Community discussions

 
Martijnscheffer
just joined
Topic Author
Posts: 4
Joined: Wed Dec 04, 2013 1:08 pm
Location: Spain, Moraira

Block SIP attacks using Mikrotik Firewall

Wed Dec 04, 2013 1:30 pm

Hi,

Sorry I am new to the forum so let me know if I add this topic to the incorrect section.

I am using an RB1200 v5.21 and trying to setup a firewall to block unwanted SIP traffic / attacks to my Asterisk server, withouth blocking the IP´s from the genuine customers.
Have tried to block IP addresses after 15 x content="SIP/2.0 401 Unauthorized within a certain period of time but eventually this will also block my genuine customers as sip traffic alway responds with content="SIP/2.0 401 Unauthorized before connecting. (also tried same method with 403 Forbidden)

Does anyone know a good method to block unwanted SIP traffic on the Mikrotik Firewall without blocking the IP addresses of genuine customers?
Also allowing only the customers IP addresses is not an option as they take their VoIP phones with them to different locations.

Thank you,

Martijn.
 
aaronhun22
Frequent Visitor
Frequent Visitor
Posts: 97
Joined: Fri Nov 15, 2013 2:15 am
Location: Las Vegas, Nevada, USA

Re: Block SIP attacks using Mikrotik Firewall

Thu Dec 05, 2013 2:11 am

You can use SPI on new connections with:
/ip firewall filter add chain=forward in-interface=ether1-gateway src-address-list="SIP Hacker" action=drop
/ip firewall filter add chain=forward protocol=udp dst-port=5060 connection-state=new src-address-list="SIP Trial" in-interface=ether1-gateway action=add-src-to-address-list address-list="SIP Hacker" address-list-timeout=1d
/ip firewall filter add chain=forward src-address=0.0.0.0/0 protocol=udp dst-port=5060 in-interface=ether1-gateway connection-state=new action=add-src-to-address-list address-list="SIP Trial" address-list-timeout=00:00:15 
What this does is watch for new sip registration connections on port 5060 and if they can't get a successful handshake with your sip server within 15 seconds (authentication should only take 3 seconds or less) then they're IP is banned for 1 day. This actually works with other servers such as SSH, FTP, etc.
 
Martijnscheffer
just joined
Topic Author
Posts: 4
Joined: Wed Dec 04, 2013 1:08 pm
Location: Spain, Moraira

Re: Block SIP attacks using Mikrotik Firewall

Thu Dec 05, 2013 3:36 pm

Hi Aaronhun22.
I have been testing it and it seems work well in a small test envirement, now going to implement it on our main routers.
I have been trying to find a good solution for a while now and have tried all sorts of complicated things.
Yours however seems fairly simple, yet most effective solution yet.

Thanks a lot,

Martijn.
 
Martijnscheffer
just joined
Topic Author
Posts: 4
Joined: Wed Dec 04, 2013 1:08 pm
Location: Spain, Moraira

Re: Block SIP attacks using Mikrotik Firewall

Fri Jan 03, 2014 5:02 pm

Unfortunately we found this not to work after doing more testing.
All the rule does is block an IP if there is a second connection coming in from the same IP within 15 seconds. (despite registration).
If a customer would try to register 2 or more SIP devices at the same time his IP would get blocked.

Any other ideas are much appreciated.
 
aaronhun22
Frequent Visitor
Frequent Visitor
Posts: 97
Joined: Fri Nov 15, 2013 2:15 am
Location: Las Vegas, Nevada, USA

Re: Block SIP attacks using Mikrotik Firewall

Thu Jan 09, 2014 2:19 am

You can change the timeout to more than 15 sec. Also if 1 IP already has a registered phone and a new one tries it will start a new 15 sec trial. Its like you said; connections are only blocked during the 15 sec trial. 15 is long since registration usually takes only 3 sec per device.
 
Martijnscheffer
just joined
Topic Author
Posts: 4
Joined: Wed Dec 04, 2013 1:08 pm
Location: Spain, Moraira

Re: Block SIP attacks using Mikrotik Firewall

Thu Jan 09, 2014 11:49 am

Ok, but we have locations with over 20 sip devices.
If the router reboots, they will all try to register at the same time and the IP will definately get blocked.
 
aaronhun22
Frequent Visitor
Frequent Visitor
Posts: 97
Joined: Fri Nov 15, 2013 2:15 am
Location: Las Vegas, Nevada, USA

Re: Block SIP attacks using Mikrotik Firewall

Fri Jan 10, 2014 10:22 pm

I can't answer for your PBX but I do know that on Asterisk when a SIP extension connection is lost they don't reregister when the connection comes back online because Asterisk already knows the IP address of the incoming extension. So for your router SPI wouldn't treat these connections as new since they're already established.
 
sveno
newbie
Posts: 40
Joined: Mon May 14, 2012 8:29 pm

Re: Block SIP attacks using Mikrotik Firewall

Thu Aug 13, 2015 2:32 pm

Great filters thank you.

I have a odd problem though: although the drop rule on the forward chain gets 200 hits/second - the packets are still forwarded and NOT dropped. What could cause this?

Who is online

Users browsing this forum: Baidu [Spider], MSN [Bot] and 13 guests