - Wrong password NOTICE[3884] chan_sip.c: Registration from '"xxx" <sip:101@MOR.server.ip:5060>' failed for 'xx.xx.xx.xx:38596' - Wrong password
It means that some device from customer network with IP xx.xx.xx.xx is sending registration with incorrect password. Possible fixes:
- Inform customer to fix device configuration (enter correct password in device configuration)
- Add IP into fail2ban whitelist.
