Blacklisted IP of the SIP trunk provider

[Triantafillos Paradas]

Hello,
Three times since yesterday, this is happening. The IP address of my sip trunk provider gets blacklisted.
The activity log has:


As a result, the sip trunk stops functioning and is changing its status to unregistered.


If I set the action for this IP to "Allow" then it works again. This is something I prefer to avoid so I am deleting the entry from the blacklist.

Is this a kind of attack?
I would like to hear your opinion and have some advice, please.

Thank you very much for your time.

 

[nub]

1, Is this a public ip or an internal proxy address?

2, White list the ip, set activity log to Verbose and save logs for 2 days at least.

3, Check activity log.

 

[eddv123]

Is this a kind of attack?

If its coming from your ITSP's address then no. Although confirm the address, password and username details all conform to what they have sent you (or exists on their online portal).

Also is this trunk IP authenticated or Registration based - I can only presume that it is Registration - if IP then something odd could be going on.

 

[dan_tx]

As a practice, I whitelist all of my sip trunk provider IP's just to prevent them from accidentally getting blacklisted. Not sure why you would not want to do this.

 

[YiannisH_3CX]

Hello @Triantafillos Paradas

I think you need to use wireshark to determine that is causing the provider to get blacklisted in the first place. You could be experiencing source identification issues that can cause the provider to spam you with Invites.

 

[Triantafillos Paradas]

Hello @YiannisH_3CX,
First, I would like to say thank you to all for your replies.

We use a second network card to connect to our VoIP provider (OTE) equipment, thru a dedicated line for VoIP telephony.

Maybe I should check the origin network card of the failed authentications. If it comes from the dedicated line then, I presume, it is OK to whitelist the IP permanently.

Thanks again.

 

[eddv123]

I have seen these sort of setups before, for security the provider sends a router which normally connects via VPN back to their network - am I right ?

Also you might want to peruse this helpful guide and confirm you have the setup as per the recommended specifications: https://www.3cx.com/blog/docs/network-configurations-supported-3cx-phone-system/

See: Multiple internet gateways (used by ISPs that offer VoIP Services)

 

[Triantafillos Paradas]

I have seen these sort of setups before, for security the provider sends a router which normally connects via VPN back to their network - am I right?

Yes.

 

[eddv123]

Should be pretty secure in that case - did you run the Wireshark capture as suggested by @YiannisH_3CX ?

 

[Triantafillos Paradas]

Not yet.