История изменений [назад]

fail2ban не банит

пытаются сбрутить сип таким образом

[2013-11-25 08:14:13] NOTICE[4096][C-00000090] chansip.c: Failed to authenticate device 1006<sip:1006@мой-ip>;tag=39ddd577 (50.7.255.132:5070) [2013-11-25 08:16:02] NOTICE[4096][C-00000091] chansip.c: Failed to authenticate device 1002<sip:1002@мой-ip>;tag=d01912a0 (198.27.87.224:5080) [2013-11-25 08:27:08] NOTICE[4096][C-00000092] chansip.c: Failed to authenticate device 1006<sip:1006@мой-ip>;tag=b864db92 (50.7.255.132:5074) [2013-11-25 08:33:57] NOTICE[4096][C-00000093] chansip.c: Failed to authenticate device 1002<sip:1002@мой-ip>;tag=845fe5c7 (198.27.87.224:5071) [2013-11-25 08:40:10] NOTICE[4096][C-00000094] chansip.c: Failed to authenticate device 1006<sip:1006@мой-ip>;tag=50cc3037 (50.7.255.132:5070) [2013-11-25 08:51:23] NOTICE[4096][C-00000095] chansip.c: Failed to authenticate device 1002<sip:1002@мой-ip>;tag=6cdb05c5 (198.27.87.224:5076) [2013-11-25 08:53:50] NOTICE[4096][C-00000096] chansip.c: Failed to authenticate device 1007<sip:1007@мой-ip>;tag=82449a32 (50.7.255.132:5076) [2013-11-25 09:07:16] NOTICE[4096][C-00000097] chansip.c: Failed to authenticate device 1007<sip:1007@мой-ip>;tag=cda428b3 (50.7.255.132:5078) [2013-11-25 09:09:18] NOTICE[4096][C-00000098] chansip.c: Failed to authenticate device 1002<sip:1002@мой-ip>;tag=494276db (198.27.87.224:5073) [2013-11-25 09:20:51] NOTICE[4096][C-00000099] chansip.c: Failed to authenticate device 1007<sip:1007@мой-ip>;tag=75017884 (50.7.255.132:5070) [2013-11-25 09:27:03] NOTICE[4096][C-0000009a] chan_sip.c: Failed to authenticate device 1002<sip:1002@мой-ip>;tag=16d86edb (198.27.87.224:5076)

т.е. поочередно меняют ip адрес на запрос. Fail2ban банит в случае, если больше 2x запросов с одного ip по порядку. Как заставить его отправлять в бан это?

fail2ban не банит

пытаются сбрутить сип таким образом

[2013-11-25 08:14:13] NOTICE[4096][C-00000090] chansip.c: chan_sip.c: Failed to authenticate device 1006<sip:1006@мой-ip>;tag=39ddd577 1006<sip:1006@мой-IP>;tag=39ddd577 (50.7.255.132:5070) [2013-11-25 08:16:02] NOTICE[4096][C-00000091] chansip.c: chan_sip.c: Failed to authenticate device 1002<sip:1002@мой-ip>;tag=d01912a0 1002<sip:1002@мой-IP>;tag=d01912a0 (198.27.87.224:5080) [2013-11-25 08:27:08] NOTICE[4096][C-00000092] chansip.c: chan_sip.c: Failed to authenticate device 1006<sip:1006@мой-ip>;tag=b864db92 1006<sip:1006@мой-IP>;tag=b864db92 (50.7.255.132:5074) [2013-11-25 08:33:57] NOTICE[4096][C-00000093] chansip.c: chan_sip.c: Failed to authenticate device 1002<sip:1002@мой-ip>;tag=845fe5c7 1002<sip:1002@мой-IP>;tag=845fe5c7 (198.27.87.224:5071) [2013-11-25 08:40:10] NOTICE[4096][C-00000094] chansip.c: chan_sip.c: Failed to authenticate device 1006<sip:1006@мой-ip>;tag=50cc3037 1006<sip:1006@мой-IP>;tag=50cc3037 (50.7.255.132:5070) [2013-11-25 08:51:23] NOTICE[4096][C-00000095] chansip.c: chan_sip.c: Failed to authenticate device 1002<sip:1002@мой-ip>;tag=6cdb05c5 1002<sip:1002@мой-IP>;tag=6cdb05c5 (198.27.87.224:5076) [2013-11-25 08:53:50] NOTICE[4096][C-00000096] chansip.c: chan_sip.c: Failed to authenticate device 1007<sip:1007@мой-ip>;tag=82449a32 1007<sip:1007@мой-IP>;tag=82449a32 (50.7.255.132:5076) [2013-11-25 09:07:16] NOTICE[4096][C-00000097] chansip.c: chan_sip.c: Failed to authenticate device 1007<sip:1007@мой-ip>;tag=cda428b3 1007<sip:1007@мой-IP>;tag=cda428b3 (50.7.255.132:5078) [2013-11-25 09:09:18] NOTICE[4096][C-00000098] chansip.c: chan_sip.c: Failed to authenticate device 1002<sip:1002@мой-ip>;tag=494276db 1002<sip:1002@мой-IP>;tag=494276db (198.27.87.224:5073) [2013-11-25 09:20:51] NOTICE[4096][C-00000099] chansip.c: chan_sip.c: Failed to authenticate device 1007<sip:1007@мой-ip>;tag=75017884 1007<sip:1007@мой-IP>;tag=75017884 (50.7.255.132:5070) [2013-11-25 09:27:03] NOTICE[4096][C-0000009a] chan_sip.c: Failed to authenticate device 1002<sip:1002@мой-ip>;tag=16d86edb (198.27.87.224:5076)1002<sip:1002@мой-IP>;tag=16d86edb (198.27.87.224:5076)

т.е. поочередно меняют ip адрес на запрос. Fail2ban банит в случае, если больше 2x запросов с одного ip по порядку. Как заставить его отправлять в бан это?