This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

I read the Rulz, I've created a DNAT blackhole rule, and I'm still getting the same IP hitting the voip server on my LAN.

I saw a few people have had similar issues so I read their threads over a few times and made some changes on my UTM before posting this.

I've been watching as a particular IP tries to brute-force its way into my Asterisk sever despite firewall rules blocking it. After seeing the other posts, I created a static blackhole route to 224.0.0.5, then created a DNAT for traffic to my WAN port from the offending IP to go to 224.0.0.5, and waited. Just saw another one at the Asterisk server.

Any suggestions? My software is at 9.701-6.

thanks

Kevin

This thread was automatically locked due to age.

Parents

0 Alexander Busch over 4 years ago

Is the blackhole DNAT before your regular rule?
Maybe show us an edit of your rule.

Best regards
Alex

-
Cancel
Vote Up 0 Vote Down

Cancel
0 Kevin Kretz over 4 years ago in reply to Alexander Busch

Hi,

Thank you for the reply. The Blackhole DNAT is at the top of my NAT rules, and the blackhole route to the nonexistent IP (blackhole2 in the rule) is my only static route.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alexander Busch over 4 years ago in reply to Kevin Kretz

Your protected host is published via DNAT too, correct?
Is that address in Going to your external WAN IP? And maybe it’s better to use an IP of a not existing host instead of a multicast IP.
But nevertheless the DNAT should work with that IP too. Sorry other things I don’t see at the moment.

Best regards

Alex

-
Cancel
Vote Up 0 Vote Down

Cancel
0 Kevin Kretz over 4 years ago in reply to Alexander Busch

Alex,

My protected host (PBX9) is not published via DNAT. It's defined under VOIP settings , and I have a firewall rule allowing SIP protocol out from PBX9.

The 224 address was suggested in another post, maybe I misunderstood. I changed it to another unused IP and will see if anything changes.

Thank you again

Kevin
Cancel
Vote Up 0 Vote Down

Cancel
0 Alexander Busch over 4 years ago in reply to Kevin Kretz

Hi Kevin,

thanks for clarification. Probably that’s why the blackhole DNAT rule is not working.
https://community.sophos.com/cfs-file/__key/communityserver-discussions-components-files/51/iptables-sequence.JPG

Sorry no better idea for that.

Best regards

Alex

-
Cancel
Vote Up 0 Vote Down

Cancel
0 Kevin Kretz over 4 years ago in reply to Alexander Busch

I'm sorry Alex - do you mean it's probably not working because of the VOIP configuration, or because of the (now changed) multicast blackhole IP?
Cancel
Vote Up 0 Vote Down

Cancel
0 Alexander Busch over 4 years ago in reply to Kevin Kretz

No, maybe that DNAT blackhole is processed after the connection is handled by the voip (helper / proxy). That’s be caused by the structure of the UTM.
Sorry my knowledge of the VoIP helper is bad. So I am not sure, but that’s my best guess.

BR

-
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Alexander Busch over 4 years ago in reply to Kevin Kretz

No, maybe that DNAT blackhole is processed after the connection is handled by the voip (helper / proxy). That’s be caused by the structure of the UTM.
Sorry my knowledge of the VoIP helper is bad. So I am not sure, but that’s my best guess.

BR

-
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data