Under attack, anything I should do?

Bob.Dig

@jrey said in Under attack, anything I should do?:

let me try this for you - standby

Also interested in a how-to.

jrey

@johnpoz said in Under attack, anything I should do?:

pfSense/pfBlockerNG

this is what they are currently blocking on.. change that

the curl that actually pulls it looks like this: (I log it in the pfblockerng.log (cause I like logging)

/usr/local/bin/curl -A "pfSense/pfBNG cURL download agent-60835222024" -sS1 https://api.bgpview.io/asn/109/prefixes

it send the output to a tmp file as part of what gets called.
Works fine here

{"status":"ok","status_message":"Query was successful","data":{"ipv4_prefixes":[{"prefix":"12.5.186.0\/23","ip":"12.5.186.0","cidr":23,"roa_status":"None","name":"CISCO-SY729-186","description":"CISCO SYSTEMS","country_code":"US","parent":{"prefix":"12.

BBcan177

@johnpoz delete the ASN file. So if the asn is a block it's in the "deny" folder. You can do that in the Log tab to delete the file. Once that file is deleted run a Force update to get the new update

johnpoz

@jrey said in Under attack, anything I should do?:

this is what they are currently blocking on.. change that

I did, I changed the whole ua variable to be "different-"

@BBcan177 should a force reload do that.. not using any asn in any pfblocker rules - just an native alias and doesn't seem to want to pull any info for the AS109 test alias I created.

But I do see a AS109 file, let me try deleting that file. And then running a forced update.

edit: ok I deleted the AS109_v4.tx file in /var/db/pfblockerng/native

But still show this error
[ AS109_v4 ] Reload . completed ..
Empty file, Adding '127.1.7.7' to avoid download failure.

BBcan177

@johnpoz no a Force Reload uses the existing downloaded files and makes any changes that you might have made with the settings. New downloads only occur if the downloaded file is missing (which is why I said to delete it) or at the Cron Frequency setting that you set.

johnpoz

@BBcan177 yeah I deleted it, says empty file in the output, but no info added other than the place holder.

jrey

@johnpoz

you could also just take the exact call I provided and ssh in the device, paste it and watch the terminal window fill with json return, (or perhaps you might see some other error ?)

prompt: /usr/local/bin/curl -A "pfSense/pfBNG cURL download agent-60835222024" -sS1 https://api.bgpview.io/asn/109/prefixes

{"status":"ok","status_message":"Query was successful","data":{"ipv4_prefixes":[{"prefix":"12.5.186.0\/23","ip":"12.5.186.0","cidr":23,"roa_status":"None","name":"CISCO-SY729-186","description":"CISCO SYSTEMS","country_code":"US","parent":{"prefix":"12.0.0.0\/8","ip":"12.0.0.0","cidr":8,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"12.19.88.0\/21","ip":"12.19.88.0","cidr":21,"roa_status":"None","name":"CISCO-SY558-88","description":"CISCO SYSTEMS INC","country_code":"US","parent":{"prefix":"12.0.0.0\/8","ip":"12.0.0.0","cidr":8,"rir_name":"ARIN","allocation_stat

dennypage

@johnpoz said in Under attack, anything I should do?:

And where in pfblocker would I put this token? I am not seeing it in any of the pfblocker settings, I have my maxmind token setup.

The link was to see info from @BBcan177 discussing the issue with BGPview.io, and the potential solutions being explored.

Using IPinfo, which requires registration and a token like Maxmind does, is one of the solutions he is exploring. He is working on an experimental implementation of IPinfo, which would potentially be used in a future version of pfBlocker. As the work is experimental and unreleased, you won't find a place to enter the token yet.

[Edit: This is what I get for reading/responding to posts in order. Sorry @BBcan177, I hadn't noticed that you had stepped in and posted.]

johnpoz

Yeah that seems to work fine

[24.03-RELEASE][admin@sg4860.home.arpa]/: /usr/local/bin/curl -A "pfSense/pfBNG cURL download agent-60835222024" -sS1 https://api.bgpview.io/asn/109/prefixes
{"status":"ok","status_message":"Query was successful","data":{"ipv4_prefixes":[{"prefix":"12.5.186.0\/23","ip":"12.5.186.0","cidr":23,"roa_status":"None","name":"CISCO-SY729-186","description":"CISCO SYSTEMS","country_code":"US","parent":{"prefix":"12.0.0.0\/8","ip":"12.0.0.0","cidr":8,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"12.19.88.0\/21","ip":"12.19.88.0","cidr":21,"roa_status":"None","name":"CISCO-SY558-88","description":"CISCO SYSTEMS INC","country_code":"US","parent":{"prefix":"12.0.0.0\/8","ip":"12.0.0.0","cidr":8,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"12.159.148.0\/22","ip":"12.159.148.0","cidr":22,"roa_status":"Valid","name":"NET12","description":"American Registry for Internet Numbers","country_code":"US","parent":{"prefix":"12.0.0.0\/8","ip":"12.0.0.0","cidr":8,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.100.0.0\/16","ip":"64.100.0.0","cidr":16,"roa_status":"Valid","name":"CISCO-GEN-6","description":"Cisco Systems, Inc.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.101.0.0\/18","ip":"64.101.0.0","cidr":18,"roa_status":"Valid","name":"CISCO-GEN-6","description":"CISCO SYSTEMS, INC.","country_code":"US","parent":{"prefix":"62.50.64.0\/19","ip":"62.50.64.0","cidr":19,"rir_name":"RIPE","allocation_status":"unknown"}},{"prefix":"64.101.64.0\/18","ip":"64.101.64.0","cidr":18,"roa_status":"Valid","name":"CISCO-GEN-6","description":"Cisco Systems, Inc.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.101.96.0\/19","ip":"64.101.96.0","cidr":19,"roa_status":"Valid","name":"CISCO-GEN-6","description":"Cisco Systems, Inc.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.101.128.0\/18","ip":"64.101.128.0","cidr":18,"roa_status":"Valid","name":"CISCO-GEN-6","description":"CISCO SYSTEMS, INC.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.101.192.0\/19","ip":"64.101.192.0","cidr":19,"roa_status":"Valid","name":"CISCO-GEN-6","description":"CISCO SYSTEMS, INC.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.101.224.0\/19","ip":"64.101.224.0","cidr":19,"roa_status":"Valid","name":"CISCO-GEN-6","description":"Cisco Systems, Inc.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"un

but doesn't seem to be updating the table in pfblocker and says the download fails, and I did change the line 761 to be a different ua

BBcan177

@johnpoz try to use the same agent string

pfSense/pfBNG cURL download agent

jrey

@johnpoz

you might also need to delete the .orig and .fail files in the "original" directory if they exists there, not just the .txt in native

johnpoz

@BBcan177 said in Under attack, anything I should do?:

pfSense/pfBNG cURL download agent

well that worked

[ AS109_v4 ]			 Downloading update .
  Downloading ASN: 109... completed
. completed ..

sorry for delay - kind of multitasking ;) on a meeting for work as well ;)

Gertjan

@JeGr said in Under attack, anything I should do?:

I don' even know how that got so famous in the first place!

I guess grc.com, Gibson and affiliates.
I remember vaguely some talk shows ...