website security problems
-
@jc1976 what website? Do you have an example site where you are seeing this..
-
Sounds like maybe you have host overrides setup but only for the FQDN including www.
Just a guess though. More info needed!
Steve
-
@stephenw10 any website, not just one.
for example, if i were to type "pfsense.org" in the address bar, it'll think about it for a bit, then give me a webpage with a security warning, and a couple of buttons one of which says "continue" via Http (or something to that effect), and another button to cancel.
if i type in "www.pfsense.org", no problem.. goes right to the page without an error.
-
What is the exact error?
Where does it redirect to?
Steve
-
@jc1976 said in website security problems:
pfsense.org
That sends a 301 redirect to https://www.pfsense.org
Connecting to pfsense.org (pfsense.org)|208.123.73.69|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: https://www.pfsense.org/ [following] --2021-11-09 12:12:52-- https://www.pfsense.org/None of which has anything to do with pfsense specifically - unless you are using proxy on pfsense
-
@jc1976 said in website security problems:
i'm running pfsense 2.5.2 with pfblockerng-dev, suricata, and squid
It could definitely be pfBlocker or Squid. Try disabling them and see which one allows that to work.
Steve
-
I have seen this issue before on some browsers like Brave and browser plugins like "HTTPS Everywhere". These browsers/plugins are forcing https traffic on all websites, and if https traffic is not possible, they give the error that OP described.
-
@stephenw10 i was using pfsense.org as an example.
i'm not home at the moment so i can't give a precise example, as it happens for just about every page.
I figured it was something to do with either squid or pfblocker.. i dunno what's going on with them but i've been having nothing but problems lately. rebuilt my entire firewall from the ground, up.. never bothered restoring settings either.. just installed the packages, installed the subscription keys, and blaah... i tried having pfblocker and suricata inspect the LAN only, because it makes sense to me (why have them inspect the WAN when it's already blocked?), and it's caused nothing but problems and headaches.
-
-
It was just happening to me.. pfsense.org, duckduckgo.com.. the pages won't come up.
it happens regardless of the browser. i used firefox, but i tested it with edge as well.
in firefox, i disabled DoH because I want everything resolved in unbound. I have cloudflare setup for dns over tls and have the NAT forwarding rule in place as per the documentation. as of now i really don't have any rules set up other than the ones that pfsense installs by default with suricata and pfblocker.I just read that service watchdog can cause issues with suricata where suricata will need to restart but the watchdog causes a conflict, which i can understand, so needless to say watchdog won't be monitoring suricata or anything for that matter any more.
This is all really aggravating. i'm trying to teach myself how to read logs because it's even getting in the way of my trading platforms working properly. This was never an issue in the past.. now all of a sudden its all screwy.
thanks for you help!
-
@jc1976 First of all, did you try what @stephenw10 recommended with disabling Squid, pfBlockerNG, and Suricata services ?
You can also save your current configuration as XML file, perform factory reset or clean install of pfSense, and then just use pure defaults and see what happens. Then you can start installing your packages and perform testing between each package install. If theres an issue with pfSense, which i highly doubt there is, this will help you pinpoint the problem and potentially resolve it.
Did you try accessing web sites from different machine / device ? If not, you should test that out too to rule out any potential problem with the OS. Windows system policies can cause issues like these.
If you dont have another machine to test with, you can download GNU/Linux like Manjaro or Linux Mint, make a bootable USB flash drive, boot your system into a live environment that has Firefox browser in it, and test it from there. No installation required, so your system and files stay intact.
-
@nimrod
i disabled caching in squid last night and that made a huge difference.
I had caching enabled but i have the cache filesystem set as 'null' because i'm using an ssd.. i know, doesn't matter much these days but can't really tell a difference when caching is enabled vs disabled anyway..as far as other computers, my gf has her mac laptop and at first she was having issues and had to tether with her phone, then she came back to use my LAN for a meeting and it's been working ever since.
it comes and goes.. if i open DDG and do a search, it comes back with an SSL error..
i'm probably going to have to reinstall all the packages again, and just do as the normal guides suggest.. i originally had it set as suricata and pfblocker inspecting the LAN, and it was nice because it got rid of all false positives and pointless logging. but ever since then, i've had nothing but problems, even after redoing it all with suricata inspecting the WAN and pfblocker in its default state as well.
-
We need to know what the actual SSL error is here.
I could easily believe this is pfBlocker/DNS-BL resolving sites to it's local VIP. That will show an SSL error but the cert error makes that obvious if you look at it.
