Allowing random IP/PORT into LAN
-
@wwdot_computers yeah open the ports they list outbound - no where in that list does it say anything about the port you were listing.
There is also that 3262 port, but that seems to only be needed for bare metal restore.
edit: most of these rules make zero sense if you have endpoint only
Those ports are not listed in their doc, what do you have in the alias?
edit2: As a troubleshooting tool, create a rule on the top that allows one of your machines your trying to backup any any.. Log its traffic - what ports does it talk on for talking to backup?
Maybe your issue is dns related? And it can't resolve what that list says it needs to be able to resolve.. But looks like it need only 443 outbound, and then one of those 3 ports.
-
Here are the ports in the alias that I have from the rules I posted prior:
-
Well that 3260 and 25xxx ports are not needed per their doc.. And 123 is ntp and wouldn't be tcp, that would be udp.. And while sure the box should sync time it wouldn't do it over tcp.. And it can get time just from pfsense ntp server.. There doc doesn't list that as a requirement that I saw..
Maybe your issue dns related? Validate you can resolve those listed fqdn at the host your trying to backup.
-
Interesting. Can not resolve "dattolocal.net" Ideas?
-
@wwdot_computers said in Allowing random IP/PORT into LAN:
dattolocal.net
Something is really odd there... I can not resolve it either get servfail - and they clearly failing dnssec
If I ask google, I get this EDE info back about the servfail
; <<>> DiG 9.16.50 <<>> dattolocal.net @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 36032 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ; EDE: 0 (Other): ([162.244.87.41] Unexpected dlt-rly-tracker-4.datto.com/a in received ANSWER at dattolocal.net for dattolocal.net/a) ; EDE: 0 (Other): ([162.244.87.43] Unexpected dlt-rly-tracker-6.datto.com/a in received ANSWER at dattolocal.net for dattolocal.net/a) ; EDE: 0 (Other): ([162.244.87.44] Unexpected dlt-rly-tracker-2.datto.com/a in received ANSWER at dattolocal.net for dattolocal.net/a) ; EDE: 0 (Other): ([162.244.87.45] Unexpected dlt-rly-tracker-5.datto.com/a in received ANSWER at dattolocal.net for dattolocal.net/a) ; EDE: 0 (Other): ([162.244.87.42] Unexpected dlt-rly-tracker-3.datto.com/a in received ANSWER at dattolocal.net for dattolocal.net/a) ; EDE: 0 (Other): ([162.244.87.46] Unexpected dlt-rly-tracker-5.datto.com/a in received ANSWER at dattolocal.net for dattolocal.net/a) ; EDE: 22 (No Reachable Authority): (At delegation dattolocal.net for dattolocal.net/a) ;; QUESTION SECTION: ;dattolocal.net. IN A ;; Query time: 209 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Tue Jun 25 16:08:19 Central Daylight Time 2024 ;; MSG SIZE rcvd: 818If I do a +trace where no dnssec is actually performed I can get an answer
; <<>> DiG 9.18.16 <<>> dattolocal.net +trace ;; global options: +cmd . 19823 IN NS h.root-servers.net. . 19823 IN NS i.root-servers.net. . 19823 IN NS j.root-servers.net. . 19823 IN NS k.root-servers.net. . 19823 IN NS l.root-servers.net. . 19823 IN NS m.root-servers.net. . 19823 IN NS a.root-servers.net. . 19823 IN NS b.root-servers.net. . 19823 IN NS c.root-servers.net. . 19823 IN NS d.root-servers.net. . 19823 IN NS e.root-servers.net. . 19823 IN NS f.root-servers.net. . 19823 IN NS g.root-servers.net. . 