Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Help! I'm under attack!

    Scheduled Pinned Locked Moved General pfSense Questions
    9 Posts 4 Posters 3.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      RChadwick
      last edited by

      I'm running 1.2.3. For the past day or so, the Internet seemed slow, pictures sometimes take too long to appear. Speed tests show a very nice speed, but sometimes slows to nothing. I see that the CPU is averaging 25% to 50% (Usually under 5%), and the state table seem to fill up instantly after resetting states. MBUF is 5401/6405. I'm no security expert, and I've never been under attack while using pfsense, so I feel helpless. Looking in the state list, I see a whole bunch of one IP address, beginning with 45 or 46 (45.x.x.x), but they keep changing. The keep trying to connect to one port after another. It seems targeted at my web server. When I shut down the webserver, everything settles down. What should I do? Will Snort stop this kind of thing?

      Here's an example of the state log:

      tcp 46.108.41.72:80 <- 192.168.8.24:4294 CLOSED:SYN_SENT
      tcp 192.168.8.24:4294 -> 69.253.164.39:14213 -> 46.108.41.72:80 SYN_SENT:CLOSED
      tcp 46.109.189.4:80 <- 192.168.8.24:4295 CLOSED:SYN_SENT
      tcp 192.168.8.24:4295 -> 69.253.164.29:27915 -> 46.109.189.4:80 SYN_SENT:CLOSED
      tcp 46.109.189.5:80 <- 192.168.8.24:4296 CLOSED:SYN_SENT
      tcp 192.168.8.24:4296 -> 69.253.164.29:64456 -> 46.109.189.5:80 SYN_SENT:CLOSED
      tcp 46.108.41.73:80 <- 192.168.8.24:4297 CLOSED:SYN_SENT
      tcp 192.168.8.24:4297 -> 69.253.164.29:15487 -> 46.108.41.73:80 SYN_SENT:CLOSED
      tcp 46.109.189.6:80 <- 192.168.8.24:4298 CLOSED:SYN_SENT
      tcp 192.168.8.24:4298 -> 69.253.164.29:34283 -> 46.109.189.6:80 SYN_SENT:CLOSED
      tcp 46.108.41.74:80 <- 192.168.8.24:4299 CLOSED:SYN_SENT
      tcp 192.168.8.24:4299 -> 69.253.164.29:46688 -> 46.108.41.74:80 SYN_SENT:CLOSED
      tcp 46.109.189.7:80 <- 192.168.8.24:4300 CLOSED:SYN_SENT
      tcp 192.168.8.24:4300 -> 69.253.164.29:32979 -> 46.109.189.7:80 SYN_SENT:CLOSED
      tcp 46.108.41.75:80 <- 192.168.8.24:4301 CLOSED:SYN_SENT
      tcp 192.168.8.24:4301 -> 69.253.164.29:52865 -> 46.108.41.75:80 SYN_SENT:CLOSED
      tcp 46.108.41.76:80 <- 192.168.8.24:4302 CLOSED:SYN_SENT
      tcp 192.168.8.24:4302 -> 69.253.164.29:48614 -> 46.108.41.76:80 SYN_SENT:CLOSED
      tcp 46.108.41.77:80 <- 192.168.8.24:4303 CLOSED:SYN_SENT

      69.253.164.29 is my WAN IP Address
      192.168.8.24 is my webserver IP Address
      46.108.41.77 is an attacker IP

      1 Reply Last reply Reply Quote 0
      • AhnHELA
        AhnHEL
        last edited by

        Do not post your WAN IP Address in any forum, it will only give you further problems.  Represent it with x's in text (xxx.xxx.xxx.xxx), or obfuscate it in screenshots.

        AhnHEL (Angel)

        1 Reply Last reply Reply Quote 0
        • W
          wallabybob
          last edited by

          On my Linux netbook I see:

          $ whois 46.108.41.74
          % This is the RIPE Database query service.
          % The objects are in RPSL format.
          %
          % The RIPE Database is subject to Terms and Conditions.
          % See http://www.ripe.net/db/support/db-terms-conditions.pdf

          % Note: this output has been filtered.
          %      To receive output for a database update, use the "-B" flag.

