Configuration

Configuration

The default path is /etc/tfps/config.json. Every field is optional. Command-line flags override file values, which override built-in defaults. Unknown JSON fields and malformed values are startup errors rather than being silently ignored.

{
  "ports": [5060, 5061],
  "intl_prefixes": ["+", "00", "011", "9011"],
  "peers": {
    "10.0.0.5": { "intl_prefixes": ["9011", "011"] },
    "203.0.113.7": { "bare_e164": true }
  },
  "ignoreip": ["10.0.0.0/8", "203.0.113.7"],
  "home_countries": ["BR"],
  "behavioural": false,
  "learn_days": 30,
  "block_ttl": 3600,
  "iface": "eth0"
}

Values every deployment must decide

ignoreip

Addresses and CIDR networks TFPS must never enforce against, normally inbound gateways and trusted carriers. The host's own addresses are exempt automatically. Exempt traffic is still evaluated and counted. 0.0.0.0/0 is rejected; use --no-enforce for observation only.

ports and iface

The SIP ports to watch and the interface where XDP attaches. Without iface, TFPS uses the default-route interface. A multihomed SIP host should normally declare it.

intl_prefixes and peers

How each PBX presents international numbers. A per-peer plan takes precedence over global prefixes. Set bare_e164 only when a peer sends E.164 without + or another prefix.

For NANPA operators, use home_countries: ["NANP"]. Do not configure "1" as an international prefix: stripping it destroys the distinction between US/Canada and Caribbean destinations sharing +1.

home_countries

Your own country or countries. Destinations resolving there are national and do not enter the experimental behavioural detector.

Optional additions

• signatures: user-agent signatures added to the built-in list;
• injection: SIP URI patterns added to the built-in list;
• scanners: scanner domains or tool names added to identity matching;
• apiban_key: background APIBAN synchronization;
• behavioural: experimental behavioural detection; and
• db, checkpoint_every, stats_every, and block_ttl: persistence and timing.

See the complete README configuration reference.