Everyday we are blacklisted

[jweldon]

So last four days every morning I come into the office and try to use my mobile app or something it tells me I am blacklisted. We keep having to go to the blacklist local and remove our WAN IP from the list.

I just whitelisted it, but why would our WAN IP be getting blacklisted? I keep seeing registration attempts from various IPs but when i try to blacklist them it says that 3cx is already done it. So how to i stop from have to remove our WAN ip everyday?

 

[Vali_3CX]

You have to check the PBX log for more details, because it's not necessary THAT mobile app is at fault, since all the devices in your office (mobile, desktop clients) all are connecting to the PBX from same WAN IP.

 

[cobaltit]

You can also whitelist your WAN IP.....

 

[jweldon]

You have to check the PBX log for more details, because it's not necessary THAT mobile app is at fault, since all the devices in your office (mobile, desktop clients) all are connecting to the PBX from same WAN IP.

Well keep seeing an extension 107 trying to register, but we don't have a 107.

 

[leejor]

Well keep seeing an extension 107 trying to register, but we don't have a 107.

...and what IP is that extension attempting to register from? That is an IP that should be blocked, and 3CX will usually do so after a set number of failed attempts (which you can adjust). You can also greatly increase the time that the blacklist lasts, which is a good idea.Many times blocking a single IP doesn't work for long, as the hackers simply increment and try again. You then need to change the subnet to cover any additional IPs that they may use. You'll usually see a pattern.

 

[jweldon]

Well keep seeing an extension 107 trying to register, but we don't have a 107.

07/29/2022 3:27:19 PM - [CM102001]: Authentication failed for AuthFail Recv Req REGISTER from x.x.x.x:5060 tid=-2fa9b96d Call-ID=[email protected]: REGISTER sip:138.68.250.147 SIP/2.0 Via: SIP/2.0/UDP 192.168.10.192:5060;branch=z9hG4bK-2fa9b96d;received=24.205.254.150 Max-Forwards: 70 Contact: "107" <sip:[email protected]:5060>;expires=3600 To: "107" <sip:[email protected]> From: "107"<sip:[email protected]>;tag=52f3e55aee6e155ao0 Call-ID: [email protected] CSeq: 180392 REGISTER Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER Proxy-Authorization: Digest username="ar3Fu27PDr",realm="3CXPhoneSystem",nonce="414d535962e45ec723:dcbd8455aee9a4d66eed71f9b89d976c",uri="sip:138.68.250.147",algorithm=MD5,response="e3c9a1002907b0c0906631d897231558" Supported: replaces User-Agent: Cisco/SPA112-1.3.5(004p) P-Station-Name: ;mac=00da55b62add; display=""; sn=CCQ2037063C Content-Length: 0 ; Reason: Credentials don't match, check that authorization-ID and password match the ones in extension setting

...and what IP is that extension attempting to register from? That is an IP that should be blocked, and 3CX will usually do so after a set number of failed attempts (which you can adjust). You can also greatly increase the time that the blacklist lasts, which is a good idea.Many times blocking a single IP doesn't work for long, as the hackers simply increment and try again. You then need to change the subnet to cover any additional IPs that they may use. You'll usually see a pattern.

yeah after i posted that we started looking deeper. Think we found the cause. Thank you forum!