Fail2ban Banned My Own PBX IP

Asterisk Asterisk Support
1

Hello,

Waking up on this Sunday, checking my emails, I see fail2ban has banned its own IP address.

My Elastix PBX (I know here is ASTERISK community, and not Elastix, but the issue I am asking opinions about, is possible attack method, as much understood as the asterisk log can show), is installed with public ip address now on called: MY-PBX-PUBLIC-IP-ADDRESS

fail2ban, has banned this ip: MY-PBX-PUBLIC-IP-ADDRESS due to many attempts.

Further, going to asterisk logs, I see:

[Dec 1 22:05:02] VERBOSE[3152] asterisk.c: -- Remote UNIX connection [Dec 1 22:05:02] VERBOSE[25938] asterisk.c: -- Remote UNIX connection disconnected [Dec 1 22:07:17] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:17] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:17] VERBOSE[25944] pbx.c: -- Executing [011972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000242", "Received incoming SIP connection from unknown peer to 011972592413134") in new stack [Dec 1 22:07:17] VERBOSE[25944] pbx.c: -- Executing [011972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000242", "DID=011972592413134") in new stack [Dec 1 22:07:17] VERBOSE[25944] pbx.c: -- Executing [011972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000242", "s,1") in new stack [Dec 1 22:07:17] VERBOSE[25944] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:17] VERBOSE[25944] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000242", "0?checklang:noanonymous") in new stack [Dec 1 22:07:17] VERBOSE[25944] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:17] VERBOSE[25944] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000242", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:17] VERBOSE[25944] func_timeout.c: Channel will hangup at 2012-12-01 22:07:32.603 EET. [Dec 1 22:07:17] VERBOSE[25944] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000242", "") in new stack [Dec 1 22:07:17] VERBOSE[25944] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000242' [Dec 1 22:07:17] VERBOSE[25944] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000242", "") in new stack [Dec 1 22:07:17] VERBOSE[25944] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000242' [Dec 1 22:07:18] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:18] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:18] VERBOSE[25945] pbx.c: -- Executing [00972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000243", "Received incoming SIP connection from unknown peer to 00972592413134") in new stack [Dec 1 22:07:18] VERBOSE[25945] pbx.c: -- Executing [00972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000243", "DID=00972592413134") in new stack [Dec 1 22:07:18] VERBOSE[25945] pbx.c: -- Executing [00972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000243", "s,1") in new stack [Dec 1 22:07:18] VERBOSE[25945] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:18] VERBOSE[25945] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000243", "0?checklang:noanonymous") in new stack [Dec 1 22:07:18] VERBOSE[25945] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:18] VERBOSE[25945] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000243", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:18] VERBOSE[25945] func_timeout.c: Channel will hangup at 2012-12-01 22:07:33.099 EET. [Dec 1 22:07:18] VERBOSE[25945] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000243", "") in new stack [Dec 1 22:07:18] VERBOSE[25945] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000243' [Dec 1 22:07:18] VERBOSE[25945] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000243", "") in new stack [Dec 1 22:07:18] VERBOSE[25945] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000243' [Dec 1 22:07:18] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:18] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:18] VERBOSE[25946] pbx.c: -- Executing [000972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000244", "Received incoming SIP connection from unknown peer to 000972592413134") in new stack [Dec 1 22:07:18] VERBOSE[25946] pbx.c: -- Executing [000972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000244", "DID=000972592413134") in new stack [Dec 1 22:07:18] VERBOSE[25946] pbx.c: -- Executing [000972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000244", "s,1") in new stack [Dec 1 22:07:18] VERBOSE[25946] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:18] VERBOSE[25946] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000244", "0?checklang:noanonymous") in new stack [Dec 1 22:07:18] VERBOSE[25946] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:18] VERBOSE[25946] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000244", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:18] VERBOSE[25946] func_timeout.c: Channel will hangup at 2012-12-01 22:07:33.677 EET. [Dec 1 22:07:18] VERBOSE[25946] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000244", "") in new stack [Dec 1 22:07:18] VERBOSE[25946] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000244' [Dec 1 22:07:18] VERBOSE[25946] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000244", "") in new stack [Dec 1 22:07:18] VERBOSE[25946] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000244' [Dec 1 22:07:19] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:19] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:19] VERBOSE[25947] pbx.c: -- Executing [900972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000245", "Received incoming SIP connection from unknown peer to 900972592413134") in new stack [Dec 1 22:07:19] VERBOSE[25947] pbx.c: -- Executing [900972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000245", "DID=900972592413134") in new stack [Dec 1 22:07:19] VERBOSE[25947] pbx.c: -- Executing [900972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000245", "s,1") in new stack [Dec 1 22:07:19] VERBOSE[25947] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:19] VERBOSE[25947] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000245", "0?checklang:noanonymous") in new stack [Dec 1 22:07:19] VERBOSE[25947] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:19] VERBOSE[25947] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000245", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:19] VERBOSE[25947] func_timeout.c: Channel will hangup at 2012-12-01 22:07:34.269 EET. [Dec 1 22:07:19] VERBOSE[25947] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000245", "") in new stack [Dec 1 22:07:19] VERBOSE[25947] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000245' [Dec 1 22:07:19] VERBOSE[25947] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000245", "") in new stack [Dec 1 22:07:19] VERBOSE[25947] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000245' [Dec 1 22:07:19] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:19] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:19] VERBOSE[25959] pbx.c: -- Executing [9900972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000246", "Received incoming SIP connection from unknown peer to 9900972592413134") in new stack [Dec 1 22:07:19] VERBOSE[25959] pbx.c: -- Executing [9900972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000246", "DID=9900972592413134") in new stack [Dec 1 22:07:19] VERBOSE[25959] pbx.c: -- Executing [9900972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000246", "s,1") in new stack [Dec 1 22:07:19] VERBOSE[25959] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:19] VERBOSE[25959] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000246", "0?checklang:noanonymous") in new stack [Dec 1 22:07:19] VERBOSE[25959] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:19] VERBOSE[25959] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000246", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:19] VERBOSE[25959] func_timeout.c: Channel will hangup at 2012-12-01 22:07:34.844 EET. [Dec 1 22:07:19] VERBOSE[25959] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000246", "") in new stack [Dec 1 22:07:20] VERBOSE[25959] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000246' [Dec 1 22:07:20] VERBOSE[25959] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000246", "") in new stack [Dec 1 22:07:20] VERBOSE[25959] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000246' [Dec 1 22:07:20] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:20] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:20] VERBOSE[25966] pbx.c: -- Executing [990011972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000247", "Received incoming SIP connection from unknown peer to 990011972592413134") in new stack [Dec 1 22:07:20] VERBOSE[25966] pbx.c: -- Executing [990011972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000247", "DID=990011972592413134") in new stack [Dec 1 22:07:20] VERBOSE[25966] pbx.c: -- Executing [990011972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000247", "s,1") in new stack [Dec 1 22:07:20] VERBOSE[25966] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:20] VERBOSE[25966] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000247", "0?checklang:noanonymous") in new stack [Dec 1 22:07:20] VERBOSE[25966] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:20] VERBOSE[25966] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000247", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:20] VERBOSE[25966] func_timeout.c: Channel will hangup at 2012-12-01 22:07:35.421 EET. [Dec 1 22:07:20] VERBOSE[25966] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000247", "") in new stack [Dec 1 22:07:20] VERBOSE[25966] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000247' [Dec 1 22:07:20] VERBOSE[25966] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000247", "") in new stack [Dec 1 22:07:20] VERBOSE[25966] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000247' [Dec 1 22:07:20] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:20] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:20] VERBOSE[25967] pbx.c: -- Executing [810972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000248", "Received incoming SIP connection from unknown peer to 810972592413134") in new stack [Dec 1 22:07:20] VERBOSE[25967] pbx.c: -- Executing [810972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000248", "DID=810972592413134") in new stack [Dec 1 22:07:20] VERBOSE[25967] pbx.c: -- Executing [810972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000248", "s,1") in new stack [Dec 1 22:07:20] VERBOSE[25967] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:20] VERBOSE[25967] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000248", "0?checklang:noanonymous") in new stack [Dec 1 22:07:20] VERBOSE[25967] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:20] VERBOSE[25967] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000248", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:20] VERBOSE[25967] func_timeout.c: Channel will hangup at 2012-12-01 22:07:35.971 EET. [Dec 1 22:07:20] VERBOSE[25967] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000248", "") in new stack [Dec 1 22:07:21] VERBOSE[25967] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000248' [Dec 1 22:07:21] VERBOSE[25967] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000248", "") in new stack [Dec 1 