0

P550 37.7.0.51 WebUI unresponsive / Cannot delete 8000+ Blocked IPs

phb

September 18, 2022 10:42

None

Follow

I nearly was unable to login into the WebUI of the PBX. Several browsers complained about site does not respond after the entry page was loaded. After wating patientely for 10 minutes I was able to use the UI again. I found out the reasony might be that there are 8000+ Messages about IPs which are automatically were blocked.

I then used the Firewall at the router to create a rule denying access to port 5060 for anyone outside the Providers IP range.Problem fixed.

I also was able to overcome the problem with the non reacting UI of the pbx by acknowleding all messages popping up in the upper right.

However, I think there are serveral bugs:

regardless of the amount of blocked IPs the pbx UI should stay operational - unless you have activated ssh and made a note of the password this is the only way to access the system. I can imagin that if there would not have been 8000 but 20.000 attacks i might have been unable to login completely. Even a restart might not have helped. So, some external bot controlling a few 1000 ips might be able to bring down the pbx to a state where only a factory reset helps. Not good.

I should be able to tag the messages about a blocked IP in a way that these do not show up in the notiication area.- I did not find such an option, I was only able do disable email notification.

Finally i should be able to delete all these entries in the pbx. However I can only delete about one entry at a time. I tried by selecting all (20) but with mixed results. Once it worked, then again not. And deleting 300 at a time never did.

 

• Facebook
• Twitter
• LinkedIn

5 comments

• 0
  
  Eric Jiang September 20, 2022 06:22

  Do you use a public IP in the PBX or do the port mapping in your firewall?

  Otherwise, there won't be that many attacks.

  8000+ blocked IPs shouldn't be the reason to make the web unresponsive. Is the problem still there?

• 0
  
  phb September 20, 2022 12:28

  The pbx is behind NAT, but I have (because otherwise no calls would come in, Trunk is Deutsche Telekom tel.t-online.de, if you tell me how to fix this then fine, please tell me!) opened port 5060 in the NAT settings of the router. I have fixed the problem by a firewall rule which will drop all packets to port 5060 that do not originate from the DeutscheTelekom IP range.

  The problem has been gone at the moment when I confirmed the 8000 messages as read about blocked ips in the WebUI. The problem originates (guess) from the popup messages which will greet you after you login to the pbx - these are also not dismissable in bulk.

  Still there are 8700 blocked IPs in the list of the PBX, and I see no option to delete these.

• 0
  
  Eric Jiang September 22, 2022 10:22

  We will optimize the warning, the pop-up is annoying.

  For those blocked IPs you can delete them page by page....

  

• 0
  
  Eric Jiang September 22, 2022 10:23

  Port mapping 5060 directly is not a good idea, better to use an unusual port for external use.

• 0
  
  phb September 22, 2022 10:49

  thank you for removing the popups.

  regarding the deleting of the record:
  When I do that per page, it will simply not delete anything. Also a "page" will be a maximum of 300 entries. Deleting 8700 entries means I have to delete 30 times. At start it seemed to work with 25 entries. But then it stopped.

  regarding the port 5060:
  I would never open this, but, If I dont, not all calls will arrive at the pbx. If I make an external call to this number, there will be silence until a timeout occurs, then the error message will be something like no answer. After opening port 5060 and mapping it to the pbx all calls will come through. FW of pbx is: 37.7.0.51

  German telekom is one of the most annoying providers. From my experience an incoming call may arrive from any server out of their IP Range, not only the one the pbx is connected to. Therefore incoming calls will only work reliable of port 5060 is opened (I have not the the complete technical background how their system works exact, this is only from my experience, and this is: calles will be missed if I dont open 5060).