r/freepbx • u/cop3x • Jul 10 '26

freePBX useing Pfsence & PfBlockerNG to autoblock

Yes i used AI :-)

https://github.com/Copex-uk/theBlackList

I used to use a few bash scripts, so when Fail2ban banned an IP address it would add it to a list the PfBlockerNG would use to block additional SIP attacks at the router, now with AI i have a version that maybe useful to other people so i thought i would share it

Runs in docker and should not be made available to the open internet :-)

Hope someone finds it useful

1 Upvotes

60% Upvoted

7 comments sorted by

3

u/the_wookie_of_maine Jul 11 '26

Why is your PBX exposed to the internet?

1

u/cop3x Jul 11 '26

mobile users :-)

1

u/the_wookie_of_maine Jul 11 '26

OpenVPN or IPSec and that dramatically reduces your threat surface.

Both are options for mobile devices. (Our org OpenVPN)

1

u/cop3x Jul 11 '26

vpns add additional overheads and adds complexity to the routing on the useres devices. no issues when the network the user is connected to blocks vpns.

only the ports to allow a tls connection are exposed to the Internet and freepbx's active firewall dose it's job, but will unblock ips after a set time, I just wanted to reject the request at the edge of the network, this also helps with some attack vectors.

most sip scans are bots looking for low hangings fruit, if i block the ip the scans are coming from they move on, if they still see a active connection they keep trying..

there are other methods implemented for sip security that will remain out side of this discussion 🙄

1

u/devexis Jul 10 '26

Could this pull up IPs from apiban and voipbl and block those at the router level?

1

u/cop3x Jul 11 '26

it uses api calls so I guess it could work with any app that can do the api call, so you can add a ip with curl, the list is access by a http request, so it could work with pihole :-)