22:07:21] VERBOSE[25967] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000248' [Dec 1 22:07:21] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:21] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:21] VERBOSE[25968] pbx.c: -- Executing [9810972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000249", "Received incoming SIP connection from unknown peer to 9810972592413134") in new stack [Dec 1 22:07:21] VERBOSE[25968] pbx.c: -- Executing [9810972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000249", "DID=9810972592413134") in new stack [Dec 1 22:07:21] VERBOSE[25968] pbx.c: -- Executing [9810972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000249", "s,1") in new stack [Dec 1 22:07:21] VERBOSE[25968] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:21] VERBOSE[25968] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000249", "0?checklang:noanonymous") in new stack [Dec 1 22:07:21] VERBOSE[25968] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:21] VERBOSE[25968] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000249", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:21] VERBOSE[25968] func_timeout.c: Channel will hangup at 2012-12-01 22:07:36.544 EET. [Dec 1 22:07:21] VERBOSE[25968] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000249", "") in new stack [Dec 1 22:07:21] VERBOSE[25968] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000249' [Dec 1 22:07:21] VERBOSE[25968] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000249", "") in new stack [Dec 1 22:07:21] VERBOSE[25968] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000249' [Dec 1 22:07:22] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:22] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:22] VERBOSE[25969] pbx.c: -- Executing [001972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024a", "Received incoming SIP connection from unknown peer to 001972592413134") in new stack [Dec 1 22:07:22] VERBOSE[25969] pbx.c: -- Executing [001972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024a", "DID=001972592413134") in new stack [Dec 1 22:07:22] VERBOSE[25969] pbx.c: -- Executing [001972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024a", "s,1") in new stack [Dec 1 22:07:22] VERBOSE[25969] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:22] VERBOSE[25969] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024a", "0?checklang:noanonymous") in new stack [Dec 1 22:07:22] VERBOSE[25969] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:22] VERBOSE[25969] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024a", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:22] VERBOSE[25969] func_timeout.c: Channel will hangup at 2012-12-01 22:07:37.133 EET. [Dec 1 22:07:22] VERBOSE[25969] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024a", "") in new stack [Dec 1 22:07:22] VERBOSE[25969] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024a' [Dec 1 22:07:22] VERBOSE[25969] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024a", "") in new stack [Dec 1 22:07:22] VERBOSE[25969] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024a' [Dec 1 22:07:22] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:22] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:22] VERBOSE[25970] pbx.c: -- Executing [00700972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024b", "Received incoming SIP connection from unknown peer to 00700972592413134") in new stack [Dec 1 22:07:22] VERBOSE[25970] pbx.c: -- Executing [00700972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024b", "DID=00700972592413134") in new stack [Dec 1 22:07:22] VERBOSE[25970] pbx.c: -- Executing [00700972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024b", "s,1") in new stack [Dec 1 22:07:22] VERBOSE[25970] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:22] VERBOSE[25970] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024b", "0?checklang:noanonymous") in new stack [Dec 1 22:07:22] VERBOSE[25970] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:22] VERBOSE[25970] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024b", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:22] VERBOSE[25970] func_timeout.c: Channel will hangup at 2012-12-01 22:07:37.741 EET. [Dec 1 22:07:22] VERBOSE[25970] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024b", "") in new stack [Dec 1 22:07:22] VERBOSE[25970] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024b' [Dec 1 22:07:22] VERBOSE[25970] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024b", "") in new stack [Dec 1 22:07:22] VERBOSE[25970] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024b' [Dec 1 22:07:23] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:23] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:23] VERBOSE[25971] pbx.c: -- Executing [800972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024c", "Received incoming SIP connection from unknown peer to 800972592413134") in new stack [Dec 1 22:07:23] VERBOSE[25971] pbx.c: -- Executing [800972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024c", "DID=800972592413134") in new stack [Dec 1 22:07:23] VERBOSE[25971] pbx.c: -- Executing [800972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024c", "s,1") in new stack [Dec 1 22:07:23] VERBOSE[25971] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:23] VERBOSE[25971] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024c", "0?checklang:noanonymous") in new stack [Dec 1 22:07:23] VERBOSE[25971] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:23] VERBOSE[25971] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024c", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:23] VERBOSE[25971] func_timeout.c: