[asterisk-iptables]

enabled  = true
filter   = asterisk
action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@localhost]
logpath  = /var/log/asterisk/messages
maxretry = 3
findtime = 60
bantime = 36000
destemail = support@domain.ru

[INCLUDES]

[Definition]

failregex = .*NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Wrong password
            .*NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
            .*NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
            .*NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Username/auth name mismatch
            .*NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
            .*NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Peer is not supposed to register
            .*NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - ACL error (permit/deny)
            .*NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
            .*NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - No matching peer found
            .*NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - Wrong password
            .*NOTICE.* <HOST> failed to authenticate as '.*'$
            .*NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)
            .*NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
            .*NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
            .*NOTICE.* .*: <HOST> failed to authenticate as '.*'
            .*NOTICE.* .*: <HOST> tried  to authenticate with nonexistent user '.*'
            .*VERBOSE.*SIP/<HOST>-.*Received incoming SIP connection from unknown peer
            .*NOTICE.* .*: Sending fake auth rejection for device.* \[IP: <HOST>:.*\]
ignoreregex =

[Sep  4 11:55:17] NOTICE[1289] chan_sip.c: Registration from '"xxxxxx" <sip:000000058@xxxxxx>' failed for 'xxxxxxx1120' - Wrong password
[Sep  4 11:55:30] WARNING[8110][C-00002003] app_dial.c: Dial requires an argument (technology/resource)
[Sep  4 11:55:52] WARNING[8125][C-00002005] dsp.c: Inband DTMF is not supported on codec g729. Use RFC2833
[Sep  4 11:55:55] NOTICE[8186][C-00002009] chan_sip.c: Call to peer '0000001594' rejected due to usage limit of 1
[Sep  4 11:56:06] NOTICE[1289] chan_sip.c: Registration from '"xxxxxxx" <sip:000000058@xxxxxx>' failed for 'xxxxxxxx:1120' - Wrong password
[Sep  4 11:56:14] NOTICE[8293][C-0000200b] chan_sip.c: Call to peer '0000001594' rejected due to usage limit of 1
[Sep  4 11:57:03] NOTICE[1289] chan_sip.c: Registration from '"xxxxx" <sip:000000058@xxxxxx>' failed for 'xxxxxx:1120' - Wrong password
[Sep  4 11:57:30] WARNING[8500][C-0000201a] dsp.c: Inband DTMF is not supported on codec g729. Use RFC2833
[Sep  4 12:00:15] WARNING[8942][C-00002036] dsp.c: Inband DTMF is not supported on codec g729. Use RFC2833
[Sep  4 12:01:22] NOTICE[1289] chan_sip.c: Registration from '"xxxxxx" <sip:000000058@xxxxxxx>' failed for 'xxxxxxx:1120' - Wrong password
[Sep  4 12:06:46] NOTICE[1289] chan_sip.c: Registration from '"xxxxxxx" <sip:000000058@xxxxxxx>' failed for 'xxxxxx:1120' - Wrong password
[Sep  4 12:07:38] NOTICE[10614][C-00002089] chan_sip.c: Call to peer '0000001482' rejected due to usage limit of 1
[Sep  4 12:08:01] NOTICE[1289] chan_sip.c: Registration from '"xxxxx" <sip:000000058@xxxxxxx>' failed for 'xxxxxxxx:1120' - Wrong password
[Sep  4 12:08:03] NOTICE[1289] chan_sip.c: Received SIP subscribe for peer without mailbox: 0000001082
[Sep  4 12:10:10] NOTICE[1289][C-00002096] chan_sip.c: Got OK on REFER Notify message
[Sep  4 12:13:31] ERROR[11772] utils.c: fwrite() returned error: Broken pipe
[Sep  4 12:13:36] NOTICE[11766][C-000020c6] chan_sip.c: Call to peer '0000001273' rejected due to usage limit of 1