Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unstoppable mIRC

    Scheduled Pinned Locked Moved Firewalling
    18 Posts 4 Posters 6.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L Offline
      LiquiD_85
      last edited by

      And this is the /tmp/rules.debug, thanks a lot:

      System Aliases

      loopback = "{ lo0 }"
      lan = "{ em0  }"
      wan = "{ fxp0  }"
      enc0 = "{ enc0 }"

      User Aliases

      set loginterface fxp0
      set loginterface em0
      set optimization normal

      scrub all random-id  fragment reassemble

      nat-anchor "pftpx/"
      nat-anchor "natearly/      "
      nat-anchor "natrules/*"

      FTP proxy

      rdr-anchor "pftpx/*"

      Outbound NAT rules

      nat on $wan from 192.168.0.0/24 port 500 to any port 500 -> (fxp0) port 500
      nat on $wan from 192.168.0.0/24 port 5060 to any port 5060 -> (fxp0) port 5060
      nat on $wan from 192.168.0.0/24 to any -> (fxp0)

      #SSH Lockout Table
      table <sshlockout>persist

      Load balancing anchor - slbd updates

      rdr-anchor "slb"

      FTP Proxy/helper

      table <vpns>{    }
      no rdr on em0 proto tcp from any to <vpns>port 21
      rdr on em0 proto tcp from any to any port 21 -> 127.0.0.1 port 8021

      NAT Inbound Redirects

      rdr on fxp0 proto { tcp udp } from any to 192.168.1.2 port { 80 } -> 192.168.0.120
      rdr on fxp0 proto tcp from any to 192.168.1.2 port { 443 } -> 192.168.0.120
      rdr on fxp0 proto tcp from any to 192.168.1.2 port { 455 } -> 192.168.0.1

      IMSpector rdr anchor

      rdr-anchor "imspector"

      UPnPd rdr anchor

      rdr-anchor "miniupnpd"

      anchor "ftpsesame/*"
      anchor "firewallrules"

      We use the mighty pf, we cannot be fooled.

      block quick proto { tcp, udp } from any port = 0 to any
      block quick proto { tcp, udp } from any to any port = 0

      snort2c

      table <snort2c>persist
      block quick from <snort2c>to any label "Block snort2c hosts"
      block quick from any to <snort2c>label "Block snort2c hosts"

      loopback

      anchor "loopback"
      pass in quick on $loopback all label "pass loopback"
      pass out quick on $loopback all label "pass loopback"

      package manager early specific hook

      anchor "packageearly"

      carp

      anchor "carp"

      permit wan interface to ping out (ping_hosts.sh)

      pass quick proto icmp from 192.168.1.2 to any keep state

      NAT Reflection rules

      allow access to DHCP server on LAN

      anchor "dhcpserverlan"
      pass in quick on $lan proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server on LAN"
      pass in quick on $lan proto udp from any port = 68 to 192.168.0.1 port = 67 label "allow access to DHCP server on LAN"
      pass out quick on $lan proto udp from 192.168.0.1 port = 67 to any port = 68 label "allow access to DHCP server on LAN"
      block in  quick on $wan proto udp from any port = 67 to 192.168.0.0/24 port = 68 label "block dhcp client out wan"

      LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses)

      antispoof for em0

      anchor "spoofing"

      Support for allow limiting of TCP connections by establishment rate

      anchor "limitingesr"
      table <virusprot>block in quick from <virusprot>to any label "virusprot overload table"

      let out anything from the firewall host itself and decrypted IPsec traffic

      pass out quick on $lan proto icmp keep state label "let out anything from firewall host itself"
      pass out quick on $wan proto icmp keep state label "let out anything from firewall host itself"

      tcp.closed 5 is a workaround for load balancing, squid and a few other issues.

      ticket (FEN-857512) in centipede tracker.

      pass out quick on fxp0 all keep state ( tcp.closed 5 ) label "let out anything from firewall host itself"

      pass traffic from firewall -> out

      anchor "firewallout"
      pass out quick on fxp0 all keep state label "let out anything from firewall host itself"
      pass out quick on em0 all keep state label "let out anything from firewall host itself"
      pass out quick on $enc0 keep state label "IPSEC internal host to host"

      make sure the user cannot lock himself out of the webGUI or SSH

      anchor "anti-lockout"
      pass in quick on em0 from any to 192.168.0.1 keep state label "anti-lockout web rule"

      SSH lockout

      block in log quick proto tcp from <sshlockout>to any port 22 label "sshlockout"

      anchor "ftpproxy"
      anchor "pftpx/*"