Channel will hangup at 2012-12-01 22:07:38.320 EET. [Dec 1 22:07:23] VERBOSE[25971] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024c", "") in new stack [Dec 1 22:07:23] VERBOSE[25971] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024c' [Dec 1 22:07:23] VERBOSE[25971] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024c", "") in new stack [Dec 1 22:07:23] VERBOSE[25971] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024c' [Dec 1 22:07:23] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:23] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:23] VERBOSE[25972] pbx.c: -- Executing [0011972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024d", "Received incoming SIP connection from unknown peer to 0011972592413134") in new stack [Dec 1 22:07:23] VERBOSE[25972] pbx.c: -- Executing [0011972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024d", "DID=0011972592413134") in new stack [Dec 1 22:07:23] VERBOSE[25972] pbx.c: -- Executing [0011972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024d", "s,1") in new stack [Dec 1 22:07:23] VERBOSE[25972] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:23] VERBOSE[25972] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024d", "0?checklang:noanonymous") in new stack [Dec 1 22:07:23] VERBOSE[25972] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:23] VERBOSE[25972] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024d", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:23] VERBOSE[25972] func_timeout.c: Channel will hangup at 2012-12-01 22:07:38.889 EET. [Dec 1 22:07:23] VERBOSE[25972] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024d", "") in new stack [Dec 1 22:07:24] VERBOSE[25972] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024d' [Dec 1 22:07:24] VERBOSE[25972] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024d", "") in new stack [Dec 1 22:07:24] VERBOSE[25972] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024d' [Dec 1 22:07:24] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:24] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:24] VERBOSE[25973] pbx.c: -- Executing [0015972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024e", "Received incoming SIP connection from unknown peer to 0015972592413134") in new stack [Dec 1 22:07:24] VERBOSE[25973] pbx.c: -- Executing [0015972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024e", "DID=0015972592413134") in new stack [Dec 1 22:07:24] VERBOSE[25973] pbx.c: -- Executing [0015972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024e", "s,1") in new stack [Dec 1 22:07:24] VERBOSE[25973] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:24] VERBOSE[25973] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024e", "0?checklang:noanonymous") in new stack [Dec 1 22:07:24] VERBOSE[25973] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:24] VERBOSE[25973] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024e", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:24] VERBOSE[25973] func_timeout.c: Channel will hangup at 2012-12-01 22:07:39.476 EET. [Dec 1 22:07:24] VERBOSE[25973] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024e", "") in new stack [Dec 1 22:07:24] VERBOSE[25973] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024e' [Dec 1 22:07:24] VERBOSE[25973] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024e", "") in new stack [Dec 1 22:07:24] VERBOSE[25973] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024e' [Dec 1 22:07:25] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:25] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:25] VERBOSE[25974] pbx.c: -- Executing [0014972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024f", "Received incoming SIP connection from unknown peer to 0014972592413134") in new stack [Dec 1 22:07:25] VERBOSE[25974] pbx.c: -- Executing [0014972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024f", "DID=0014972592413134") in new stack [Dec 1 22:07:25] VERBOSE[25974] pbx.c: -- Executing [0014972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024f", "s,1") in new stack [Dec 1 22:07:25] VERBOSE[25974] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:25] VERBOSE[25974] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024f", "0?checklang:noanonymous") in new stack [Dec 1 22:07:25] VERBOSE[25974] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:25] VERBOSE[25974] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024f", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:25] VERBOSE[25974] func_timeout.c: Channel will hangup at 2012-12-01 22:07:40.023 EET. [Dec 1 22:07:25] VERBOSE[25974] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024f", "") in new stack [Dec 1 22:07:25] VERBOSE[25974] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024f' [Dec 1 22:07:25] VERBOSE[25974] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024f", "") in new stack [Dec 1 22:07:25] VERBOSE[25974] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-0000024f' [Dec 1 22:07:25] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:25] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:25] VERBOSE[25975] pbx.c: -- Executing [0031972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000250", "Received incoming SIP connection from unknown peer to 0031972592413134") in new stack [Dec 1 22:07:25] VERBOSE[25975] pbx.c: -- Executing [0031972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000250", "DID=0031972592413134") in new stack [Dec 1 22:07:25] VERBOSE[25975] pbx.c: -- Executing [0031972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000250", "s,1") in new stack [Dec 1 