IP Blacklist Rules not being followed

[Seiten]

I have an On-Premises local Debian installation (18.0 (Build 889)) for a small home-office scenario. I have a Pfsense router with IP Geoblocking, but am getting multiple notices where certain IP addresses are attempting entry via my FQDN port 5001.



My Failed Authentication Setting is set for 2....



However, I see certain IP addresses exceeding the number Ive set, but no entry into the Blacklist for that IP exists. I have set the Blacklist time interval to a time equal to about 10 years. Im aware that HQ pulls down some history of failed IP address sources and Ive noticed that some IPs I try to add are denied as already existing, yet they are not physically in my list. (Assuming its referring to the 3cx master list.)

Can anyone explain this or am I missing a key setting?

Many thanks...

 

[silicon2]

I would also be keen to see a proper answer/response to this question as I am seeing a similar issue. If the ip address is denied as being present already - it would be better for the error message to state it is in the Shared Global Blacklist.
I'd also like to understand where the blocking happens is this via Windows firewall rules updates on the Windows instance, or is this blocked/handled by 3CX itself transparently?

 

[bitn2]

This option is just for sip attempts, you can vote here for a better solution: https://www.3cx.com/community/threa...nt-and-management-console.119205/#post-554300

 

[Seiten]

This option is just for sip attempts, you can vote here for a better solution: https://www.3cx.com/community/threa...nt-and-management-console.119205/#post-554300

Thanks for the reply. Could you expand on this answer a bit, "only sip attempts". When I scan through my IP Blacklists, where some automated 3CX entries reside, I have descriptions that say the following:



This seems to indicate they are blocked from someone one trying to to the User management screen. Or, are these errors evidence of your SIP attempts blocking? Sorry, Im a newb!

 

[SteveITS]

See this thread: https://www.3cx.com/community/threa...considered-in-ip-blacklist.119034/post-554277
It seems that setting you posted is only for some types of connection attempts and the web client/management is hard coded to 10 attempts.

 

[Seiten]

See this thread: https://www.3cx.com/community/threa...considered-in-ip-blacklist.119034/post-554277
It seems that setting you posted is only for some types of connection attempts and the web client/management is hard coded to 10 attempts.

Many thanks. That explains it all.

 

[kwen1x]

Hi Seiten

see this feature suggestion

https://www.3cx.com/community/threa...mpts-webclient-and-management-console.119205/

please click on the vote+ button to make this feature more 'popular'