# fail2ban for Asterisk, FreePBX and other SIP servers

> Stop SIP brute force with fail2ban: the asterisk filter and jail for 5060/5061 TCP+UDP, the security log, FreePBX Intrusion Detection, FreeSWITCH, Kamailio and 3CX.
>
> Source: https://fail2ban.dev/guides/asterisk/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

To protect Asterisk with fail2ban, enable the stock `[asterisk]` jail in `/etc/fail2ban/jail.local` and point `logpath` at Asterisk's log, usually `/var/log/asterisk/messages` plus the security log. The jail already bans ports 5060 and 5061 on both TCP and UDP. The [asterisk filter](/guides/asterisk/#filter-asterisk) matches failed registrations, unknown peers, rejected calls and PJSIP security events.

```ini
[asterisk]
enabled  = true
backend  = auto
logpath  = /var/log/asterisk/messages
           /var/log/asterisk/security
maxretry = 5
bantime  = 1d
```

## What the stock asterisk jail does

From `jail.conf`:

```ini
port     = 5060,5061
action_  = %(default/action_)s[name=%(__name__)s-tcp, protocol="tcp"]
           %(default/action_)s[name=%(__name__)s-udp, protocol="udp"]
logpath  = /var/log/asterisk/messages
maxretry = 10
```

SIP scanners often probe other services too. To block a caught address on every port, use the all-ports action in the jail:

```ini
[asterisk]
enabled   = true
backend   = auto
banaction = %(banaction_allports)s
logpath   = /var/log/asterisk/messages
            /var/log/asterisk/security
```

## What the asterisk filter matches

The filter covers both the old `chan_sip` and the current `chan_pjsip` messages:

```log
[2026-10-25 18:36:11] NOTICE[1943] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:100@192.0.2.10>' failed for '203.0.113.42:5072' (callid: abc123) - No matching endpoint found
[2026-10-25 18:36:12] NOTICE[3477] chan_sip.c: Call from '' (198.51.100.7:10836) to extension '0011441234567' rejected because extension not found in context 'default'.
[2026-10-25 18:36:13] SECURITY[1724] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2026-10-25T18:36:13.659+0000",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="<unknown>",SessionID="3686a690",LocalAddress="IPV4/UDP/192.0.2.10/5060",RemoteAddress="IPV4/UDP/203.0.113.42/5084",Challenge="1569024763/510a7e",Response="8e1814",ExpectedResponse=""
```
|---|---|
| `Registration from ... failed ... Wrong password / No matching peer found / Device does not match ACL` | chan_sip |
| `Request '...' from '...' failed for '<IP>' ... No matching endpoint found / Failed to authenticate` | chan_pjsip |
| `Call from ... rejected because extension not found in context` | chan_sip, chan_pjsip (toll-fraud probes) |
| `Host <IP> failed to authenticate`, `No registration for peer` | chan_iax2 |
| `SecurityEvent="InvalidAccountID / ChallengeResponseFailed / InvalidPassword / FailedACL"` | security log (any channel driver, also AMI) |

fail2ban 1.1.1 fixed the PJSIP "No matching endpoint found" rule for newer Asterisk versions that append `after X tries in Y ms`.

## Turn on the Asterisk security log

PJSIP reports most authentication failures as security events, and those go to the `security` log level only. Enable a channel for it in `/etc/asterisk/logger.conf`:

```ini
[logfiles]
messages => notice,warning,error
security => security
```

If Asterisk logs to syslog or the journal instead of files, use `backend = systemd`. The filter has `journalmatch = _SYSTEMD_UNIT=asterisk.service` and handles the extra timestamp Asterisk prints in journal lines.

## Test the jail

```bash
sudo fail2ban-regex /var/log/asterisk/security asterisk
sudo fail2ban-client -t
sudo systemctl restart fail2ban
sudo fail2ban-client status asterisk
```

> **Whitelist your SIP trunk and phones**
A provider's proxy or a remote office behind one NAT can rack up failures fast if one phone has a stale password. Add trunk and office addresses to `ignoreip`, or the whole office loses phones when one handset misbehaves.

Pair the jail with [recidive](/config/recidive/): SIP bots come back the moment a ban expires, and a week-long all-ports ban on the second offence ends that.

## FreePBX: Intrusion Detection is fail2ban

FreePBX's **Intrusion Detection** (part of the Sangoma System Admin module) is fail2ban with a GUI. The module writes fail2ban's configuration, including `/etc/fail2ban/jail.local`, and shows bans in **Admin → System Admin → Intrusion Detection**. Don't install a second fail2ban.

