APIBAN helps protect your Asterisk and FreePBX systems from unwanted SIP traffic.

1. AstriCon 2021
Fred Posner
@fredposner
https://qxork.com
Securing Asterisk or FreePBX with
APIBAN

2. Agenda
●
Introduction
●
What is APIBAN?
●
How APIBAN works
●
How to Integrate

3. Introduction

4. Who am I?
●
I’m Fred
●
Matrix:
@fred:matrix.lod.com
●
Twitter: @fredposner
●
VoIP Consultant
●
https://qxork.com

5. What is APIBAN?

6. APIBAN is not Fail2Ban

7. (I don’t like Fail2Ban)

8. Experiences with Fail2Ban
●
Major
– Memory issues
– CPU issues
– Reactive
– Single box
●
Minor
– Never could
remember
commands
– Messed with Chains

9. What is APIBAN?

15. How APIBAN Works

16. How APIBAN Works
●
Globally deployed
Honeypots
●
IP kept “active” for 7
days
●
Accessible via API

17. API
●
banned (GET)
– List in groups of 250
– Control ID
●
check (GET)
– Individual IP check

18. API Example
●
https://apiban.org/api/[APIKEY]/banned
●
HTTP 200
{"ipaddress":["1.2.3.4","1.2.3.5"], "ID":"9876543210"}
●
HTTP 400
{"ipaddress":["no new bans"], "ID":"none"}
●
https://apiban.org/api/[APIKEY]/banned/[ID]

19. API Example
●
https://apiban.org/api/[APIKEY]/check/[IPADDRESS]
ie check/1.2.3.4
●
HTTP 200
{"ipaddress":"blocked", "ID":"9876543210"}
●
HTTP 404
{"ipaddress":"ok", "ID":"0"}
Full documentation: apiban.org

20. How APIBAN Works
1. Go to APIBAN.org
2.Get Key
3.Start Using APIBAN

21. How APIBAN Works
●
Cost: $0
●
Service provided by
LOD.com

22. Integrating APIBAN

23. Integrating APIBAN
●
Use the API
– Kamailio example
– API documentation on
apiban.org
●
Open Source Client
– Go (or bash)
– Integrates with IPTABLES
github.com/palner/apiban

24. Go Client
●
Small Footprint
●
Auto Flush
●
Compile yourself or
download and run
●
Linux, Pi

25. Simple Installation
1. Create the folder /usr/local/bin/apiban
2.Download apiban-iptables-client
3.Download config.json
4.Update config with your APIBAN key
5.Give client execute permission

27. iptables-api

28. github.com/palner/iptables-api
●
Very simple API
●
Local chain in
IPTABLES
●
IPv4 and IPv6

29. iptables-api example
●
curl localhost/blockip/1.2.3.4
●
curl localhost/unblockip/1.2.3.4
●
curl localhost/flushchain

30. Example
same => n,Log(NOTICE, ${CHANNEL(pjsip,remote_addr)}
just tried to do something bad)
same =>
n,Set(Result=${CURL(http://localhost:8082/blockip/$
{CHANNEL(pjsip,remote_addr)})
same => n,Log(NOTICE, local apiban ${Result})

31. Thank You!
Questions?
Fred Posner
https://qxork.com
https://apiban.org