New IP Blacklist Entries are disappearing

[RadyAir]

One of our larger clients, 32SC Enterprise, is having an interesting problem,
which affects us in monitoring more than the client.

I am seeing alert emails for the same IP address being blocked - 4 separate alerts in a 28 minute period.
in the screenshot we are getting duplicates because of our own internal rule, so please ignore that.

When I log in to the system, I see the rule, but it disappears after just a minute or two, not sure exactly.
I have been putting permanent blocks in place today as a workaround. those work.

Is anyone else seeing this behaviour?
Thanks

 

[Charles_3CX]

Please check that the Automatic Global IP Blacklist is enabled in the Advanced > Anti-Hacking section. This IP is listed and blocked globally by default.

https://www.3cx.com/blog/voip-howto/global-ip-blacklist/

 

[RadyAir]

Yes, that is the case for the IP shown in my screenshot. Explains why I could not create a rule for this item.
I have now enabled this for our client.

However, I am getting alerts, which create temporary blocks, which only last a minute or two,
for other IPs that are Not on the Global list, which I am able to create permanent blocks for.
ie : 30.71.88.190 and 30.71.84.134 which were not on the list
though a similar 30.71.86.149 is on the global list.

so the issue remains, we are seeing IP's blacklisted, and then the same IP's blacklisted again the same day.
I've confirmed that the IP Blacklist interval is the default 86400 seconds, or one day,
so we should not be seeing them try again for 24 hours, yet they can in a few minutes.

 

[KyriacosS_3CX]

Hello,

If you navigate to Admin > Advanced > Anti-Hacking you will find a set of tunable settings used by the PBX to automatically blacklist IPs it considers as attackers. Perhaps the time interval before such an IP is cleared from the local blacklist has been lowered?

 

[RadyAir]

I see the Green, Amber and Red settings are new.
My defaults show 200/3000/6000 and I have changed this client to 200/2500/4000 before a full blacklist is applied.

I also notice these three are measuring "amount of packets" rather than failed Authentication...
but I don't see where that number of packets is defined.
When were these changes made? I can go check the release history of course.

Thanks, Randy