19823 IN RRSIG NS 8 0 518400 20240707170000 20240624160000 5613 . TbfcxHfBUFXoWqSj9MqO9XQ/zZje2qfrSBhdeaVf3xpiuZqUxxGANBN8 KcQR5tNFbDRP/vPgFPAjWwR4nzAWe/Cv9KTz6lAjn2+O46GhsTIO7Zvu 4Y/r6C3KJsSXF1D7DdumS+rAI+eip3xStAghcSbqAQJfkwfUb2jy7m4k lcs1d6qT2CIcEcSU/i/z44gkJH5rtIH9zQfjF1i+1VQf66lx6PPAw4Aq t7Dsu8Hp0jrHeAvKUGAIemAZhfayXcU1EGGVa3uwWKjlcLgiaJPp6B0d lf5WBI1TsMsI7Zbr+r4lzsk5IsIwGgsblm3orML1HwMg2zmBlEjnVsRb UbMsug== ;; Received 525 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 86400 IN DS 37331 13 2 2F0BEC2D6F79DFBD1D08FD21A3AF92D0E39A4B9EF1E3F4111FFF2824 90DA453B net. 86400 IN RRSIG DS 8 1 86400 20240708200000 20240625190000 5613 . GUngUjWt7Wug0Z5OCnh1v5eVmd94d23+Lh8HdgFVVb9U9N6/htHgAeM0 emATeJbRTuKXfvEZPBJVs7nZi7/GmmWtAjmPXDjZMqUI5Uzu+TDftifG sFnBKsbKak4jaFwJfZGJk+SZiXd8Gpo9EHHefUk4BX5hDiM2HePJFVW6 FiQXacAOT2LjpZvz5se//Lq9qlFsJWp2guUWhl04ulyMYMUD7doH6Z08 5MrCWnqo/hxS6CU10zvrwe3hSfHniIU1+s75c+Dc6ZyH+z9bwcRGbDGq xXO0FmCftLbX4UfDYBGlIh9qJhcV4nPEcdO4ikEx2BBEJ7fJ4wy+AI8X qu7gbQ== ;; Received 1171 bytes from 170.247.170.2#53(b.root-servers.net) in 30 ms dattolocal.net. 172800 IN NS dlt-rly-tracker-1.datto.com. dattolocal.net. 172800 IN NS dlt-rly-tracker-2.datto.com. dattolocal.net. 172800 IN NS dlt-rly-tracker-3.datto.com. dattolocal.net. 172800 IN NS dlt-rly-tracker-4.datto.com. dattolocal.net. 172800 IN NS dlt-rly-tracker-5.datto.com. dattolocal.net. 172800 IN NS dlt-rly-tracker-6.datto.com. A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 86400 IN NSEC3 1 1 0 - A1RTLNPGULOGN7B9A62SHJE1U3TTP8DR NS SOA RRSIG DNSKEY NSEC3PARAM A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 86400 IN RRSIG NSEC3 13 2 86400 20240629024642 20240622013642 51809 net. hF4q89ZVBO55eWZL8q6wAOUvnOxAkEC0F6kFXLduI8SUKrUBJeteDhVc 7ErTVKxfUq7nrA3QJEy2gw2FEOSRbA== Q3HBHI4I2FNO0GDMKEMKT7TPSL5TGAKO.net. 86400 IN NSEC3 1 1 0 - Q3HHVPH6AM4SSQ6LMDCUHI413ISDSBIE NS DS RRSIG Q3HBHI4I2FNO0GDMKEMKT7TPSL5TGAKO.net. 86400 IN RRSIG NSEC3 13 2 86400 20240629025141 20240622014141 51809 net. zkHGAQm9SQf01Os21pcWOpH+0U7bsKF2y+kYUKv2OW3nkPW26fwjYmGS a0B2GshLKGwfjhW/TcEhtjvbEqWx5Q== ;; Received 601 bytes from 192.31.80.30#53(d.gtld-servers.net) in 38 ms dlt-rly-tracker-3.datto.com. 300 IN A 162.244.87.43 dlt-rly-tracker-4.datto.com. 300 IN A 162.244.87.44 dlt-rly-tracker-5.datto.com. 300 IN A 162.244.87.45 dlt-rly-tracker-2.datto.com. 300 IN A 162.244.87.42 dlt-rly-tracker-6.datto.com. 300 IN A 162.244.87.46 dlt-rly-tracker-1.datto.com. 300 IN A 162.244.87.41 ;; Received 256 bytes from 162.244.87.45#53(dlt-rly-tracker-5.datto.com) in 31 ms [23.09.1-RELEASE][admin@sg4860.home.arpa]/root:I would contact there support, because clearly they got something broken in their dns, or there is something specific you need to do to resolve that? But my point of view its broken.. It does say something about "in local dns" so maybe your suppose to create a specific record to resolve that locally?
I would contact their support - its not something broken in pfsense that is for sure.. Here is a query to 1.1.1.1 and it also comes back empty..
[23.09.1-RELEASE][admin@sg4860.home.arpa]/root: dig dattolocal.net @1.1.1.1 ; <<>> DiG 9.18.16 <<>> dattolocal.net @1.1.1.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51315 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;dattolocal.net. IN A ;; Query time: 34 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP) ;; WHEN: Tue Jun 25 16:23:45 CDT 2024 ;; MSG SIZE rcvd: 43 [23.09.1-RELEASE][admin@sg4860.home.arpa]/root:So its not just you.. Or pfsense anything.. Doesn't resolve correctly on the public internet..
Maybe their doc isn't quite right and there is some specific host.dattolocal.net your suppose to resolve?
But you can see in the ede info, looks like they are not returning the SOA when there is no A record for just the domain dattolocal.net, which is a borked config, it should return a soa.. if there is no record..
See if I ask for something where the record does not exist - you should get back the SOA that tells you hey this NS is authoritative for this domain, and he says there isn't a record for what your asking for.
