Snort best practice to Unblock

john24634

Hi all,

I've installed SNORT and I love it, however I find it hard to unblock my traffic.

What is the best way to unblock my real traffic.

Try to reproduce to connect to the page and look in the logs? and which logs?

Or there is a better way?

John

SteveITS

@john24634 start in alert only mode so you can see what is triggering and tune your settings.

The alerts tab shows history plus blocked IPs have an X. The blocks tab shows only currently blocked IPs.

john24634

So since I installed Snort I cant access from Internet my site mySite.duckdns.org.

I did both Force disable on Alert and Clear the Blocked List.

also if I Click "stop snort" on snort status i still can reach it.

Does stop nort disables completelly the IDS?

SteveITS

@john24634 I’m assuming you’re using the default legacy blocking mode. if you delete a blocked IP then it’s not blocked anymore. Whether Snort is running is actually irrelevant.

There is no need to run Snort on both WAN and LAN. Typical use is to run it on LAN.

bmeeks

@john24634 said in Snort best practice to Unblock:

Does stop nort disables completelly the IDS?

No, Snort blocks by telling pfSense to place an IP address in a system-created pf table called snort2c. Once an IP is placed in that table, a hidden firewall rule created by pfSense at startup blocks that IP address until it is removed from the table. Stopping nor restarting Snort alters anything in that table once the IP is placed there initially. Stopping Snort prevents any additional IP addresses from being added to that table, but it does not remove any that are already present.

There are fours ways to clear an IP from that table and thus "unblock" that address.

Use the Remove Blocks button on the BLOCKS tab of Snort.
Configure the Remove Blocked Hosts Interval setting on the GLOBAL SETTINGS tab of Snort. That will remove blocked hosts at the interval shown providing that host has produced no further traffic during the interval period.
Clear the entire snort2 table contents using the option under DIAGNOSTICS > TABLES.
Reboot the firewall. All pf tables are RAM constructs and are thus automatically cleared out when the firewall reboots.