История изменений [назад]

через iptables. астериск вам не фаервол.

через iptables. астериск вам не фаервол.

$IPTABLES -A sipdos -m string --string "INVITE sip:" --algo bm --to $OFFSET -j sipdosinvite

$IPTABLES -A sipdosinvite \
-m hashlimit --hashlimit $IRATE --hashlimit-burst $BURST \
--hashlimit-mode srcip,dstport --hashlimit-name sip_i_limit -j ACCEPT

# REGISTER limit
$IPTABLES -A sipdos -m string --string "REGISTER sip:" --algo bm --to $OFFSET -j sipdosregister

$IPTABLES -A sipdosregister \
-m hashlimit --hashlimit $RRATE --hashlimit-burst $BURST \
--hashlimit-mode srcip,dstport --hashlimit-name sip_r_limit -j ACCEPT

через iptables. астериск вам не фаервол.

IRATE=20/minute

# REGISTER rate, per host.
RRATE=10/minute

# All other SIP methods rate, per host.  Be careful with SUBSCRIBEs, OPTIONS, CANCELs, etc.
ORATE=60/minute

# Methods for this script to ignore.  These SIP methods are always allowed.
IGMETH="OPTIONS"

# Burst
BURST=30

# Interface(s) to protect on INPUT. Seperate multiple interfaces with spaces.
# This will protect SIP services on THIS HOST.
IFACE="eth0"

    $IPTABLES -A sipdos -m string --string "INVITE sip:" --algo bm --to $OFFSET -j sipdosinvite

 $IPTABLES -A sipdosinvite \
 -m hashlimit --hashlimit $IRATE --hashlimit-burst $BURST \
 --hashlimit-mode srcip,dstport --hashlimit-name sip_i_limit -j ACCEPT

 # REGISTER limit
 $IPTABLES -A sipdos -m string --string "REGISTER sip:" --algo bm --to $OFFSET -j sipdosregister

 $IPTABLES -A sipdosregister \
 -m hashlimit --hashlimit $RRATE --hashlimit-burst $BURST \
 --hashlimit-mode srcip,dstport --hashlimit-name sip_r_limit -j ACCEPT

через iptables. астериск вам не фаервол.

 IRATE=20/minute

 # REGISTER rate, per host.
 RRATE=10/minute

 # All other SIP methods rate, per host.  Be careful with SUBSCRIBEs, OPTIONS, CANCELs, etc.
 ORATE=60/minute

 # Methods for this script to ignore.  These SIP methods are always allowed.
 IGMETH="OPTIONS"

 # Burst
 BURST=30

 # Interface(s) to protect on INPUT. Seperate multiple interfaces with spaces.
 # This will protect SIP services on THIS HOST.
 IFACE="eth0"

# Search packet to this location. A larger offset looks further into the packet
# and takes more time but could catch more attacks (and false alarms).
# Remember, the method to match on is always in the beginning of the packet.
OFFSET=65

# тут чтото еще есть, много ;)

        $IPTABLES -A sipdos -m string --string "INVITE sip:" --algo bm --to $OFFSET -j sipdosinvite

     $IPTABLES -A sipdosinvite \
     -m hashlimit --hashlimit $IRATE --hashlimit-burst $BURST \
     --hashlimit-mode srcip,dstport --hashlimit-name sip_i_limit -j ACCEPT

     # REGISTER limit
     $IPTABLES -A sipdos -m string --string "REGISTER sip:" --algo bm --to $OFFSET -j sipdosregister

     $IPTABLES -A sipdosregister \
     -m hashlimit --hashlimit $RRATE --hashlimit-burst $BURST \
     --hashlimit-mode srcip,dstport --hashlimit-name sip_r_limit -j ACCEPT