Event ID 30051

[Nik_si]

Hello,

what can I do to reduce this kind of warnings? I know that it just doing its job but I want to help it. (see attached)

it comes from different kind of ip's and with my knowledge same ext. (100).

p.s The server is not under router or something, directly is hosted as public vm.

 

[OlegR_3CX]

Hi there.
Those IPs in the settings are unknown to you? And you can also see them as blacklisted after sometime?

 

[bitn2]

For me its the same since v20, those IPs are unknown for me.

Unidentified Incoming Call. Review INVITE and adjust source identification: INVITE sip:[email protected] SIP/2.0 Via: SIP/2.0/UDP 89.163.146.102;branch=z9hG4bK-1440278755;rport=57085 Max-Forwards: 70 Contact: <sip:[email protected]> To: "FPBX"<sip:[email protected]> From: "FPBX"<sip:[email protected]>;tag=3536363730633165313363340133343231363631393234 Call-ID: 357797048158560923189394 CSeq: 1 INVITE Accept: application/sdp User-Agent: PBX Content-Length: 0

 

[OlegR_3CX]

It seems that someone is trying to register on the 3CX System, so some kind of brute force attack.
Since it's a 5060 port used, you could maybe use your firewall and allow only know IP's to contact 5060 from the public network.

 

[Nik_si]

Hi there.
Those IPs in the settings are unknown to you? And you can also see them as blacklisted after sometime?

Hello,

is not known for me, server is in public (VPS) there is no firewall or something else. does debian-3cx has it's own firewall ?

how can I restrict this untrusted registrations?

 

[OlegR_3CX]

If you have access to your OS firewall, maybe you can try in there. You will need to use manuals of the nftables and see how this can be done.