I did not say that my article represents a complete answer to every part of every one of your questions, at every level of abstraction and specificity. Just that it might be helpful. :-)
On Mon, Oct 22, 2018 at 04:40:03PM +0300, Ellad Yatsko wrote: > Dear Alex, > > your article is just "general words". :-) There is a couple of questions: > > - can my "vision" be completed? > - how can it be implemented? > > The major problem as I see is to modify algorithm so Kamailio will not check > database but will lean on answers of its upstream to generate > UL. It should not BALANCE, just forward SIP traffic, ANALYZE answers of > Upstream > SIP-Server, make decision about attacks and PROXY RTP. It should be more > clear > definition what I would like to achieve. > > I could be confused about exact terminology of "Session Border Controller". > But I'd like to implement FRAUD/BruteForce protection of my Asterisk using > Kamailio (in the middle) because I heard it highly effective in the point > of view of heavy loads. Asterisk might not bear a "tons" of SIP requests > (dialogs). > > > > Kind regards, > Ellad > > > 22.10.2018 12:07, Alex Balashov пишет: > > I hate to plug my own articles, but in this case it might help: > > > > http://www.evaristesys.com/blog/kamailio-as-an-sbc-five-years-on/ > > > > -- > > Sent from mobile. Apologies for brevity and errors. > > > > -----Original Message----- > > From: Ellad Yatsko <[email protected]> > > To: [email protected] > > Sent: Mon, 22 Oct 2018 3:28 AM > > Subject: [SR-Users] Kamailio as SBC > > > > Hello! > > > > I'd like to implement the following diagram: > > > > Users -> Internet -> Kamailio -> Asterisk > > > > 1. Kamailio has no own users, it just re-writes headers and re-send > > REGISTER messages to Asterisk where usres are located. > > > > 2. Depending on Astersisk's answers Kamailio either form UL (using > > original IP from the first, original REGISTER from Users) or translates > > Asterisk's answer back to Users. If it is error (e.g. > > forbidden/notfound) Kamailio blocks User's IP (for instance using pike > > module) and Fail2Ban adds affected IP into IPSet's List to block it by > > IPTables Permanently. > > > > 3. INVITEs are translated to Asterisk as to the only Upstream > > SIP-Server. And again Errors from Asterisk are processed in the same way > > as Bad REGISTERs. Pike in conjunction with IPSet/IPTables block affected > > IPs. > > > > 4. Astersisk sees all registrations from Internet user as they are > > directly behind Kamailio. Kamailio rewirtes headers twice: from Users to > > Asterisk and from Asterisk to Users - this allows to hide topology from > > users (they deal ONLY with Kamailio) and block non-static IPs on the > > Asterisk's side. > > > > Is this possible? > > > > Kind regards, > > Ellad Yatsko > > > > > > > > > > > > _______________________________________________ > > Kamailio (SER) - Users Mailing List > > [email protected] > > https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users > > > > _______________________________________________ > > Kamailio (SER) - Users Mailing List > > [email protected] > > https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users > > > > _______________________________________________ > Kamailio (SER) - Users Mailing List > [email protected] > https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users -- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/ _______________________________________________ Kamailio (SER) - Users Mailing List [email protected] https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
