900 sec WebClient IP Blacklist in v20

[Exactly]

I need to change that parameter, we get too many requests from outside and we can't use whitelist cause most of users got no static IP. What i can do beside all users on VPN?

 

[KyriacosS_3CX]

Are your actual users entering wrong credentials that often?

 

[Exactly]

It looks more like brute force, the system is open to the world because of people working remotely.
The login times also indicate that these are not login attempts by our users (at night, when they are not working).

 

[KyriacosS_3CX]

Is it affecting actual users though? The auto-blacklist is there to mitigate this type of issue, the server getting flooded with invalid requests.

There might be solutions beyond a VPN that allow your users to login from a known whitelisted IP if the random blocking frequently blocks their access too (eg proxy with auth).
In many cases having an actual firewall in front that limits incoming connections for example only to the countries/regions where you have users keeps things clean, but then if the random connections are from the same regions, it would not help.

It might be best to consult a network engineer or your ISP to see what options you really have.

 

[bitn2]

You could restrict your SIP Port to your trunk provider to get rid of this.