Zycoo CooVox T Series, Руководство администратора и пользователя

Страница: 138 / 147

- 132 - ZYCOO CooVox T-series IP Phone System Admin User Guide v4.0.0
communicating with the IPPBX system. Even the service port number can be specified so it can grant or deny a
specific IP or network to access a specific service. The priority from high to low of the firewall rules is from the top
of the list to the bottom.
If you are going to grant access of some kind of services to specific IP address or network, add the grant rule/rules
first then add the deny rules. If the order of the rules is not correct you may use the arrows in the
Priority column
to adjust the order of the rules.
In the above given example, the 2 rules “AcceptAMI” and “BlockAMI” limited that only the IP addresses from
network 192.168.17.0 can have AMI access. Except IP from this network others will all be denied to access. In this
case, if the “AcceptAMI” rule is moved beneath the “BlockAMI” rule, then the AMI port will be totally lockdown,
no one can access it.
Notice
If you are going to add rules to block some IP addresses from accessing some kind of services on the IPPBX system,
be sure you add the correct IP/network address (if not defined, the firewall will consider as ALL), and the correct
service port number (if not define, the firewall will consider as ALL), otherwise misconfiguration of a deny rule
might cause the IPPBX system total lockdown, only way would be using Console (T100/T100S and T200) or HDMI
(T600) to unlock the IPPBX from command lines.
Auto Defense will help with the prevention of DDOS attacks.
You may specify the service port number and the maximum packets to be accepted on this port number in a
certain time interval. Except the specified number of packets, more packets sent within the time interval will be
dropped by the IPPBX system.
Intrusion Detection and Prevention
Path: System -> Security Center ->Intrusion Prevention
CooVox series IPPBX system uses Fail2Ban to perform intrusion detection.Fail2Ban is an intrusion prevention
framework written in the Python programming language. It works by reading Asterisk logs and some other logs in
the IPPBX system, and uses iptables profiles to block brute-force attempts.