As in TWELVE calls IN A ROW last evening. I had to turn off the ringer. This also happened on April 1st, but not since. I set up service in Mid march. I periodically get calls from "asterisk" as well, but never many in a row like this. What can I do?
I'm using THE Obi110 into a ATT U-verse gateway, with Voipmyway service. The calls do not show in the call history on the voipmyway control panel, but do show up in the Obi web interface.
Looking at your OBi Call History, which OBi Service are these calls coming in on? Is '101' and 'asterisk' showing up as the Peer Names? If so, what are the Peer Numbers?
Thanks for your reply. Below is a screenshot of the last of the calls from last evening. It looks like they ring for exactly 1 minute.
(http://dl.dropbox.com/u/1145005/Obi.JPG)
Somehow, it's coming in through your SP1 Service. Is that your VoIPMyWay account?
You might be able to block it with the following:
Voice Services -> SP1 Service -> X_InboundCallRoute : {101:},{ph}
bradwn,
Receiving 12 calls in a row looks like someone was trying to test something and it wasn't ringing his local extension.
As improbable as it may seem, I would verify with the Sip Provider to make certain you have a unique Username and ID to logon to their service. Perhaps ask them to give you new logon credentials.
Correct, SP1 is VoIPMyWay, nothing is set as SP2.
I'll check with them. I picked up on a couple of the calls, nothing audible on the other end.
Quote from: bradwn on May 06, 2011, 12:21:58 PM
Correct, SP1 is VoIPMyWay, nothing is set as SP2.
In VoipMyWay's vPanel, set 101 in the incoming routing to blacklist. That will keeping from getting to the Obi.
This is due to script kiddies running tools looking for insecure voip services. What happens is they dial looking for extensions that are improperly configured.
This has been escalated and is being researched as what we can do on the service side, but since we are not the makers of the obi or have one for testing we can not offer a answer on to how to block at the obi. Have you tried what the other users recommended about setting up the block routes on the obi?
Here is the official response / fix
Change the port of the user's local SIP port. This isn't relayed through our network.
It was more than likely someone scanning their ISPs range for open PBX servers.
It can't be blocked as it wasn't sent through our network. We have received several reports of this on various ISPs. Some people are scanning large blocks of IPs in an attempt to find Asterisk or SIP servers that are not secure. They are scanning ranges of IPs to see if there are open PBXes on them, then on any of the ones where there are open PBXes, they attempt to use them to make outbound calls.
Ok, a month later and after changing the port #, and I'm still getting calls occasionally. The latest ones occured on 5/21 and 5/23, from Peer Number "200" and "asterisk" (4 times). How do I make this stop? Can I block any calls that are not from a regular telephone number? Do I have to just live with this?
Quote from: bradwn on June 08, 2011, 02:41:17 PM
Ok, a month later and after changing the port #, and I'm still getting calls occasionally. The latest ones occured on 5/21 and 5/23, from Peer Number "200" and "asterisk" (4 times). How do I make this stop? Can I block any calls that are not from a regular telephone number?
Did you try the suggestion I posted on May 6:?
Voice Services -> SP1 Service -> X_InboundCallRoute : {101:},{ph}
A more general, 3-digit block would be:
Voice Services -> SP1 Service -> X_InboundCallRoute : {(xxx):},{ph}
No, I didn't. So I enter it brackets and all as follows?:
{200:},{ph}
Can I do this to cover the most frequent peers?:
{101:},{200:},{asterisk:},{ph}
What exactly does that do?
The InboundCallRoute is used to route incoming calls. It can match CallerID numbers and do something special with them. Since you're getting more than just 101 now and they appear to always be 3-digit numbers, I suggest:
Voice Services -> SP1 Service -> X_InboundCallRoute : {(xxx):},{ph}
This will route any incoming call with a CallerID of a 3-digit number to the bit-bucket. All others will go to the PHONE Port as usual.
I appreciate your help. 2 questions to clarify:
1. Do I enter this into the field exactly as shown (between the quotes) "{(xxx):},{ph}" ? I ask because currently InboundCallRoute is set to default, and the field simply shows "ph". The syntax of what you posted seems different.
2. Is there a way I can do the same with "asterisk"? That is the most frequent call I get.
The curly braces can be omitted if there is only one rule in the route, hence the ph instead of {ph}.
If 'asterisk' is being listed as a Peer Number, then a rule for it too can be included:
Voice Services -> SP1 Service -> X_InboundCallRoute : {asterisk:},{(xxx):},{ph}
The InboundCallRoute format is described in detail on page 113 of the OBi Device Administration Guide.
Thanks. I unchecked the Default box, entered the new string, saved, confirmed and rebooted, and it's back to Default again. tried it twice, no luck.
You have two options when maintaining an OBi:
1. Enable Auto Provisioning and do all configuration though the OBiTALK configuration facility.
2. Disable Auto Provisioning and do all configuration manually through the OBi itself.
It's one or the other - you can't mix them.
