Asterisk and FreePBX

Report SIP scanners and toll-fraud attempts caught by fail2ban's Asterisk jail.

Any phone system on the internet is scanned by SIP bots within hours, looking for extensions with weak passwords to run up international calls. fail2ban already ships an Asterisk filter; add the isipsafe action and every banned scanner is reported as VoIP fraud.

Set it up

1. Install the action if you have not yet (see fail2ban):

   curl -s https://isipsafe.com/integrations/fail2ban.conf | sudo tee /etc/fail2ban/action.d/isipsafe.conf

2. Enable the jail with the action in /etc/fail2ban/jail.local:

   [asterisk]
   enabled  = true
   maxretry = 5
   action   = %(action_)s
              isipsafe[categories="voip,brute-force", key="sl_your_key_here"]

   The filter reads Asterisk's security log; make sure logger.conf writes the security level to the file the jail watches (/var/log/asterisk/messages or security).
3. Restart fail2ban and watch sudo fail2ban-client status asterisk.

FreePBX

FreePBX's Intrusion Detection module runs fail2ban with its own Asterisk jail. Add the isipsafe[...] line to that jail's action in /etc/fail2ban/jail.local, and check after module updates that the line is still there.

Block them too

SIP scanners rotate through a few thousand addresses that are already on the list. Dropping the list at the firewall (ipset or nftables, or your router) stops most of them before they reach Asterisk at all.

Need a hand?

If something here does not work with your version of Asterisk and FreePBX, or you have improved it, tell us. We update these pages with what people send.

Asterisk and FreePBX and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.