FreePBX Firewall Not Working?

@1sae wrote:

I just upgraded my distro via script and see they are using a firewall now. I had my own entries in iptables to block ip's that have attempted to hack in. In the FreePBX firewall I have eth0 set to external and added an ip in the blacklist. But it looks like the ip I've added is still showing up in the logs. I added them to iptables too and still in there. Here's a little snip of the log:

[2015-11-27 12:59:05] NOTICE[5950] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:05] NOTICE[5950] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27
 12:59:09] NOTICE[3497] chan_sip.c: Registration from '"4001" 
<sip:4001@76.90.*.*:5060>' failed for '85.25.200.167:5068' - 
Wrong password
[2015-11-27 12:59:10] NOTICE[5952] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:10] NOTICE[5952] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27
 12:59:14] NOTICE[3497] chan_sip.c: Registration from '"9999" 
<sip:9999@76.90.*.*:5060>' failed for '85.25.200.167:5083' - 
Wrong password
[2015-11-27 12:59:15] 
NOTICE[3497] chan_sip.c: Registration from '"405" 
<sip:405@76.90.*.*:5060>' failed for '85.25.200.167:5061' - 
Wrong password
[2015-11-27 12:59:15] 
NOTICE[3497] chan_sip.c: Registration from '"941" 
<sip:941@76.90.*.*:5060>' failed for '85.25.200.167:5069' - 
Wrong password
[2015-11-27 12:59:15] NOTICE[5954] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:15] NOTICE[5954] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27
 12:59:18] NOTICE[3497] chan_sip.c: Registration from '"9001" 
<sip:9001@76.90.*.*:5060>' failed for '85.25.200.167:5086' - 
Wrong password
[2015-11-27 12:59:20] NOTICE[5956] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:20] NOTICE[5956] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27
 12:59:24] NOTICE[3497] chan_sip.c: Registration from '"7009" 
<sip:7009@76.90.*.*:5060>' failed for '85.25.200.167:5087' - 
Wrong password
[2015-11-27 12:59:25] NOTICE[5958] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:25] NOTICE[5958] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27
 12:59:25] NOTICE[3497] chan_sip.c: Registration from '"888" 
<sip:888@76.90.*.*5060>' failed for '85.25.200.167:5089' - 
Wrong password
[2015-11-27 12:59:30] NOTICE[6003] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:30] NOTICE[6003] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27
 12:59:33] NOTICE[3497] chan_sip.c: Registration from '"999" 
<sip:999@76.90.*.*:5060>' failed for '85.25.200.167:5080' - 
Wrong password
[2015-11-27 12:59:34] 
NOTICE[3497] chan_sip.c: Registration from '"12000" 
<sip:12000@76.90.*.*:5060>' failed for '85.25.200.167:5084' - 
Wrong password
[2015-11-27 12:59:34] 
NOTICE[3497] chan_sip.c: Registration from '"00005" 
<sip:00005@76.90.*.*:5060>' failed for '85.25.200.167:5072' - 
Wrong password
[2015-11-27 12:59:35] NOTICE[6005] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:35] NOTICE[6005] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27 12:59:40] NOTICE[6007] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:40] NOTICE[6007] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27 12:59:45] NOTICE[6009] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:45] NOTICE[6009] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27 12:59:50] NOTICE[6034] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:50] NOTICE[6034] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27
 12:59:51] NOTICE[3497] chan_sip.c: Registration from '"110" 
<sip:110@76.90.*.*:5060>' failed for '85.25.200.167:5079' - 
Wrong password
[2015-11-27 12:59:55] NOTICE[6036] manager.c: 127.0.0.1 tried to authenticate with nonexistent user 'cxpanel'
[2015-11-27 12:59:55] NOTICE[6036] manager.c: 127.0.0.1 failed to authenticate as 'cxpanel'
[2015-11-27
 12:59:56] NOTICE[3497] chan_sip.c: Registration from '"5091" 
<sip:5091@76.90.*.*:5060>' failed for '85.25.200.167:5060' - 
Wrong password

It looks like fail2ban isn't catching it either. Any ideas on how to make it work again?

Posts: 1

Participants: 1

Read full topic