Allowing random IP/PORT into LAN
-
@johnpoz It's for the device OP doesn't have:
https://www.reddit.com/r/Datto/comments/13dfsgk/dattolocalnet_unable_to_resolve/
"xxxx.dattolocal.net is a dynamic DNS entry managed by Datto which should basically just resolve your Siris's eth0 address. Its mostly used for BMRs and as a pointer when going to device.dattobckup.com to see local Datto devices. ..." -
@SteveITS great thanks. So he doesn't need that - but why do they list it under a dns requirement for endpoint clients.. Not a datto user nor have I heard of it even until today ;)
But from just the quick read through of some docs, I thought I saw something that you can't do like both - you either have a local device or you use endpoint, but endpoint from your comment doesn't require to be able to resolve that - so why would it be in the docs for endpoint client setup?
-
@johnpoz Have not used Endpoint so I can't explain that. I would guess though it's a hostname under it? Or a paste-o on their part? Endpoint came along after their BCDR as I recall.
BCDR backs up snapshot images to (or through) a local device then up to Datto's cloud, and the device/server can instant-start on the BCDR device or in the cloud. Endpoint says it is a snapshot also.
In my experience with Arcserve ShadowProtect, one can only have one snapshot going at a time or they trip on each other. (note with ShadowProtect one can do one job with full+incrementals, and a second full job without incrementals, but can't have two incrementals going on the same drive)
(we have one client on Datto BCDR and many on ShadowProtect)
-
@SteveITS Yes. It did come after the BCDR product. The cloud backup takes an initial snapshot and then incremental ones. Never heard of ShadowProtect though. I may have to check them out.
None of my clients need the BCDR and are more suited for just the Endpoint BKP. It is at the file level, so data can be restored that way. However, from talking to some of the techs, a BMR is still possible.
That being said, what do you think I need to do as far as getting the agents to work behind pfSense? They work fine connected to the VPN, Therefore I know that it is not an endpoint issue. It must be on the firewall. Should I disable all the rules and see what comes through? I do not understand why the firewall is blocking 443 and such, considering it is open via the standard tcp/udp ports. I am running snort and pfBlocker(something. cant remember offhand)
You guys have been great and I appreciate all the info. Thank you for helping me get to the bottom of this one.
-
@wwdot_computers for a test do like I said, put a rule at the top that allows the device to ANY.. Does it work then.. If not its not a pfsense issue.. Log this rule so you can see where its going and what ports.. If they F'd up the doc on for that datto.net thing maybe they missed a port or something?
Unless you some rules in floating blocking outbound? And again anything blocked by pfsense, unless you have created a block rule that doesn't log or you have turned off logging of the default deny.
-
@johnpoz I will try it and see what happens! Thank you guys. I will report back after I have some results.
-
@johnpoz So, interestingly enough, running the default allow all rule at the top of the rules did not allow the agent to connect. I am seeing LAN blocks from snort, though. I removed snort and the blocks are still there. Do I need to reboot the router to make that happen?
I had seen all the traffic that was coming through the "open pipe" so I know that everything was working. I don't understand why none of the endpoints' agents can connect when not on the VPN. We are using NordLayer.
I am pulling my hair out here!
-
@wwdot_computers you must clear/remove the Snort blocks in that package’s blocks tab.
-
@wwdot_computers said in Allowing random IP/PORT into LAN:
I am seeing LAN blocks from snort
You might of wanted to mention your running an IPS like in post 1 or 2..
-
@johnpoz I did not realize that it was installed until the logs showed blocks from it. I have removed it, but it is still showing blocking.
How do I clear the snort blocks after I have removed the package? Will I need to reinstall it again?
-
@wwdot_computers I believe you go to the tables section call up the table and click the empty button.
I don't use snort not 100% but any table should be listed under diag / tables - and there is an empty button.
edit: believe this is the table - mine is empty so no clear button, but if you have stuff in a table there should be the clear button
-
@johnpoz Yes that is exactly where it was.
Looking at the packages, pfBlockerNG-devel is also installed. Should I remove that too, or just try it again with Snort gone? -
@wwdot_computers if you are not wanting to use the features of pfblocker then yeah you can uninstall it.. Is it even enabled and setup, is it blocking stuff that you don't want blocked?
-
@johnpoz It is enabled and under Geo it is set to deny top spammers. The rest are all at Disabled/Log
Looking at the pictures you inserted when we were talking about Snort. Do I need to empty the plex table too if it is there?
-
@wwdot_computers no that was just a table of mine to show the clear button
-
@johnpoz I don't want to celebrate too soon, but the agent is staying connected now after Snort went away. Is there any benefit of snort?
I will keep checking it throughout the day and let the thread know if we are still good this evening.
Thank you for the diligence and help here. I pray it is all good now!
-
@wwdot_computers said in Allowing random IP/PORT into LAN:
Is there any benefit of snort?
That could be a discussion on its own ;) I personally feel in a smb or home setup it is a very limited use.. For starters there is a huge learning curve to actually have it do what you want, and not break stuff.
The rules need to be adjusted for your environment, most all traffic these days is encrypted - which means the data that would make an IPS useful is very limited.
Users somehow get it in their heads - oh click enable and I am protected by a IPS.. Doesn't work that way, any IPS or even IDS takes configuration, tweaking and monitoring to be of really any use - other than breaking shit the user is wanting to do ;)
I have been in IT for 30 some years, and yes I have ran IPS for very large enterprise, and also support for customers systems when worked for large msp.. Over the years.. So learning curve for me is not an issue - but my home network has really no use of it.. It would be a lot of work on my part to get it all setup, dialed in to provide actual functionality.. Time spent would be figuring out what is causing false positives..
That being said it does have valid use cases where it could be one of the most valuable tools.. But I doubt your ready to invest the time, and more than likely your not really doing anything on your network that would warrant such a system..
Tools are only useful if you know how to use the tool, and actually have need for it..
I could go and pick up a cnc milling machine. Set it all up in my garage - but what use would I have for it - they are amazing tools, but they are not push a button and magic happens..
-
@johnpoz I get that. So I came back and hooked my laptop up. At first there was zero connection for datto. I waited a bit and it came on. So, I am still watching it.
Again I thank you. -
@johnpoz STILL WORKING!! Thank you again for all of your help. How can I help your status? I am new to the forums.
