Crashes when try to edit alias

johnpoz

@cdsJerry yeah if your going to add large cidr ranges - don't use the host alias, since it will expand them to for every IP in the range. Use the networks alias if your adding large number of large cidr ranges.

Where are you pulling this list of IP/Networks from exactly - you know updating the alias can be automated either with the built in alias tools or pfblocker alias function is way more robust

stephenw10

Yup probably that^

cdsJerry

@stephenw10
I'm sure it was a huge list but since the gui can't display it now, I can't edit it. How do I get back to a way where I can manage it and maybe do it right this time? (based on the comments below)

stephenw10

Can you view the aliases page at all? If so you can probably delete it.

Otherwise I would roll back the config to before you added it. Either via Diag > Backup/Restore or at the console if you can't reach that.

Steve

cdsJerry

@johnpoz Yes, it was a list published on Cloudflare's page. It's a bunch of large ranges. I saw that the interface would expand out the list but I didn't know that would crash the system. I'm sure this is the problem. I think I had put in two, maybe three, of the ranges before it crashed.

So how do I get into the alias to manage it at this point? Do I just delete the entire alias and start it over as network instead of a host?

There had been some IPs in there with a description something like "imported from Cloudlfare/ips" or something. I can't give you the exact text as it's gone and I can't even get into the alias now. But I did notice that none of the IPs listed there were anything even similar to the IP list on Cloudflare's page. I figured the ones in the firewall were outdated. I think they all started with 199. or 197.

I don't know anything about an automated Alias tool. I wonder if that's where the old list came from but if so, why didn't any of the IPs match the IP list from Cloudflare?

stephenw10

@cdsJerry said in Crashes when try to edit alias:

Do I just delete the entire alias and start it over as network instead of a host?

Yes, do that if you can.

johnpoz

@cdsJerry without info on where you got the list of cloudflare IPs or ranges have no idea why they might be different or even the ability to check Ips listed on who owns them.

If I was looking for the authoritative list of what IPs cloudflare uses - I would go to the horses mouth..

https://www.cloudflare.com/ips/

From that the Ipv4 isn't all that large of list. But if you converted those ranges to individual IPs - it would be a shit ton ;) There are 2 /13s in that list - those alone are over 500k IPs each.

173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22

Out of curiosity only - why do you want such an alias? How are you going to use it?

Just the /13s and the /14 your over 1.3 Million Ips if you expand the cidrs out - that is a lot of entries for a "table" ;)

cdsJerry

@stephenw10 I I reloaded the config from an auto backup. I can' now get into the alias
The entries are of two kinds with several entries of each kind. They look like this:

199.27.128.30 Entry added Mon, 24, Oct 2011 12:41:52 +0000 Note this entry was added 13 years ago?
197.234.240.0 from cloudflare.com/ips

The second one is part of the address listed on Cloudlfare's list of IPs
173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22

So it appears that I'm back to where I started, which in this case is good. Now I just need to figure out how to update the list correctly.

cdsJerry

@johnpoz Sorry for the IP list. Looks like were were both writing at the same time.

The reason I was messing with this at all is that I'm getting a pile of 520 errors on my website. When I pause Cloudflare they go away so it appears that for some reason Cloudflare isn't able to access my server to get the images (that's all that's stores on this particular server... images used on my website and a few specification files that can be downloaded). It seemed reasonable to me that if I turned off Cloudflare and could get the images, but turn on Cloudflare and there's a 520 error which it reports as being between Cloudflare and my server... it must be the firewall. So I started looking at the Alias list and sure enough, I had one for Cloudflare but most of it appeared to be out of date so I thought "ah ha! That's why I'm getting 520 errors. I should update the IP lists." And boom! Here I am.

johnpoz

@cdsJerry so you using the alias to what IPs can access your resource via firewall. And you want only cloudflare to access these resources. Oh that makes sense, thanks for setting my Kuriosity Kat at ease..

if you create a network alias that should be easy enough to create.. But you could prob also just have it loaded directly using the url to the text version of that list..

