Solved Is there a 3CX Global Blacklist Lookup?

[sditn]

I have received an email alert to say a given IP address "has made numerous attempts to authenticate with 3CX with invalid details. In response, 3CX has created a blacklist rule denying this IP to continue sending requests."

Wonderful, though that same email says that blacklist entry "will expire on: Monday, 28 February 2022 16:04:12". which has now passed.

I look up the IP and I am happy it is malicious so I want to make sure it is always blacklisted - so I try to add it to the IP Blacklist.

Even though that IP address is NOT in my blacklist, when I try to add it I get the error "This IP address is already in the blacklist"

I now understand that IP address may be in the 3CX Global Blacklist described at https://www.3cx.com/blog/voip-howto/global-ip-blacklist/ which is fine.

Here are my questions / points:

> If we get an alert like this the email should SAY it is in the Global Blacklist rather than my local install blacklist.
> Is there a 3CX Global Blacklist Lookup so I can verify the IP really is in that blacklist and when it is really going to expire?
> If that IP 'drops off' the 3CX blacklist, then it looks like we could be exposed again. I want to add it myself but I can't. Do we wait to be exposed before we can tighten things up?

I think this needs some work.

 

[ChrisC_3CX]

Even though that IP address is NOT in my blacklist, when I try to add it I get the error "This IP address is already in the blacklist"

I now understand that IP address may be in the 3CX Global Blacklist described at https://www.3cx.com/blog/voip-howto/global-ip-blacklist/ which is fine.

That should indeed be the case.

If we get an alert like this the email should SAY it is in the Global Blacklist rather than my local install blacklist.

If an IP get's added to the 3CX Global blacklist, you will not receive an email. If you received an email for this IP then it means that it is your PBX that blocked it.

Is there a 3CX Global Blacklist Lookup so I can verify the IP really is in that blacklist and when it is really going to expire?

No way to search through the 3CX Global IP blacklist, but, if you are trying to add an IP that does not exist in your local ip blacklist, as you have seen, it will not allow you so that is an indication that it exists in the global one.

If that IP 'drops off' the 3CX blacklist, then it looks like we could be exposed again. I want to add it myself but I can't. Do we wait to be exposed before we can tighten things up?

IPs in the Global blacklist will not automatically get removed for no reason, if an IP does get removed then there would be a reason for it such as it being deemed as safe so I wouldn't say that you'll ever be exposed. In any case, should you want to manually add an IP to your PBX's local blacklist, what you can do is, disable the global black list, enter the ip to your PBX local list and then re-enable the 3CX global blacklist.

 

[sditn]

Thanks very much for your comprehensive response!

 

[ChrisC_3CX]

You're very welcome!

Do let us know if you need additional information or assistance with anything!