Solved Does IP blacklist impact performance after large number of entries?

[Just-a-volunteer]

Currently running v18, but when we were on V16, we were getting so many repeated hack attempts that I extended the IP ban time (Blacklist time interval) from 24hrs to about 16 or so years (500000000 seconds). I originally noticed we were getting many repeat IPs after the 24 hr ban had lapsed and that's why I extended it.

In the last year or so, the blacklist has grown to over 3,000 entries. However, I've noticed that the attacks haven't been as often as they used to be. Don't know for sure, but I concluded that it was because of the ban time that I had configured.

I would imagine, at some point, this becomes counterproductive since it could degrade the system performance. However, I haven't noticed much of a hit. This is a Debian install running on a dedicated i5 4th gen SFF PC with 8 gigs of RAM and a 320 gig drive. We have 14 extensions but only 3-4 are used most of the time. The others are in rooms for emergency calls mostly.

Should I be concerned about performance? Is there something else that might be affected as a result of this very large list?

 

[Saqqara]

Do you have 3cx blacklist enabled https://www.3cx.com/blog/voip-howto/global-ip-blacklist/

 

[ChrisC_3CX]

Generally speaking you should be fine if you stay within our hardware recommendations. Nevertheless, like @Saqqara I too highly recommend you enable the 3CX Global black list since a good chunk of those IPs may very well already be in there.

 

[Just-a-volunteer]

Do you have 3cx blacklist enabled https://www.3cx.com/blog/voip-howto/global-ip-blacklist/

Yes, that was one of the first things I enabled but that didn't stop the large number of hack attempts

 

[ChrisC_3CX]

In that case it must've been unknown IPs at the time as your PBX may have been one of the early targets. In any case, leaving it enabled will definitely help mitigate the situation and the fact that you have a lot of entries in the PBX's IP blacklists at least means that the specific PBX's security mechanisms are doing their job for cases that are not in 3CX's global blacklist all in all meaning that we got you covered

If for any reason you want to minimize the list I guess you could always export it and then use that list to block the IPs completely on the firewall level instead. Provided of course you manage the firewall and this would be easy to do. Just an idea.

 

[Just-a-volunteer]

good idea about migrating the IPs to the main firewall. I'll look into that.

It's good to know I'm not bogging down the PBX with all the entries on the blacklist. Thanks for all the details!

 

[ChrisC_3CX]

You're very welcome!

Let us know if you need anything else!