https://www.cloudflare.com/ips-v4/#

here you go - the 7 I put there in the drop down means this list would be updated every 7 days.. You could do a 1, if you wanted it to be updated in hours you would need to use the pfblocker aliases features. But doesn't really look like they update that list all that often

cdsJerry

@johnpoz John, actually I'm not trying to restrict access to only Cloudflare. I'm just trying to make sure Cloudflare isn't blocked by some other rule so I put the Cloudflare alias above most of the block rules. I say that... but as I go look at my rules list just now I see it's Disabled. Not sure if it's been disabled or if that just happened when I restored the alias from the config backup. Maybe that rule hasn't been active for a long time. I hadn't looked at that before I started making changes to the alias. Rats.

I see the rule information says it was last updated on 5/8/15 so I guess this rule hasn't done anything for years. Probably best to just delete it and delete the Cloudflare alias as well.

johnpoz

@cdsJerry ok - same difference really.. If you block XYZ via some rule, and you want to make sure these IPs are not blocked.. Then sure you put rule allowing this alias before your block that blocks other stuff.

I do same to be honest.. I only allow for example US Ips in some rules. But I also want to make sure that the statuscake Ips - that could be global always have access. So I use a floating rule that allows the list of IPs from statuscake, before it would hit the rule that only allows US ips, etc.

cdsJerry

@johnpoz OK, I changed the Alias to the table as you suggested above and I enabled the rule again. I don't know where the problem is, but I still have a problem. When I disable the cache on Cloudflare so that all request must pull their images from our server... all the images fail to display. I don't know if it's a firewall problem but it sorta looks like it.

johnpoz

@cdsJerry well if it was a firewall problem - you would see traffic being blocked, unless you disabled the log of deny?

Do you see traffic from an IP that is being denied to what I would assume is 443 on your firewall?

Are you saying if you remove the rule for cloudflare IPs it works?

cdsJerry

@johnpoz I honestly don't know what's going on. Is it a firewall issue or a Volusion issue? Beats me. If it's Volusion I don't want to waste any more of your time.

pfsense Screenshot 2023-10-20 102646.png

I have found a pattern, but no explanation. If I open a browser and pull up a product that has no image I can refresh the page multiple times.. .still no image. I then open that product page in Volusion's back end and go to the images section. I copy the image file name (text) and paste it right back into the same field making NO changes, then save the product. And then refresh the page on my computer and the image now displays perfectly.

If I copy the entire URL instead of just the file name sometimes it displays and sometimes it doesn't. But if I copy just the picture name and paste it back, it works.

All this sounds like a Volusion problem.. so why the 520 errors trying to view those images in a browser. That has nothing to do with Volusion as the images aren't hosted on their computers at all. Here's an example I haven't fixed. https://images.cds.com/Microboards/MEDB-10001_sm.jpg

Several min. later I reloaded that URL above without making ANY changes to either the firewall, my server, nor Volusion. And now the picture loads just fine. When I look at the firewall logs MY IP doesn't show up, which makes sense. After all, the IP looking for the image should have been one of those millions of Cloudflare IPs.

stephenw10

Some sort of dynamic reference that gets recreated when you save it maybe?

johnpoz

@cdsJerry Why are those blocked? What rule blocked them? Are they stateful blocks? Or are they something other than a SYN? What is in the protocol column for those blocks?

Maybe the session closed on your end, and when clouldflare tries to use a old session its blocked because its out of state? I you have a specific rule that allows those IP ranges - the only reason they would be blocked is they are to a wrong port, or are out of state.

cdsJerry

@johnpoz The log has moved past those entries now. I'm 99% sure they were TCP:S I thought I'd captured the block rule but I see the graphic that I didn't get it. It may have been a state because I'm not seeing it blocked this morning. Either that or Cloudflare got the resources from another IP and is caching them now because all my images are on the website. Before they were missing the graphics.

johnpoz

@cdsJerry those look like retries to me 1-2 seconds apart with the same source IP.. So very well could be cloudflare attempting to use an old session, that pfsense no longer had a state for..

If happens again make sure to grab or note what the protocol was if anything other than Syn, then it is an out of state block.