Blacklist or whitelist: Difference between revisions
imported>Wd6awp No edit summary |
No edit summary |
||
(10 intermediate revisions by 3 users not shown) | |||
Line 1: | Line 1: | ||
{{Warning|adv-topics/allowdenylists/}} | |||
Occasionally it becomes necessary to limit connections to your node. With this configuration you can either blacklist (block) or whitelist (allow) inbound connections. Outbound connections are not blocked. Only one list can be used at a same time and it applies to all nodes on the server. If using the whitelist all nodes on the local server (127.0.0.1) are allowed. The lists are managed with these Asterisk CLI commands: | |||
=== Easy === | |||
WA3DSP wrote a script simplifies this process nicely: [https://hamvoip.org/downloads/node-ban-allow.sh Download node-ban-allow.sh] | |||
=== Less Easy === | |||
* Blacklist | * Blacklist | ||
*CLI> database put blacklist 1998 "any comment" | |||
*CLI> database del blacklist 1998 | |||
* | *CLI> database show blacklist | ||
* Whitelist | * Whitelist | ||
* | *CLI> database put whitelist 1000 "any comment" | ||
* | *CLI> database del whitelist 1000 | ||
* | *CLI> database show whitelist | ||
*Both | *Both | ||
* | *CLI> database show | ||
==Blacklist Configuration== | ==Blacklist Configuration== | ||
Line 57: | Line 60: | ||
</pre> | </pre> | ||
== Web Portal == | |||
If you want to have a blacklist for the web portal users you will need to modify the [allstar-public] context in extentions.conf | |||
<pre> | |||
[allstar-public] | |||
exten => s,1,Ringing | |||
exten => s,n,Set(RESP=${CURL(https://register.allstarlink.org/cgi-bin/authwebphone.pl?${CALLERID(name)})}) | |||
exten => s,n,Set(NODENUM=${CALLERID(number)}) | |||
exten => s,n,GotoIf($["${RESP:0:1}" = "?"]?hangit) | |||
exten => s,n,GotoIf($["${RESP:0:1}" = ""]?hangit) | |||
exten => s,n,GotoIf($["${RESP:0:5}" != "OHYES"]?hangit) | |||
exten => s,n,Set(CALLSIGN=${RESP:5}) | |||
exten => s,n,Wait(3) | |||
exten => s,n,Playback(rpt/node|noanswer) | |||
exten => s,n,Saydigits(${NODENUM}) | |||
exten => s,n,Set(CALLERID(name)=${CALLSIGN}) | |||
exten => s,n,Set(CALLERID(num)=0) | |||
exten => s,n,GotoIf($[${DB_EXISTS(blacklist/${CALLERID(name)})}]?blacklisted) | |||
exten => s,n,Rpt(${NODENUM}|X) | |||
exten => s,n,Hangup | |||
exten => s,n(hangit),Answer | |||
exten => s,n(hangit),Wait(1) | |||
exten => s,n(hangit),Hangup | |||
exten => s,n(blacklisted),Playback(privacy-you-are-blacklisted) | |||
exten => s,n(blacklisted),Playback(goodbye) | |||
exten => s,n(blacklisted),Wait(1) | |||
exten => s,n(blacklisted),Hangup | |||
</pre> | |||
Whitelist is not implemented here, but it should be easy to do | |||
To block a web-portal user you will need to add the callsign in capital letters to the blacklist. | |||
* <code>*CLI> database put blacklist KM6RPT "no comment"</code> | |||
[[Category:How to]] | [[Category:How to]] | ||
[[Category:Node Configuration]] | [[Category:Node Configuration]] |
Latest revision as of 21:25, 29 June 2024
Occasionally it becomes necessary to limit connections to your node. With this configuration you can either blacklist (block) or whitelist (allow) inbound connections. Outbound connections are not blocked. Only one list can be used at a same time and it applies to all nodes on the server. If using the whitelist all nodes on the local server (127.0.0.1) are allowed. The lists are managed with these Asterisk CLI commands:
Easy
WA3DSP wrote a script simplifies this process nicely: Download node-ban-allow.sh
Less Easy
- Blacklist
*CLI> database put blacklist 1998 "any comment" *CLI> database del blacklist 1998 *CLI> database show blacklist
- Whitelist
*CLI> database put whitelist 1000 "any comment" *CLI> database del whitelist 1000 *CLI> database show whitelist
- Both
*CLI> database show
Blacklist Configuration
Add this to extensions.conf just below the [radio-secure] context.
[radio-secure] ... ; To add a node to the blacklist: ; database put blacklist 1998 “any comment” ; to remove: ; database del blacklist 1998 ; to list ; database show blacklist [blacklist] exten => _XXXX!,1,NoOp(${CALLERID(num)}) exten => _XXXX!,n,GotoIf($[${DB_EXISTS(blacklist/${CALLERID(num)})}]?blocked) exten => _XXXX!,n,Goto(radio-secure,${EXTEN},1) exten => _XXXX!,n(blocked),Hangup [whitelist] exten => _XXXX!,1,NoOp(${CALLERID(num)}) exten => _XXXX!,n,NoOp(${IAXPEER(CURRENTCHANNEL)}) exten => _XXXX!,n,GotoIf($["${IAXPEER(CURRENTCHANNEL)}" = "127.0.0.1"]?radio-secure,${EXTEN},1) ;permit local IPs exten => _XXXX!,n,GotoIf($[${DB_EXISTS(whitelist/${CALLERID(num)})}]?radio-secure,${EXTEN},1) exten => _XXXX!,n,Hangup
In iax.conf modify the [radio] context by adding and/or commenting context = lines.
[radio] type = user disallow = all allow = ulaw allow = adpcm allow = gsm codecpriority = host ;context = radio-secure ;context = whitelist context = blacklist transfer = no
Web Portal
If you want to have a blacklist for the web portal users you will need to modify the [allstar-public] context in extentions.conf
[allstar-public] exten => s,1,Ringing exten => s,n,Set(RESP=${CURL(https://register.allstarlink.org/cgi-bin/authwebphone.pl?${CALLERID(name)})}) exten => s,n,Set(NODENUM=${CALLERID(number)}) exten => s,n,GotoIf($["${RESP:0:1}" = "?"]?hangit) exten => s,n,GotoIf($["${RESP:0:1}" = ""]?hangit) exten => s,n,GotoIf($["${RESP:0:5}" != "OHYES"]?hangit) exten => s,n,Set(CALLSIGN=${RESP:5}) exten => s,n,Wait(3) exten => s,n,Playback(rpt/node|noanswer) exten => s,n,Saydigits(${NODENUM}) exten => s,n,Set(CALLERID(name)=${CALLSIGN}) exten => s,n,Set(CALLERID(num)=0) exten => s,n,GotoIf($[${DB_EXISTS(blacklist/${CALLERID(name)})}]?blacklisted) exten => s,n,Rpt(${NODENUM}|X) exten => s,n,Hangup exten => s,n(hangit),Answer exten => s,n(hangit),Wait(1) exten => s,n(hangit),Hangup exten => s,n(blacklisted),Playback(privacy-you-are-blacklisted) exten => s,n(blacklisted),Playback(goodbye) exten => s,n(blacklisted),Wait(1) exten => s,n(blacklisted),Hangup
Whitelist is not implemented here, but it should be easy to do
To block a web-portal user you will need to add the callsign in capital letters to the blacklist.
*CLI> database put blacklist KM6RPT "no comment"