Blacklist

[gyates82]

I have a few problems with the blacklist.

First, I cant reconcile the blacklist time in these messages. My blacklist time is actually days, not minutes, which worked fine in v14:

The IP 52.32.205.214 has been blacklisted for 1001 sec.
Reason: Requests rate is too high!

In this example it shows 1001 seconds, but in other messages the time ranges seemingly randomly from 12 to 201 seconds. The blacklist action doesn't seem to take into account the blacklist timeout I've set.

Second,
Under IP Blacklist in Security, the blacklisted IP's are not displayed, event though the dashboard (and the activity log) show there to be active blackisted IP addresses.

 

[Davidch]

+1

I have the same probleme

 

[gyates82]

Bump. Sorry. Fending off huge numbers of attacks.

 

[Pierre_3CX]

Hi there,
Please open support tickets so that we can review your logs and help further on this.

In the meantime, some prevention steps can be taken from your side
- in the Settings / Security / Anti-Hacking / divide each values by two, except the blacklist time interval, and the security barrier (green). Set the blacklist time interval to a higher value such as 31536000 (1 year).
- in your firewall, filter the SIP port to allow only trusted sources, meaning your VoIP providers IP/range, and remote extensions (if any).
- validate, restart services.