Sometimes you don’t want to mess around with people cracking into your SIP servers and run up your phone bill (aka toll fraud). So, with this little script, we block all traffic from anywhere and everywhere. Be careful, it’s pretty heavy handed. BTW, there are some outputs for ClearOS, IPtables and Ubuntu’s UFW.
This should be useful for people running, FreeSWITCH, Asterisk, OpenSIPS and Kamailio.
#!/bin/bash
################################################################################
# We don't like blocking of huge parts of the world, but we often don't have the
# time or resources to deal with those who try to haxor our networks. kthanksbye
################################################################################
# Edit this to fit your level of frustration.
REGISTRIES="CHANGE_ME"
# This is how I roll:
#REGISTRIES="(AfriNIC|APNIC|LACNIC|RIPE NCC)"
################################################################################
# APNIC Asia/Pacific Region
# ARIN North America Region
# AfriNIC Africa Region
# LACNIC Latin America and some Caribbean Islands
# RIPE NCC Europe, the Middle East, and Central Asia
################################################################################
IANA="http://www.iana.org"
IPV4_LIST="/assignments/ipv4-address-space/ipv4-address-space.txt"
REGEX="[0-9]{1,3}\.0\.0\.0/8"
BLOCK_LIST=`wget --quiet -O - ${IANA}${IPV4_LIST} | \
egrep "${REGISTRIES}" | \
awk '{print $1}' | \
sed "s/\//.0.0.0\//" | \
sed "s/^0*//"`
for NET in ${BLOCK_LIST}; do
if [[ ${NET} =~ ${REGEX} ]]; then
# Time to do your thing.
echo "Sorry to break things off, ${NET}, it's not you... it's me."
########################################################################
# IPtables
########################################################################
#iptables -I INPUT -j LOG --log-prefix "${NET} Dropped: " --log-level 7
#iptables -I INPUT -s ${NET} -j DROP
########################################################################
# ClearOS firewalls - Blocked Incoming Connections
# (add to the RULES section of /etc/clearos/firewall.conf)
########################################################################
#echo "${NET}||0x10000002|0|${NET}|| \\" | sed "s/\//_/"
########################################################################
# Ubuntu's UFW - Uncomplicated Firewall
########################################################################
#sudo ufw deny from ${NET}
fi
done
Happy hacking!
