I'm posting this here because I can't find where the freeswitch forums are but even though this is kind of interesting, it's also pretty scary and my subnet that hosts my little VOIP telephone network is currently out of service. I'm running a Linux server with a lot of memory that runs VMWare Workstation. All my trixboxes and other PBXs run in their own virtual machine making it easy for me to network lots of them in all kinds of configurations. I'm still learning this. I started with trixbox and that's my main PBX and one of my trixboxes is even trunked into an ITSP so I can call into the outside world and the outside world can call into me. Over the past months I've gotten very familiar with asterisk and how trixbox does things. I have also tried out other PBXes like Digium and Sip foundry just to see how they work.
Freeswitch has been on my radar for quite awhile and I had it compiled in a couple of VMs and on the Linux host that runs the VMWare which supports all the VMs. Since I had the Freeswitch already compiled on the host I decided to fire it up into the default configuration. The default config worked and I even trunked it into a local trixbox serving as a VOIP provider and that worked. The XML config is kind of complicated so I'm far from figuring it out yet.
I then installed FreePBX to see how that works with the FreeSwitch compared to how it works with trixbox and AteriskNOW. The install went OK -- there were some issues with FreePBX that I really didn't like but I digress. After getting FreePBX almost working I went to take the dog for a walk and came back and saw the lights on my router were blinking furiously which is never a good sign. :I usually have wireshark running all the time. I went to check wireshark and there were so many messages so fast it crashed and my Linux server was sluggish.
I was getting SIP Register requests to the FreeSwitch from the same IP address in the 58.20.0.0 network which is from Beijing China. I have absolutely no idea how they found out about this installation. I run my own DNS server for all the PBXs and I constantly make sure no errant DNS requests ever make it to a public DNS server. The FreeSwitch was in its default config but after I loaded FreePBX it changed the configuration (which I really didn't like) and I'm not sure what it did. Something had to have sent out a notification to the Chinese in order for them to know my stupid unconfigured freeswitch even existed. Ironically, they were probably looking for free phone calls and they should have hit the trixbox that was actually configured to the outside world.
I have two IPs on my DSL line and the IP that's hooked to the subnet with the VOIP network is currently down but my other IP is working which is why I can post this. Apparently my ISP saw that traffic and cut it off and put that IP out of service. I'm going to work with them today to get back up and running but I'm a little worried about this. Had I been a consultant on a real VOIP install and this happened it would have been a disaster. Not only did a goofball in China take down my phone network, they could have taken down my entire network and Internet. access.
I'm posting this story here in the hopes that someone has some insights into what I might have done wrong and how I can avoid something like this happening again.
Member Since:
2010-04-01