22:07:25] VERBOSE[25975] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:25] VERBOSE[25975] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000250", "0?checklang:noanonymous") in new stack [Dec 1 22:07:25] VERBOSE[25975] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:25] VERBOSE[25975] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000250", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:25] VERBOSE[25975] func_timeout.c: Channel will hangup at 2012-12-01 22:07:40.579 EET. [Dec 1 22:07:25] VERBOSE[25975] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000250", "") in new stack [Dec 1 22:07:25] VERBOSE[25975] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000250' [Dec 1 22:07:25] VERBOSE[25975] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000250", "") in new stack [Dec 1 22:07:25] VERBOSE[25975] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000250' [Dec 1 22:07:26] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:26] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:26] VERBOSE[25976] pbx.c: -- Executing [90015972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000251", "Received incoming SIP connection from unknown peer to 90015972592413134") in new stack [Dec 1 22:07:26] VERBOSE[25976] pbx.c: -- Executing [90015972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000251", "DID=90015972592413134") in new stack [Dec 1 22:07:26] VERBOSE[25976] pbx.c: -- Executing [90015972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000251", "s,1") in new stack [Dec 1 22:07:26] VERBOSE[25976] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:26] VERBOSE[25976] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000251", "0?checklang:noanonymous") in new stack [Dec 1 22:07:26] VERBOSE[25976] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:26] VERBOSE[25976] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000251", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:26] VERBOSE[25976] func_timeout.c: Channel will hangup at 2012-12-01 22:07:41.135 EET. [Dec 1 22:07:26] VERBOSE[25976] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000251", "") in new stack [Dec 1 22:07:26] VERBOSE[25976] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000251' [Dec 1 22:07:26] VERBOSE[25976] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000251", "") in new stack [Dec 1 22:07:26] VERBOSE[25976] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000251' [Dec 1 22:07:26] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:26] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:26] VERBOSE[25977] pbx.c: -- Executing [90031972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000252", "Received incoming SIP connection from unknown peer to 90031972592413134") in new stack [Dec 1 22:07:26] VERBOSE[25977] pbx.c: -- Executing [90031972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000252", "DID=90031972592413134") in new stack [Dec 1 22:07:26] VERBOSE[25977] pbx.c: -- Executing [90031972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000252", "s,1") in new stack [Dec 1 22:07:26] VERBOSE[25977] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:26] VERBOSE[25977] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000252", "0?checklang:noanonymous") in new stack [Dec 1 22:07:26] VERBOSE[25977] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:26] VERBOSE[25977] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000252", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:26] VERBOSE[25977] func_timeout.c: Channel will hangup at 2012-12-01 22:07:41.717 EET. [Dec 1 22:07:26] VERBOSE[25977] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000252", "") in new stack [Dec 1 22:07:26] VERBOSE[25977] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000252' [Dec 1 22:07:26] VERBOSE[25977] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000252", "") in new stack [Dec 1 22:07:26] VERBOSE[25977] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000252' [Dec 1 22:07:27] VERBOSE[3280] netsock2.c: == Using SIP RTP TOS bits 184 [Dec 1 22:07:27] VERBOSE[3280] netsock2.c: == Using SIP RTP CoS mark 5 [Dec 1 22:07:27] VERBOSE[25978] pbx.c: -- Executing [010972592413134@from-sip-external:1] NoOp("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000253", "Received incoming SIP connection from unknown peer to 010972592413134") in new stack [Dec 1 22:07:27] VERBOSE[25978] pbx.c: -- Executing [010972592413134@from-sip-external:2] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000253", "DID=010972592413134") in new stack [Dec 1 22:07:27] VERBOSE[25978] pbx.c: -- Executing [010972592413134@from-sip-external:3] Goto("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000253", "s,1") in new stack [Dec 1 22:07:27] VERBOSE[25978] pbx.c: -- Goto (from-sip-external,s,1) [Dec 1 22:07:27] VERBOSE[25978] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000253", "0?checklang:noanonymous") in new stack [Dec 1 22:07:27] VERBOSE[25978] pbx.c: -- Goto (from-sip-external,s,5) [Dec 1 22:07:27] VERBOSE[25978] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000253", "TIMEOUT(absolute)=15") in new stack [Dec 1 22:07:27] VERBOSE[25978] func_timeout.c: Channel will hangup at 2012-12-01 22:07:42.271 EET. [Dec 1 22:07:27] VERBOSE[25978] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000253", "") in new stack [Dec 1 22:07:27] VERBOSE[25978] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000253' [Dec 1 22:07:27] VERBOSE[25978] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000253", "") in new stack [Dec 1 22:07:27] VERBOSE[25978] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/****MY-PBX-PUBLIC-IP-ADDRESS****-00000253'