Changes you make directly in `jail.local` get overwritten the next time the module rewrites it. Put local overrides in a separate file that's read after `jail.local`:

```ini
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24
```

### "FreePBX fail2ban not running"

When the dashboard says fail2ban isn't running or Intrusion Detection won't start, find the real error first:

```bash
sudo journalctl -u fail2ban -n 50 --no-pager
sudo fail2ban-client -t
```

- **Missing log file.** On FreePBX 17 (Debian 12) there's no `/var/log/auth.log` or `/var/log/secure`, so an SSH jail fails with `Have not found any log file for ... jail` and fail2ban refuses to start. Set `backend = systemd` for that jail in a `jail.d/*.local` file, or create the missing file. See [no log file](/troubleshooting/no-log-file/).
- **A filter referenced by a jail doesn't exist** (`Unable to read the filter`). Usually left over from a module update. Reinstall or update the System Admin module.
- **Start limit hit.** After several failed starts systemd stops trying. Fix the cause, then `systemctl reset-failed fail2ban && systemctl start fail2ban`.

## FreeSWITCH

The stock `[freeswitch]` jail and [freeswitch filter](/guides/asterisk/#filter-freeswitch) match Sofia auth failures:

```log
```

```ini
[freeswitch]
enabled = true
backend = auto
port    = 5060,5061,5080,5081
logpath = /var/log/freeswitch/freeswitch.log
```

## Kamailio and OpenSIPS

fail2ban ships no Kamailio filter, but you control what Kamailio logs. Log a line when an auth check fails *with* credentials present, then match it:

```text
if (!auth_check("$fd", "subscriber", "1")) {
    if (is_present_hf("Authorization") || is_present_hf("Proxy-Authorization")) {
        xlog("L_WARN", "F2B-AUTH-FAIL: $rm from $si:$sp user=$fU\n");
    }
    auth_challenge("$fd", "0");
    exit;
}
```
[Definition]
failregex = ^\s*(?:\S+ )?\S*kamailio\[\d+\]: WARNING: <script>: F2B-AUTH-FAIL: \S+ from <ADDR>(?::\d+)?
ignoreregex =
```

## 3CX

3CX doesn't use fail2ban for SIP. It has a built-in anti-hacking feature that blacklists IPs after failed registrations, plus a global IP blacklist shared between 3CX installs, both managed in the 3CX admin console. Don't add an asterisk-style jail on a 3CX host. Use fail2ban there for SSH only.

## asterisk and freeswitch filter reference

{{component:filter-ref:asterisk.freeswitch}}

## FAQ

### How do I set up fail2ban for Asterisk?

Enable the stock `[asterisk]` jail in `jail.local` and set `logpath` to `/var/log/asterisk/messages`, plus `/var/log/asterisk/security` after adding `security => security` to `logger.conf`. The jail bans ports 5060 and 5061 on both TCP and UDP. Test with `fail2ban-regex /var/log/asterisk/messages asterisk`.

### Why is fail2ban not running on FreePBX?

Usually a jail can't find its log file, often SSH on FreePBX 17 (Debian 12, no auth.log), and fail2ban refuses to start. Run `systemctl status fail2ban` and `fail2ban-client -t`, then fix the jail with `backend = systemd` in a `jail.d/*.local` file, because the System Admin module rewrites `jail.local`.

### Does the fail2ban asterisk filter work with PJSIP?

Yes. It matches PJSIP's `Request ... failed for '<IP>' ... No matching endpoint found` and `Failed to authenticate` notices, plus `ChallengeResponseFailed` and `InvalidPassword` security events. Enable the security log channel in `logger.conf`, because many PJSIP failures only appear there.

### Why does fail2ban ban SIP on TCP and UDP separately?

The `[asterisk]` jail defines two actions, `asterisk-tcp` and `asterisk-udp`, because SIP mostly runs over UDP while TLS (5061) uses TCP. A single action with the default `protocol = tcp` would leave UDP 5060, the port bots actually use, open to the banned address.

### Does 3CX need fail2ban?

Not for SIP. 3CX blocks addresses with repeated failed registrations through its built-in anti-hacking feature and IP blacklist, configured in the admin console. fail2ban on a 3CX server is useful for SSH only.

### Is there a fail2ban filter for Kamailio?

No stock one. Log failed authentication with `xlog` from your routing script, using a fixed tag such as `F2B-AUTH-FAIL`, and write a short filter for that line. Kamailio's `pike` and `htable` modules can also rate-limit and block abusive sources inside Kamailio.