Re: How to block H.323 spam calls with fail2ban

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Robert Kulagowski via gnugk-users wrote:
> On Mon, Aug 12, 2019 at 5:21 AM Jan Willamowius via gnugk-users
> <gnugk-users@xxxxxxxxxxxxxxx> wrote:
> > when you run the GNU Gatekeeper, you can block spam calls from the well
> > known bots ("MERA RU", "SimpleOPAL" etc.) eg. using a small LUA script
> > in your config.
> >
> > But that alone doesn't stop the load on the server, because often these
> > bots keep on making calls.
> >
> > Fail2ban to the rescue!  
> 
> Is the lua script available somewhere? I looked at the documentation,
> and I didn't see it in the Appendix, and it doesn't appear that it was
> in the tarball as far as I can tell.


I'm, using a simple one-line script to block the bots:

[LuaAuth]
CallScript=if (string.find(vendor, "MERA RTU") or string.find(srcInfo, "cisco") or string.find(vendor, "SimpleOPAL")) then result = "Fail"; else result = "OK"; end

[Gatekeeper::Auth]
LuaAuth=required;ARQ;Setup


Regards,
Jan

-- 
Jan Willamowius, Founder of the GNU Gatekeeper Project
EMail  : jan@xxxxxxxxxxxxxx
Website: https://www.gnugk.org
Support: https://www.willamowius.com/gnugk-support.html

Relaxed Communications GmbH
Frahmredder 91, 22393 Hamburg, Germany
Geschäftsführer: Jan Willamowius
HRB 125261 (Amtsgericht Hamburg)
USt-IdNr: DE286003584
_______________________________________________________

Posting: mailto:gnugk-users@xxxxxxxxxxxxxxx
Archive: https://lists.gnugk.org/pipermail/gnugk-users/
Unsubscribe: https://lists.gnugk.org/lists/listinfo/gnugk-users
Homepage: https://www.gnugk.org/




[Index of Archives]     [SIP]     [Open H.323]     [Gnu Gatekeeper]     [Asterisk PBX]     [ISDN Cause Codes]     [Yosemite News]

  Powered by Linux