3CX IP blacklist not used??

[Michel (MGN)]

I see numerous invalid login attempts in the activity log. But even after many attempts I did not see 3CX block the IP's, but only return "invalid credentials" warning.
To block these connections I decided to manually add the IP's to the blacklist, but with all IP's I got a message telling me the IP already exists in the blacklist (the global 3CX blacklist).

So why weren't these IP's immediately blocked during connection? Or will 3CX always return invalid creds at login attempts, when an IP is blocked?

Or could it be that the IP's where added to the global list before I tried manually adding the IP's? How often is the global list updated?

 

[VasilisV_3CX]

Hi @Michel (MGN),

Update: It's a flat 3 tries. If you get the incorrect details entered 3 times, it should blacklist you. If yours is not doing this, then either the IP Address is 'Whitelisted' or something is wrong...

Or will 3CX always return invalid creds at login attempts, when an IP is blocked?

When an IP is blocked, you should see the following prompt immediately:



If you've whitelisted an IP or range, you'll get the Incorrect Username or Password prompt indefinitely until the correct details are entered.

 

[Michel (MGN)]

Actually, the setting "Failed Authentication Protection" was set rather high by default after install (not sure what the exact number was, I changed this to 5)

I see that login attempts from blocked IP's are not listed in the activity log. Is there a 'block log'??

 

[VasilisV_3CX]

Hi @Michel (MGN),

Actually, the setting "Failed Authentication Protection" was set rather high by default after install (not sure what the exact number was, I changed this to 5)

Change it back to 10, as I've double checked and edited my response. It shouldn't be necessary.

There isn't a block log so to speak, but you can see the IPs that have already been blocked in the IP Blacklist tab.