Quote from: RonR on June 09, 2011, 09:14:50 AM
You have two options when maintaining an OBi:
1. Enable Auto Provisioning and do all configuration though the OBiTALK configuration facility.
2. Disable Auto Provisioning and do all configuration manually through the OBi itself.
It's one or the other - you can't mix them.
This is the number one newbie issue, comes up time and again. Those using the Expert configuration might be better served if the pop up notice when about to enter the Expert Configuration portal explained the above mentioned statement more clearly than it does now. The pop up just asks :
"Are sure you want to enter OBi Expert Configuration?"
Of course you can expect the user behavior will be to click on the OK button. At
that moment it is not obvious to a new user that the configuration option on the OBi unit should not be used.
Should there be a better notification? Should there be a check box in the Expert configuration where the user deliberately checks to acknowledge that this will override the OBi unit. The offered solution solves some remote configuration issues and creates another annoying one.
If the question is "Should Obi users be able to block REPEATED, ANNOYING calls from non-human peers easily, without entering advanced configuration?" The answer is most certainly YES.
filtering or routing option.
can this process be used for "unknown" - this is the string I am getting from the scanners .
Quote from: RegularJoe on November 18, 2011, 03:40:54 AM
can this process be used for "unknown" - this is the string I am getting from the scanners .
Yes:
Voice Services -> SPx Service -> X_InboundCallRoute : {unknown:},...
Unfortunately, these scanners keep changing their peering number. I've been getting calls from '100', '101', 'sip', 'asterisk', and most recently 'unknown'. Most of them are coming from Russian ISP's, so complaints are usually ignored.
A better way to block this unwanted crap is to supply the OBi with a list of the IP addresses that it should accept SIP requests from. For example, I have a SIP provider named Ribbit configured on SP2 and also want to accept calls from IP Comms as well as my PAP2:
Service Providers -> ITSP Profile B -> SIP -> X_AccessList : 192.168.1.145,8.15.247.77,64.154.41.100
192.168.1.145 : PAP2
8.15.247.77 : Ribbit
64.154.41.100 : IP Comms
Calls from any other IP addresses should be ignored.
I get them too. Got one from 101 this morning.. UGH
Got them again from "1" today.
http://img403.imageshack.us/img403/9140/calllog.jpg
Kamakzie,
Perhaps you can prevent this by setting this up with the ip of your sip SP:
Service Providers->ITSP Profile A/B->SIP->X_AccessList = ip add of your sip service
Quote from: Kamakzie on June 28, 2012, 09:35:35 AM
Got them again from "1" today.
Change SP1 -> X_UserAgentPort from 5060 to e.g. 5070 and they should go away. If you previously needed to forward port 5060 to the OBi, forward the new port instead.
I also got another one today, peer name sipvicious, peer number 100. I was unable to format an IP range in Service Providers->ITSP Profile A/B->SIP->X_AccessList. I use Callcentric, and they use an IP range. Obi takes individual IP addresses, separated by commas.
flex25,
Yes we have been there before. That should be a feature request, don't you think. ;)
Right you are, QBZappy! It has been done. Hopefully, Obi will make this update.
If you use a random value for SP1 -> X_UserAgentPort (instead of 5060), you will rarely, if ever, see a bogus call. IMO 98%+ of SIP scans are to port 5060.
@Stewart. I'm sure that you are correct regarding AgentPorts. I have used 5070(sp1) and 5071(sp2) and had six months free of bogus calls to my OBi110. That is until last night when I got calls from PeerNumber 1000 on sp1 and sp2 at 4am >:( It does not matter where you live in the world, they always call in the middle of the night!
Just how random can we make AgentPorts? Most people seem to use ports in the 5xxx range. Is there a good reason for this? I don't want to restrict access from odd ip addresses as this can be useful when travelling. I guess a combination of random AgentPorts and using RonR's "sending them to the bit bucket" is the answer.
ianobi
You could use a random high port, e.g. 47612, though these clowns could be scanning every port on the the entire Internet (conceivably, it would be possible with e.g. a million zombies), so it might not help.
You could also set up InboundCallRoute for the SPx to only accept calls to specific destinations (the DID or account numbers that your providers normally send).
Thanks for the advice. I was never very fond of clowns or zombies :)
It seems to me a combination will work best. White-listing your providers IPs, changing ports to something nonstandard, and of course RonRs method of sending three-digit numbers to the bit bucket. And yes any filtering on the providers end closed that hole.
If you change SP1 -> X_UserAgentPort to some random port, I presume you have to do the same for SP1 -> X_KeepAliveServerPort, or does the blank SP1 -> X_KeepAliveServer suggest that this is not a feature that's being used by my setup?
Also, for those of us behind a NAT, I presume we'd have to change port forwarding so that port points to Obi's IP for UDP packets?
We got hammered today with these type of calls today on all 3 lines (several in the row on all)
Is this still the best way to stop this? X_InboundCallRoute : {(xxx):},{ph}
Is there way to block incomming calls all together on individual lines?
Thanks
Search around on the forum for posts describing the "Oleg method." This involves a change to your X_InboundCallRoute settings.
http://www.obitalk.com/forum/index.php?topic=6976.0
Thanks!