FreePBX Site Disconnects All Phones At Once
-
FreePBX 14, found this issue today. A site that normally works will suddenly have all phones disconnect. I connected my own line from home to see if it would disconnect as well, but it registered and was solid even when the main site disconnected. All phones, all at once. I suspected a site network issue, of course.
Inbound and outbound trunks were always still working, so the issue had to be related to the site.
I found that if I watched the system long enough, that the phones would connect again, but not for long. All coming back on, or going off, together. I tried restarting the responsive firewall, and this would cause the phones to all connect, but then all disconnect again. This seems odd as the LAN has a static IP for that site and is whitelisted in the firewall, so in theory there should be no firewall activity to block the site.
I watched the logs from asterisk and noticed a lot of failed attempts at connecting from a device at that site with a bad password, which led me to suspect the intrusion detection system.
Sure enough, the issue was being caused by a fail2ban detector seeing the bad passwords and banning the site over and over again. Intrusion Detection in FreePBX is not under the Responsive Firewall, but is its own thing. To modify it, you go to Admin -> System Admin -> Intrusion Detection. Here you can see what IPs are currently banned, change any settings, set up and most importantly, whitelist any sites that you need to not have be affected by fail2ban's detection mechanism.
