Solved IP Blacklisted but still getting through

Discussion in '3CX Phone System - General' started by michaelholt, Feb 13, 2017.

Thread Status:
Not open for further replies.
  1. michaelholt

    Joined:
    Oct 9, 2015
    Messages:
    18
    Likes Received:
    3
    As the subject says, I have blacklisted an IP address but it is still getting through trying to register. Because registration via WAN is turned off, they can't make a phone call. Also, I am getting this message exactly every 8 minutes:


    The IP 195.154.214.162 has been blacklisted for 1800 sec. (Expires at: 2017/0212 23:56:41).

    Reason: Too many failed authentications!​

    I have done these things:
    1. Blacklisted the IP
    2. Blocked the IP at the firewall

    None of these things have stopped these messages. Also, every 2 minutes, this IP tries to register with an extension which does get blocked but if the IP is blacklisted, how does it get this far?
     
  2. YiannisH_3CX

    YiannisH_3CX Support Team
    Staff Member 3CX Support

    Joined:
    May 10, 2016
    Messages:
    5,486
    Likes Received:
    357
    Hello @michaelholt

    This sounds very strange indeed. What version PBX are you on? Since you blocked it at your firewall level it shouldn't reach the PBX server.
    Make sure you block the IP to port 5060 TCP and UDP and see if that males a difference. Also when did this start? Could it be that the messages you are getting happened prior to the IP being blocked?
     
  3. michaelholt

    Joined:
    Oct 9, 2015
    Messages:
    18
    Likes Received:
    3
    You know, I only blocked tcp as I was in a hurry. That's an awesome suggestion. Thank you. I'll see what happens after that.

    That hacker has now apparently stopped as the messages quit. I guess they went to bed. They are in France.

    Also, the 3CX server rebooted to which all the messages stopped at that time. This makes me wonder if a service in 3CX was somehow preventing the ip blacklist. I am so glad for the WAN registration block.
     
  4. YiannisH_3CX

    YiannisH_3CX Support Team
    Staff Member 3CX Support

    Joined:
    May 10, 2016
    Messages:
    5,486
    Likes Received:
    357
    I am assuming that the messages you saw where generated before the number was blacklisted as they should normally be blocked by your firewall.
    Keep an eye on it and us know how it goes
     
  5. michaelholt

    Joined:
    Oct 9, 2015
    Messages:
    18
    Likes Received:
    3
    All is good now. Thank you so much for your help. Without your suggestion, I might not have went back and looked at udp. You saved my entire night as I would have been up trying to stop it before everyone came in at about 5am.
     
  6. YiannisH_3CX

    YiannisH_3CX Support Team
    Staff Member 3CX Support

    Joined:
    May 10, 2016
    Messages:
    5,486
    Likes Received:
    357
    Glad to hear the issue is resolved
     
Thread Status:
Not open for further replies.