Blacklist time unstable

[Kane Wong]

Hello;

I set the "This is the time interval in seconds that an abusive IP Address remains in the blacklist" to 999999999, almost 31 years but it is found that some can be blocked until 2051 but some aren't. Any reason? Pls see my screen shot.

 

[AWS2P]

did you set 3CX time to blacklist before the first IP was added in the blacklist?

 

[Kane Wong]

did you set 3CX time to blacklist before the first IP was added in the blacklist?

Yes.

 

[Kane Wong]

Just another ip blacklisted few seconds ago, this ip is blocked for 31 years that meet my requirement. Weird, nothing changed for black list time interval.

 

[AWS2P]

you should enable automatic blacklist if not already done

 

[Kane Wong]

you should enable automatic blacklist if not already done
View attachment 14188

OK. I can enable it but if the blacklisted IP is legitimate, can I go back to the list and unblock it because some of my user might enter the bad password from home while access to the web client.

Also; I found this information from my alert email. Seems, different reason has different blacklisted length of time.

Case #1
IP 5.62.56.14 has been blacklisted on PBX xxxxxx.company.com.
Affected Module: SIP Server/Call Manager
User agent: 3CXPhoneSystem

The IP 5.62.56.14 has been blacklisted for 999999999 seconds. (Expires at: 2051/10/08 15:47:23).
Reason: Too many failed authentications!

Case #2
P 37.49.229.173 has been blacklisted on PBX xxxxxx.company.com.
Affected Module: SIP Server/Call Manager
User agent: Cisco

The IP 37.49.229.173 has been blacklisted for 100001 seconds. (Expires at: 2020-01-31 10:14:06).
Reason: Requests rate is too high!

 

[AWS2P]

since several month now with automatic blacklist enabled on my pbxs there's no more one IP locally
blacklisted so 3CX protection seems very good to prevent problems.

 

[cobaltit]

If you a legitimate IP is blocked you can't unblock it but you can turn off the blacklist if need be. But there's no way your user's should get on the blacklist just because they put in a bad password. The global blacklist blocks IPs that are seeing hitting multiple instances

 

[JohnS_3CX]

Hello;

I set the "This is the time interval in seconds that an abusive IP Address remains in the blacklist" to 999999999, almost 31 years but it is found that some can be blocked until 2051 but some aren't. Any reason? Pls see my screen shot.View attachment 14183

Depending on the failed attempts, the timer get compounded, adding more time as the amount of packets the PBX receives within a given time slice keep climbing

 

[Kane Wong]

By using the "Automatic Global 3CX IP Blacklist" function on 3CX, how the bad IP to be downloaded to my server? And the size of the download, if the download done everyday?

My understand is that the global list is stored in my server and the 3CX system inspects all incoming traffic to compare the ip address with the global list, if match, the 3CX will block it. I wish my understanding is correct.

 

[JohnS_3CX]

Hi Kane,

The Global Blacklist is downloaded automatically from the 3CX servers every day if you enable this feature, it's a very small download size of some kilobytes.

Your understanding is correct, attackers IPs will be added to the list and spread across all 3CX systems which have this feature enabled so that any malicious traffic will be automatically dropped if it matches the list.