$ dig sljdflsjdflsjfl.google.com ; <<>> DiG 9.16.50 <<>> sljdflsjdflsjfl.google.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 15435 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;sljdflsjdflsjfl.google.com. IN A ;; AUTHORITY SECTION: google.com. 3600 IN SOA ns1.google.com. dns-admin.google.com. 646028540 900 900 1800 60 ;; Query time: 40 msec ;; SERVER: 192.168.3.10#53(192.168.3.10) ;; WHEN: Tue Jun 25 16:30:31 Central Daylight Time 2024 ;; MSG SIZE rcvd: 105 -
@johnpoz It's for the device OP doesn't have:
https://www.reddit.com/r/Datto/comments/13dfsgk/dattolocalnet_unable_to_resolve/
"xxxx.dattolocal.net is a dynamic DNS entry managed by Datto which should basically just resolve your Siris's eth0 address. Its mostly used for BMRs and as a pointer when going to device.dattobckup.com to see local Datto devices. ..." -
@SteveITS great thanks. So he doesn't need that - but why do they list it under a dns requirement for endpoint clients.. Not a datto user nor have I heard of it even until today ;)
But from just the quick read through of some docs, I thought I saw something that you can't do like both - you either have a local device or you use endpoint, but endpoint from your comment doesn't require to be able to resolve that - so why would it be in the docs for endpoint client setup?
-
@johnpoz Have not used Endpoint so I can't explain that. I would guess though it's a hostname under it? Or a paste-o on their part? Endpoint came along after their BCDR as I recall.
BCDR backs up snapshot images to (or through) a local device then up to Datto's cloud, and the device/server can instant-start on the BCDR device or in the cloud. Endpoint says it is a snapshot also.
In my experience with Arcserve ShadowProtect, one can only have one snapshot going at a time or they trip on each other. (note with ShadowProtect one can do one job with full+incrementals, and a second full job without incrementals, but can't have two incrementals going on the same drive)
(we have one client on Datto BCDR and many on ShadowProtect)
-
@SteveITS Yes. It did come after the BCDR product. The cloud backup takes an initial snapshot and then incremental ones. Never heard of ShadowProtect though. I may have to check them out.
None of my clients need the BCDR and are more suited for just the Endpoint BKP. It is at the file level, so data can be restored that way. However, from talking to some of the techs, a BMR is still possible.
That being said, what do you think I need to do as far as getting the agents to work behind pfSense? They work fine connected to the VPN, Therefore I know that it is not an endpoint issue. It must be on the firewall. Should I disable all the rules and see what comes through? I do not understand why the firewall is blocking 443 and such, considering it is open via the standard tcp/udp ports. I am running snort and pfBlocker(something. cant remember offhand)
You guys have been great and I appreciate all the info. Thank you for helping me get to the bottom of this one.
-
@wwdot_computers for a test do like I said, put a rule at the top that allows the device to ANY.. Does it work then.. If not its not a pfsense issue.. Log this rule so you can see where its going and what ports.. If they F'd up the doc on for that datto.net thing maybe they missed a port or something?
Unless you some rules in floating blocking outbound? And again anything blocked by pfsense, unless you have created a block rule that doesn't log or you have turned off logging of the default deny.
-
@johnpoz I will try it and see what happens! Thank you guys. I will report back after I have some results.
-
@johnpoz So, interestingly enough, running the default allow all rule at the top of the rules did not allow the agent to connect. I am seeing LAN blocks from snort, though. I removed snort and the blocks are still there. Do I need to reboot the router to make that happen?
I had seen all the traffic that was coming through the "open pipe" so I know that everything was working. I don't understand why none of the endpoints' agents can connect when not on the VPN. We are using NordLayer.
I am pulling my hair out here!
-
@wwdot_computers you must clear/remove the Snort blocks in that package’s blocks tab.
-
@wwdot_computers said in Allowing random IP/PORT into LAN:
I am seeing LAN blocks from snort
You might of wanted to mention your running an IPS like in post 1 or 2..
-
@johnpoz I did not realize that it was installed until the logs showed blocks from it. I have removed it, but it is still showing blocking.
How do I clear the snort blocks after I have removed the package? Will I need to reinstall it again?
-
@wwdot_computers I believe you go to the tables section call up the table and click the empty button.
I don't use snort not 100% but any table should be listed under diag / tables - and there is an empty button.
edit: believe this is the table - mine is empty so no clear button, but if you have stuff in a table there should be the clear button
-
@johnpoz Yes that is exactly where it was.
Looking at the packages, pfBlockerNG-devel is also installed. Should I remove that too, or just try it again with Snort gone? -
@wwdot_computers if you are not wanting to use the features of pfblocker then yeah you can uninstall it.. Is it even enabled and setup, is it blocking stuff that you don't want blocked?
-
@johnpoz It is enabled and under Geo it is set to deny top spammers. The rest are all at Disabled/Log
Looking at the pictures you inserted when we were talking about Snort. Do I need to empty the plex table too if it is there?
-
@wwdot_computers no that was just a table of mine to show the clear button