      User-defined aliases follow

      User-defined rules follow

      pass in quick on $wan reply-to (fxp0 192.168.1.1) proto { tcp udp } from any to {  192.168.0.120 } port = 80 keep state  label "USER_RULE: NAT 80"
      pass in quick on $wan reply-to (fxp0 192.168.1.1) proto tcp from any to {  192.168.0.120 } port = 443 keep state  label "USER_RULE: NAT 443"
      pass in quick on $wan reply-to (fxp0 192.168.1.1) proto tcp from any to {  192.168.0.1 } port = 455 keep state  label "USER_RULE: WEBCONFIGURATOR"
      block in quick on $wan reply-to (fxp0 192.168.1.1) from any to any  label "USER_RULE: Blocca tutto"
      pass in quick on $lan proto tcp from 192.168.0.0/24 to any port = 80 keep state  label "USER_RULE: HTTP"
      pass in quick on $lan proto tcp from 192.168.0.0/24 to any port = 443 keep state  label "USER_RULE: HTTPS"
      pass in quick on $lan proto { tcp udp } from 192.168.0.0/24 to any port = 53 keep state  label "USER_RULE: DNS"
      pass in quick on $lan proto tcp from 192.168.0.0/24 to any port = 25 keep state  label "USER_RULE: SMTP"
      pass in quick on $lan proto tcp from 192.168.0.0/24 to any port = 995 keep state  label "USER_RULE: POP3/S"
      pass in quick on $lan proto tcp from 192.168.0.0/24 to any port = 110 keep state  label "USER_RULE: POP"
      block in quick on $lan from any to any  label "USER_RULE: Blocca tutto LAN"

      VPN Rules

      pass in quick on em0 inet proto tcp from any to $loopback port 8021 keep state label "FTP PROXY: Allow traffic to localhost"
      pass in quick on em0 inet proto tcp from any to $loopback port 21 keep state label "FTP PROXY: Allow traffic to localhost"
      pass in quick on fxp0 inet proto tcp from port 20 to (fxp0) port > 49000 flags S/SA keep state label "FTP PROXY: PASV mode data connection"

      enable ftp-proxy

      IMSpector

      anchor "imspector"

      uPnPd

      anchor "miniupnpd"

      #–-------------------------------------------------------------------------

      default deny rules

      #---------------------------------------------------------------------------
      block in  quick all label "Default deny rule"
      block out  quick all label "Default deny rule"</sshlockout></virusprot></virusprot></snort2c></snort2c></snort2c></vpns></vpns></sshlockout>

      1 Reply Last reply Reply Quote 0
      • jimpJ Offline
        jimp Rebel Alliance Developer Netgate
        last edited by

        A couple notes: Your "block all" rules on LAN and WAN are not needed, as pfSense is default deny. They don't hurt anything, they're just redundant.

        It should be blocking the traffic, unless I'm misreading something.

        I don't see anything in there that would allow it to bypass, unless it's connecting via some sort of proxy on a port you're allowing.

        You could try temporarily turning on logging on every rule, and then connect, and see if it shows up in the log. When it does, click the green ">" next to the rule on the log view and it will tell you which rule passed it.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • L Offline
          LiquiD_85
          last edited by

          @jimp:

          A couple notes: Your "block all" rules on LAN and WAN are not needed, as pfSense is default deny. They don't hurt anything, they're just redundant.

          It should be blocking the traffic, unless I'm misreading something.

          I don't see anything in there that would allow it to bypass, unless it's connecting via some sort of proxy on a port you're allowing.

          You could try temporarily turning on logging on every rule, and then connect, and see if it shows up in the log. When it does, click the green ">" next to the rule on the log view and it will tell you which rule passed it.

          Yes i know that the "black all rules" are useless but with the log option i can solve a lot of problems seeing what pfsense is blocking or not!
          I'll try logging my all rules, thanks a lot!

          1 Reply Last reply Reply Quote 0
          • L Offline
            LiquiD_85
            last edited by

            No rules logs the computer with the ip address that execute mIRC and i think that this user download illegal material from mIRC (divx games etc.) and i can't stop him, it's absurd!

            1 Reply Last reply Reply Quote 0
            • GruensFroeschliG Offline
              GruensFroeschli
              last edited by

              Did you wireshark to see where the traffic is destined to?
              Are you certain, that there is no other gateway than the pfSense?

              We do what we must, because we can.

              Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

              1 Reply Last reply Reply Quote 0
              • L Offline
                LiquiD_85
                last edited by

                Yes the net is:

                MCLINK Router (zxell prestige 600 series)
                                                                                    |
                                                                                    V
                                                                              PFSENSE
                                                                                    |
                                                                                    V
                                                                                SWITCH
                                                                                    |
                                                                                    V
                                                                              ALL USERS

                The router redirect all the traffic to pfsense, any protocol any ports etc. and pfsense manage all the traffic!

                1 Reply Last reply Reply Quote 0
                • jimpJ Offline
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  What happens if you do a traceroute from that machine to the server that it is connecting to? Does it really go through your pfSense box?

                  And have you tried a packet capture yet as GruensFroeschli suggested?

                  If nothing logged – even a pass -- then the most likely scenario is that it is not, in fact, routing through the pfSense box but some other way.

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • L Offline
                    LiquiD_85
                    last edited by

                    I'will do theese tries as soon as possible, and update this thread, thanks a lot to all!

                    1 Reply Last reply Reply Quote 0
                    • L Offline
                      LiquiD_85
                      last edited by

                      I think that all traffic is destinated to pfsense because IMSPECTOR can detect if anyone use IRC protocols!!!

                      1 Reply Last reply Reply Quote 0
                      • J Offline
                        jigpe
                        last edited by

                        you but not the gtalk..gtalk wont log in imspector :( anyone?

                        jigp
                        Davao City
                        1.2.2

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.