Steve
-
this is what i mean..
i uninstalled pfblockerng, deleting all settings as well so when i reinstalled it was to it's defaults.
i also restored suricata to it's defaults.neither are running at the moment because i can't get through to any sites. ddg.com will come up (sorta, but that's also problematic).
i also uninstalled firefox to it's entirety and reinstalled in it's default state.
I used Edge, my gf uses her mac with chrome, it's just really crappy.. if i go to speedtest.net, assuming the page even resolves, i get my full allotted speed. ping times are normal, around 12ms.i'm wondering if it's comcast... there was an outtage a couple weeks ago when this all started happening.. they got it up and running obviously, but i wonder if there's a config issue on their end with their routing?
what do you all think? this just doesn't make any sense.. i've NEVER had pfsense be so unreliable and problematic. even with all my screwing around, it always JUST WORKS... now its basically unusable..
-
@jc1976 says right there was the problem is
That isn't a pfsense thing.
Firefox setting
https://support.mozilla.org/en-US/kb/https-only-prefs
-
up until lately, i've never had a problem with it. ive had mozilla in https only mode ever since i knew the mode existed. on my pc at work, i have the same settings enabled and it works fine. also, that's just an initial screen. if i put www.amazon.com, the site resolves as it should. and this goes on for almost all sites.
the last 2 times i reinstalled pfsense from the ground, up, i use gparted to wipe out all partition tables. so, i know the install is completely fresh.
do you think it could be xfinity? a couple weeks ago we had an outtage and ever since then i've had issues.
as of now, my pfsense is doing nothing more than routing dns over tls traffic to cloudflare... THATS IT!. i disabled pfblocker, squid, suricata, got rid of watchdog.
this weekend i'm going to take a back up of the config from my other pfsense box at my family house. it's precisely the same dell optiplex 790 with an i7-2600 (with HT disabled).
Again, i REALLY appreciate your input! i absolutely LOVE pfsense! and i won't get rid of it.. i just need to figure out why i'm having so many issues with it all of a sudden. I wish i new how to read logs better..
the only other thing i question is the RAM. it's new and by crucial (16gigs).
16gigs of RAM should read 16384, however on my dashboard it reads 16201.
when i see my other pfsense box this weekend i'll be able to see if something is wrong. -
@jc1976 just to add, my other pfsense box has suricata running in inline mode whereas this one is in legacy.. always had problems with this one in inline, never in the other.. which is odd because the only difference between the two boxes is my current box has a quad port intel i340 nic, whereas my other has a dual port intel pro/1000. yes, hardware offloading has been disabled..
i dunno... i wish my GF wasn't living with me at the moment so i could focus on this when i get home from work.. LOL!
-
You're doing it right : re installing with bit level destroying etc.
But then you fail :
Do Not import your saved backup configuration !Do these simple steps :
Install clean.
Assign LAN interfaces, activates DHCP where needed.
Assign a WAN and connection method.
Change the admin password.And now the critical thing : do nothing else.
No config import - do nothing.
Done !pfSense works out of the box.
Your issue is solved.
And you also know now what the issue was .... -
@jc1976 this was never a pfSense or Xfinity issue to begin with. The error you got was clearly a browser/plugin issue as i described in my first post in this thread. Just because you didnt have any issues before, doesnt mean that the issue was not there. Browsers and their plugins are constantly getting updated, and with those updates, their behavior changes as well. Previous versions could try to establish HTTPS traffic, and if they fail, they just continue to HTTP without you even knowing. This could be browser "security issue" so Mozilla decided to change this and warn you if HTTPS traffic is not possible, and force you to "accept the risks" before you continue.
There is no need to use gparted or any other 3rd party software to wipe partitions. pfSense installer is doing that by default. Im not sure why you removed pfBlockerNG, Squid and Suricata if you have more than capable hardware. Neither of those packages were causing the issue you had. You are just paranoid now for no reason.
You also said, and i quote:
"i just need to figure out why i'm having so many issues with it all of a sudden. I wish i new how to read logs better.."
What other issues are you having ?
As for the RAM memory, some amount of your total system memory is shared with onboard graphic card. This can be changed in BIOS. pfSense doesnt need much video RAM since its not running Xorg graphic server. Its all textual or web interface mode. Unfortunately some BIOS-es wont let you set this shared memory size less than 32, 64 and on some system even 128mb of RAM. If you want to overcome this issue, you need a dedicated video card, which is totally pointless since you have 16GB of RAM which is overkill anyway.
-
This is not a RAM issue.
It's almost certainly a browser issue. That should be easy to check though by just using a different browser.
It could be a combination of things and that browser plugin is just revealing it.Like something is resolving those to a different page, maybe a warning or error, and your browser is showing that because it's http.
Steve