This is someone from Israel with number 00972592413134 trying to make outbound calls, as a outsider, with context from-sip-external, so leading to “S”, which is how Asterisk treats outsiders without permission to make calls.

I have seen all this before, and if one decides to go public with their PBX, this is unavoidable (correct me if I am wrong), and these common attack hits are everyday work. BUTTTTT, my issue is with the IP address, unlike all other attacks, this specific one is ORIGINATING from my own PBX, which I find it kind of impossible. No one has access to the web interface, nor SSH. This is locked ONLY to my own IP address, and I am 99.99% sure on that. My suspicion is this is just spoofing or some kind of man-in-the-middle attack, pretending to be my own IP, and tricking Asterisk.

Going to Elastix interface, and reporting, this is what is shown as the outcome of above tries:

What is this? Is my PBX already broken in or all good?

Thank you,
Ali.

2

Try setting your firewall to block attempts to spoof your own address. They are probably specifying the return address in the SIP headers.

3

Thank you for your reply David.

Do you know how that is done? Googling it as I am typing, I am using iptables with fail2ban.

Rgds,
Ali.

4

Basically the same way as you should already be blocking 192.168/16, etc., on your public interface.

5

Thank you David,

if I understood you correctly, you mean just to add my own IP address in firewall deny-list, in case someone uses that to spoof in. right?

Ali.

6

Preferably at the boundary router. If you do it on the same machine, there may be subtleties if it tries to do loopbacks with the public address, which may require you to be careful.

7

Thank you. Apart from above points made, do you see a successful attempt from the above logs? Or like other common attacks, just someone TRYing to break-in. I just am worries about the 111 there, which usually is reported as UNKNOWN.

Ali.

8

I think I misdiagnosed this. I think there has been a change in the way that guest channels are named, from using the remote address to using the local one, which basically breaks your fail2ban rule that matches this message.

Unless you really need it, you should turn off allowguest.

The sample I looked at seems to be answering the calls and immediately dumping them, but you should not, normally, be letting it get that far. If you want to see if someone successfully broke in, look for an outgoing Dial.