Block asterisk password brute force in Asus RT-n66u

block_sip_spammers.sh

#!/bin/sh
IPS=$(cat /opt/var/log/asterisk/messages | grep -oE "failed for '([^:]*)" | grep -oE '[0-9]+\.[0-9]+\.[0-9+]+\.[0-9]+' | sort | uniq)

[ -z "$IPS" ] && exit 0

for ip in ${IPS}
do
  echo "Blocking IP: ${ip}"
  iptables -I INPUT -s ${ip} -j DROP
  echo "iptables -I INPUT -s ${ip} -j DROP" >> /jffs/scripts/firewall-start
done

# Send notification
python /opt/bin/telegram_send "Asterisk blocked IPs ${IPS}"

# Clear messages to prevent double blocking
echo "" > /opt/var/log/asterisk/messages