My trunk provider's IP has been blacklisted from 3CX

[kyriacos.it]

Hello guys,

I am not receiving incoming calls. The reason being was that my IP's trunk provider was blacklisted.

Now I have whitelisted the IP but I am not getting incoming calls yet.

I looked at the events and I saw that I have been getting blacklisted for quite a long time now.

Event log / Warnings
The IP 1xx.xxx.xxx.xxx has been blacklisted for 201 sec. Reason: requests rate is too high!
SIP Server ID: xxxxx 04/05/2022 15:32:59

I have a lot of this warnings


Does anyone knows what other reason could be that I'm not getting incoming calls?

Could it be that 3CX blacklist my IP forever o for a long period of time ? Is there a way to change this ?

 

[leejor]

You might start by telling us who your trunk provider is. Is it a supported provider?

 

[SteveITS]

Add your SIP provider IPs to the Security/IP Blacklist page as Allow.

 

[kyriacos.it]

Hello guys thanks for your replies,

My provider is Megacall is not a supported provider

I have also alow/whitelist it the IP from my provider as soon as I realised that it was being blacklisted. This has not solved the issue.

I do not know if when you are blacklisted many times if you can be blacklisted forever or for long period of time because you have been abusive many times over time. ( this last bit is a theory)

Any ideas to solve the issue are welcome.

 

[leejor]

The solution would be to find out why (from your provider?) you get the Reason: requests rate is too high!

If whatever is causing that, is not corrected, then the IP would continue to be blacklisted.

 

[kyriacos.it]

Indeed that is the warning that I get from the event log ( Reason :request rate is too high)

From that warning I started the following actions:

Whitelist it my IP and the provider's IP

Contacted my provider to double check everything was working on their site also to make sure I was whitelisting the right IP

Still not working...

I will check if there is any other IP that needs to be whitelist it.But don't think so...

 

[YiannisH_3CX]

Hi @kyriacos.it

As a troubleshooting step try disabling the 3CX global blacklist if enabled, although if you whitelisted the providers IP that should have worked. Make sure that your provider is only using one IP address and the requests are not coming from multiple IPs.
Then run a packet capture and filter with the providers IP to check what the provider is sending and the reason it gets blacklisted.
You might be getting traffic that should not be headed to your system.

Also do outbound calls work? Run an outbound call and leave it running for a minute. Does that work?

 

[kyriacos.it]

Hello @YiannisH_3CX and everyone else,

I forgot to mention that I already disable the 3CX glocal blacklist when I whitelist it the IPs from the provider.

We have only that IP with our provider.

And I also forgot to mention that the outbound calls are working.

I believe we're under an attack because now the block WAN request is ON.

Also a bunch of IPs that I haven't seen before are showing up

What the procedure to follow for this type of action ?

Thanks in advance

 

[YiannisH_3CX]

I forgot to mention that I already disable the 3CX glocal blacklist when I whitelist it the IPs from the provider.

Also a bunch of IPs that I haven't seen before are showing up

You are now seeing more IPs because the blacklist in off. Scammers scan systems all the time but the global blacklist prevents most of it.

We have seen cases in the past where the SIP Trunk provider was also internet provider and attacks seems to be coming from their IP so they were getting blacklisted. Perhaps its the same case with you

However since your outbound calls are working the IP is not blacklisted by 3CX. If it were the calls would go out but the response from the provider would be blocked preventing the call from being established.

The error you are getting is triggered by the anti-hacking module of 3CX as something is triggering the security barriers. I believe your only option now is to run a packet capture and see what traffic is coming to the PBX to determine the cause of the issue.

 

[kyriacos.it]

So an update I ran the packet capture and what I see it's that 3CX is refusing the INVITE from my SIP trunk provider.

I will buy support form 3CX to try to fix it because all the troubleshooting done until this point has not worked so far

 

[kyriacos.it]

Thanks for all the support guys !!

Especially @YiannisH_3CX