《FreeSWITCH案例大全》

sudo apt-get install fail2ban

touch /etc/fail2ban/jail.d/freeswitch.local

[freeswitch]
enabled = true
filter = %(known/filter)s[_pref_line='(?: [\d\.]+%%%%)?']
banaction = ufw
maxretry = 5
findtime = 3600
bantime = 259200
ignoreip = 127.0.0.1/32
port = 5060,5061
logpath = /usr/local/freeswitch/log/freeswitch.log

cat /etc/fail2ban/filter.d/freeswitch.conf

# Fail2Ban configuration file
#
# Enable "log-auth-failures" on each Sofia profile to monitor
# <param name="log-auth-failures" value="true"/>
# -- this requires a high enough loglevel on your logs to save these messages.
#
# In the fail2ban jail.local file for this filter set ignoreip to the internal
# IP addresses on your LAN.
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = freeswitch

# Parameter "mode": normal, ddos or extra (default, combines all)
# Usage example (for jail.local):
#   [freeswitch]
#   mode = normal
#   # or with rewrite filter parameters of jail:
#   [freeswitch-ddos]
#   filter = freeswitch[mode=ddos]
#
mode = extra

# Prefix contains common prefix line (server, daemon, etc.) and 2 datetimes if used systemd backend
_pref_line = ^%(__prefix_line)s(?:(?:\d+-)?\d+-\d+ \d+:\d+:\d+\.\d+)?

prefregex = ^%(_pref_line)s \[WARN(?:ING)?\](?: \[SOFIA\])? \[?sofia_reg\.c:\d+\]? <F-CONTENT>.+</F-CONTENT>$

cmnfailre = ^Can't find user \[[^@]+@[^\]]+\] from <HOST>$

mdre-normal = %(cmnfailre)s
              ^SIP auth failure \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip <HOST>$

mdre-ddos   = ^SIP auth (?:failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip <HOST>$

mdre-extra  = %(cmnfailre)s
              <mdre-ddos>

failregex = <mdre-<mode>>

ignoreregex =

datepattern = ^(?:%%Y-)?%%m-%%d[ T]%%H:%%M:%%S(?:\.%%f)?
              {^LN-BEG}

# Author: Rupa SChomaker, soapee01, Daniel Black, Sergey Brester aka sebres
# https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban
# Thanks to Jim on mailing list of samples and guidance
#
# No need to match the following. Its a duplicate of the SIP auth regex.
#  ^\.\d+ \[DEBUG\] sofia\.c:\d+ IP <HOST> Rejected by acl "\S+"\. Falling back to Digest auth\.$

## 启动系统服务
systemctl start fail2ban
## 重启系统服务（修改配置生效）
systemctl restart fail2ban
## 停止系统服务
systemctl stop fail2ban
## 用fail2ban-client命令启动服务
fail2ban-client start
## 用fail2ban-client命令重载全部配置（修改配置生效）
fail2ban-client reload
## 用fail2ban-client命令重载指定监禁配置（把<JAIL>换成具体的名称）
fail2ban-client reload <JAIL>
## 用fail2ban-client命令停止服务
fail2ban-client stop
## 查看当前保护状态
fail2ban-client status
## 查看当前保护的具体服务状态（把<JAIL>换成具体的名称）
fail2ban-client status <JAIL>
## 查看版本
fail2ban-client version
## 手动监禁一个IP（把<JAIL>换成具体名称，把<xx.xx.xx.xx>换成具体IP）
fail2ban-client set <JAIL> banip <xx.xx.xx.xx>
## 手动将一个IP解除监禁（把<JAIL>换成具体名称，把<xx.xx.xx.xx>换成具体IP）
fail2ban-client set <JAIL> unbanip <xx.xx.xx.xx>

ufw status

Status: active

To                         Action      From
--                         ------      ----
Anywhere                   REJECT      194.61.28.102
Anywhere                   REJECT      193.107.216.55
Anywhere                   REJECT      193.107.216.29
Anywhere                   REJECT      193.107.216.143
22/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
....