Jump to content

Notification Blacklist


mskenderian
 Share

Recommended Posts

I get notifications for ips that get blacklisted, in recents weeks i am getting more and more. specially from the same IP. We started blocking these IPs, but even though the IP is blocked, we still get notifications from that specific IP. 

anyway to disable these notification if the IP is already blacklisted?

Link to comment
Share on other sites

yes that would indeed be the correct way. but i am.

 

see below. 2nd line shows my entry that i blocked the connection.  1st line shows the PBX auto blocked it for me and i got a notification

image.png.bff38b07f42e3a62c3a54f39ec541187.png

 

image.thumb.png.3c8c48f9585fe58acb3349ad2f502e32.png

this particular machine is running 68.0.16

about to upgrade to .20 this week.

Link to comment
Share on other sites

Below is the logs from the PBX.

[8] 9:09:51.135	Accept connection from blacklisted address 192.240.110.202:50788 for 1000 msⓘ
[6] 9:09:52.136	Delete SIP connection 3352 from 192.240.110.202:50788ⓘ
[7] 9:09:52.136	Connection from 192.240.110.202:50788 closedⓘ

 

Link to comment
Share on other sites

The problem is that some devices will try immediately to reconnect when the TCP connection gets closed, which results in an own-device-DoS. That is why the PBX must wait for some time before closing the connection. 

Because of the way TCP/IP works the PBX needs to accept the connection before it can get the remote address. That does take some CPU. Firewall manufacturers will not go out of business anytime soon. 

Why we have two records remains a little mystery though. 

Link to comment
Share on other sites

I am not sure I understand you.

Let me clarify a few items, this PBX is not production. I do have a few devices provisioned to it for testing purposes. But this IP geolocates to florida. which i have no customers on the east coast.

Regardless of the fact the PBX needs to accept the connection, why am i still getting email notifications? I got 191 emails in the last 8 days for this particular IP.

Link to comment
Share on other sites

  • 2 weeks later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...