Blacklist / Whitelist

Sometimes you need to limit who can connect to your node. A blacklist blocks specific nodes, and a whitelist allows only the nodes you choose. Click any command or config block to copy it.

How it works

	Blacklist	Whitelist
What it does	Blocks the nodes on the list. Everyone else can connect.	Allows only the nodes on the list. Everyone else is blocked.
Best for	Keeping out one or two problem nodes	A private node or a closed group
Local nodes	Not affected unless listed	Nodes on the same server (127.0.0.1) are always allowed

Only inbound connections are checked. Your node can still connect out to any node, even one on the blacklist.

Only one list can be active at a time, and it applies to every node on the server.

Setup

Open the dialplan file: nano /etc/asterisk/extensions.conf

Find the [radio-secure] context and paste both of these blocks just below it. Adding both now lets you switch between them later without editing this file again.

[blacklist]
exten => _XXXX!,1,NoOp(${CALLERID(num)})
exten => _XXXX!,n,GotoIf($[${DB_EXISTS(blacklist/${CALLERID(num)})}]?blocked)
exten => _XXXX!,n,Goto(radio-secure,${EXTEN},1)
exten => _XXXX!,n(blocked),Hangup

[whitelist]
exten => _XXXX!,1,NoOp(${CALLERID(num)})
exten => _XXXX!,n,NoOp(${IAXPEER(CURRENTCHANNEL)})
exten => _XXXX!,n,GotoIf($["${IAXPEER(CURRENTCHANNEL)}" = "127.0.0.1"]?radio-secure,${EXTEN},1) ; permit local IPs
exten => _XXXX!,n,GotoIf($[${DB_EXISTS(whitelist/${CALLERID(num)})}]?radio-secure,${EXTEN},1)
exten => _XXXX!,n,Hangup

Open the IAX config: nano /etc/asterisk/iax.conf
In the [radio] section, pick which list is on by leaving exactly one context = line without a ; in front. This example turns on the blacklist:
```
[radio]
type = user
disallow = all
allow = ulaw
allow = adpcm
allow = gsm
codecpriority = host
;context = radio-secure
;context = whitelist
context = blacklist
transfer = no
```
To use… Leave this line on

Blacklist context = blacklist

Whitelist context = whitelist

No list (back to normal) context = radio-secure
Save both files and restart so the changes take effect: astres.sh Or simply reboot.

To use…	Leave this line on
Blacklist	`context = blacklist`
Whitelist	`context = whitelist`
No list (back to normal)	`context = radio-secure`

Managing the lists

The lists live in the Asterisk database and are managed from the Asterisk command line. Open it with:

asterisk -rvvv

Then use these commands at the CLI> prompt (type exit when done):

To…	Blacklist	Whitelist
Add a node	`database put blacklist 1998 "any comment"`	`database put whitelist 1000 "any comment"`
Remove a node	`database del blacklist 1998`	`database del whitelist 1000`
Show the list	`database show blacklist`	`database show whitelist`
Show everything	`database show`

List changes work right away. Adding or removing a node doesn't need a restart, and the lists are kept through reboots.

Use the comment to note who the node belongs to or why it was added, e.g. "stuck keyed 10/18". It makes the list much easier to manage later.

Command builder

Fill this in to get a ready-to-paste command.

Action List Node number Comment

At the CLI> prompt:

Or straight from the Linux prompt, without opening the CLI:

Tips

Whitelist your friends first. As soon as the whitelist is on, every node not on it is blocked, including your hub. Add the nodes you want before switching iax.conf over.

Outbound still works. A blocked node can't connect to you, but you can still connect to it.

To turn the list off, go back to context = radio-secure in iax.conf and restart. Your lists stay saved for next time.