Snort will not unblock a whitelisted IP

smknjoe

Well, it looks like it blocks single LAN IPs (192.168.1.2 192.168.1.5) that are whitelisted also. :(

1.2.3-RELEASE
Snort 2.8.5.3 pkg v. 1.21

seanlee

It ignores my whitelist too, no matter how many times I save/apply.

I've tried:
192.168.1.0/24
192.168.1.1/32
192.168.1.1

pfsense 1.2.3-RELEASE
Snort 2.8.5.3 pkg v. 1.22

jamesdean

After you create a whitelist or modify a whitelist you need to save your settings in the interface edit tab and restart the interface that is using the whitelist.
Only CIDR blocks and ips are required.

This will not work 192.168.1.1/32.

USe only ips 192.168.1.1 or blocks 192.168.1.0/24.

James

seanlee

Thanks I will try this.

I noticed that the IP's I submit for my whitelist are nowhere to be found in /usr/local/etc/snort/whitelist/mylist.

I have to edit the file manually from the shell using VI. If I follow your procedure after I edit the file, then it seems to work.

The file is rw-rw–-- and user/group is snort/snort.

-Sean

goremache

hi all,

Frist, thanks James for a very very nice tool !!!. Many thanks.

Second, I'm having the same problem. The whitelist works for individual ips but not for block (x.x.x.x/24 entry). I've checked also the /usr/local/etc/snort/whitelist/mylist and it has the settings entered in the GUI. I have also restarted the snort service after each modify.

Please help me … because entering each host ip is not an option.

Thanks a lot !!!

goremache

sorry … I forgot the used versions...

snort 2.8.5.3 pkg v. 1.25
pfsense 1.2.3-RELEASE

thanks

jamesdean

@goremache:

sorry … I forgot the used versions...

snort 2.8.5.3 pkg v. 1.25
pfsense 1.2.3-RELEASE

thanks

I have to recode the ips plugin for snort so that cidr blocks can be used again.
I am really busy with payed projects at the moment and will not be free for a month or so.

James

goremache

It's ok …
...thanks for the support and looking forward for the new version :)

darklogic

I have an issues with SNORT 2.8.5.3 V. 1.25 Blocking a Public IP just as everyone describes. Even after white listing it and restarting everything. I get an alert that states this (spp_frag3) Framentation overlap SID ID 123:8:1

This ID is nowhere to be found in any of the categories?

Please Help.

g4m3c4ck

Reading another thread (spp_frag3) is a snort preprocessor error. Not sure how to fix it other than to suggest you turn on all the preprocessors to see if that fixes it.

As far as whitelisting goes you need to find the offending rule that is blocking the address and create a suppress rule for it in the tab. I "believe" I got it to work by using this syntax.

suppress gen_id 1, sig_id 11969, track by_src, ip 216.82.225.24

I tried to get one rule to handle the same sig i.e.

suppress gen_id 1, sig_id 11969, track by_src, ip 216.82.222.14
suppress gen_id 1, sig_id 11969, track by_src, ip 216.82.212.10

Edit: This doesn't work. I will try restarting the router and see if anything changes. It is still blocking a category I have recently unchecked.

But I was not able to get it to work as above. Haven't had the time to test using a , or ; to separate due to time constraints.