Random Register trying to connect

Asterisk Asterisk Endpoints
1

CentOS 7
Asterisk 13.18.2
Using PJSIP Driver

I’m getting multiples random IPs trying to register to my asterisk server.

Is this normal?
How Can I stop it?
Is there a way to allow specific IP to register to specific extension/endpoint?
What is best practices?
I know I can have a white-list via Firewall to allow specific IP but there must be a better way?

Example:

[Dec  3 03:36:47] NOTICE[2446]: 
res_pjsip/pjsip_distributor.c:649 log_failed_request: Request 'INVITE' from '"1002" <sip:1002@xxx.xxx.xxx.xxx>' failed for '158.69.248.146:5070' (callid: 0ec044c6b4149f041c28ab594aba646c) - No matching endpoint found

[Dec  3 03:38:03] NOTICE[2451]: 
res_pjsip/pjsip_distributor.c:649 log_failed_request: Request 'INVITE' from '"1002" <sip:1002@xxx.xxx.xxx.xxx>' failed for '158.69.248.146:5070' (callid: 35078f7a1be01f144ebfc6a2ebbaf5c3) - No matching endpoint found

[Dec  3 03:39:19] NOTICE[2456]: 
res_pjsip/pjsip_distributor.c:649 log_failed_request: Request 'INVITE' from '"1002" <sip:1002@xxx.xxx.xxx.xxx>' failed for '158.69.248.146:5070' (callid: f8eedc68e75637652201ae7a71c7b64a) - No matching endpoint found
2

Yes, if you don’t adequately firewall it, or you need to have calls from unknown addresses. Any SIP system on the internet will get attacked very quickly.

There are tools, like fail2ban, which will dynamically add firewall rules after a failed attempt.

You should make sure that passwords, on all phones, are strong, and that you don’t match end points by use name.

1 Like