asterisk users - Apr 2020 - Can't block intrusion

On 2020-04-01 15:12, Greg Troxel wrote:
> D'Arcy Cain <darcy at VybeNetworks.com> writes:
> But yet, new packets from that IP address reach asterisk.   It seems
> almost entirely clear to me that you have a firewall problem, not an
> asterisk problem.
This could well be but Asterisk is the only thing that continues to
communicate.
> I would test this out with a remote machine under your control, and
> packet trace.  I would check for a buggy firewall rule that is somehow
> accepting packets from new tcp or udp packets as matching an old
> connection state object.  I would check for the new attempts as coming
> from something that matches the original "connection", even if
UDP.
Here is the first four lines from "pfctl -sr":

pass in quick on bge0 from <FRIENDS> to any flags S/SA keep state
block drop in log quick on bge0 from <ENEMIES> to any
block drop in log quick on bge0 from <AUTOBLOCK> to any
block drop out log quick on bge0 from any to <AUTOBLOCK>

Unless pf is broken I can't see how anything besides my "friends"
can be
getting through.
>> The weird thing is that the attempts don't stop.  That IP continues
to
>> try different numbers.  There are two ways that I have found so far to
> 
> You say "continues to try", but surely you are not surprised that
> packets arrive at your computer.  I think you are surprised that they
> make it to asterisk.  But your language doesn't quite line up with
> that.  Am I misinterpreting?
Maybe.  By "try" I don't mean "try to get through".  I
mean "try to
access my switch".  They aren't actually breaking in.  My passwords are
strong enough to frustrate them.

-- 
D'Arcy J.M. Cain
Vybe Networks Inc.
A unit of Excelsior Solutions Corporation - Propelling Business Forward
http://www.VybeNetworks.com/
IM:darcy at VybeNetworks.com VoIP: sip:darcy at VybeNetworks.com

D'Arcy Cain <darcy at VybeNetworks.com> writes:
> Here is the first four lines from "pfctl -sr":
>
> pass in quick on bge0 from <FRIENDS> to any flags S/SA keep state
> block drop in log quick on bge0 from <ENEMIES> to any
> block drop in log quick on bge0 from <AUTOBLOCK> to any
> block drop out log quick on bge0 from any to <AUTOBLOCK>
agreed that I can't see it.
>> You say "continues to try", but surely you are not surprised
that
>> packets arrive at your computer.  I think you are surprised that they
>> make it to asterisk.  But your language doesn't quite line up with
>> that.  Am I misinterpreting?
>
> Maybe.  By "try" I don't mean "try to get through".
I mean "try to
> access my switch".  They aren't actually breaking in.  My
passwords are
> strong enough to frustrate them.
Yes, but the fact that the sender is sending packets is no surprise.
The issue is about  how those are handled.   I think you need to use
tcpdump and turn up firewall debugging.

On 1 Apr 2020, at 22:14, Greg Troxel <gdt at lexort.com>
wrote:
> 
> I think you need to use tcpdump and turn up firewall debugging.

sngrep is your friend …My bet is UDP vs TCP on firewall rules :-)

Mark

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.digium.com/pipermail/asterisk-users/attachments/20200401/d5366a6b/attachment.html>