          % Information related to '46.108.32.0 - 46.108.63.255'

          inetnum:        46.108.32.0 - 46.108.63.255
          netname:        ADNET
          descr:          ADNET TELECOM
          country:        RO
          admin-c:        ADN-RIPE
          tech-c:        ADN-RIPE
          status:        ASSIGNED PA
          mnt-by:        MNT-ADNET
          mnt-routes:    MNT-ADNET
          mnt-domains:    MNT-ADNET
          source:        RIPE # Filtered

          role:            ADNET TELECOM
          address:        96B Basarabiei Boulevard, district 2
          address:        Bucharest, Romania
          e-mail:          noc@adnettelecom.ro
          remarks:        –-----------------------------------
          admin-c:        CV208-RIPE      # Calin Velea
          tech-c:          CV208-RIPE      # Calin Velea
          tech-c:          RALU            # Raluca Andreea Gogioiu
          tech-c:          KARO            # Daniel Pana
          tech-c:          AP13038-RIPE    # Alexandru Prodan
          tech-c:          MM26510-RIPE    # Marius-Alexandru Matei
          remarks:        -------------------------------------
          nic-hdl:        ADN-RIPE
          mnt-by:          MNT-ADNET
          remarks:        -------------------------------------
          remarks:        Abuse reports: abuse@adnettelecom.ro
          remarks:        NOC E-mail: noc@adnettelecom.ro
          remarks:        Support: support@adnettelecom.ro
          remarks:        Phone: +40215681111 (24/7 NOC)
          remarks:        -------------------------------------
          source:          RIPE # Filtered

          % Information related to '46.108.0.0/17AS5541'

          route:          46.108.0.0/17
          descr:          AdNet Telecom
          remarks:        -------------------------------------
          remarks:        Abuse reports: abuse@adnettelecom.ro
          remarks:        NOC E-mail: noc@adnettelecom.ro
          remarks:        Support: support@adnettelecom.ro
          remarks:        -------------------------------------
          origin:        AS5541
          mnt-by:        MNT-ADNET
          source:        RIPE # Filtered

          $

          It rather looks to me that something on web server system is making multiple attempts to access a web server in Romania. (Notice all the accesses to port 80, http, on 46.108.x.x.) with varying port numbers on your web server system.

          If there is no need for someone on your LAN to be making web accesses to systems in Romania you might want to add firewall rules to block (or even pass with log to get a better idea of usage patterns) such access.

          1 Reply Last reply Reply Quote 0
          • AhnHELA
            AhnHEL
            last edited by

            Using the Country Block Package might be very useful in this instance blocking out all of Romania

            AhnHEL (Angel)

            1 Reply Last reply Reply Quote 0
            • W
              wallabybob
              last edited by

              @onhel:

              Using the Country Block Package might be very useful in this instance blocking out all of Romania

              Does that package block access FROM a country or block access TO a country or (optionally) both?

              The posted segment of the log appears to show access from pfSense box TO Romania. Or am I interpreting that data incorrectly?

              1 Reply Last reply Reply Quote 0
              • AhnHELA
                AhnHEL
                last edited by

                You are absolutely right Wallabybob.  He said he was under attack, so I quickly misread, looks more like he was infected.

                AhnHEL (Angel)

                1 Reply Last reply Reply Quote 0
                • R
                  RChadwick
                  last edited by

                  As an update, it looks like he was attacking webdav on my server. Looking at my apache logs, I see something different:

                  46.29.255.122 - - [06/Apr/2011:03:05:30 -0400] "GET /webdav/sip2.php?&IP=47.111.203 HTTP/1.1" 404 1188 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
                  46.29.255.122 - - [06/Apr/2011:03:05:35 -0400] "GET /webdav/sip2.php?&IP=47.112.50 HTTP/1.1" 404 1188 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
                  46.29.255.122 - - [06/Apr/2011:03:05:35 -0400] "GET /webdav/sip2.php?&IP=47.112.150 HTTP/1.1" 404 1188 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
                  46.29.255.122 - - [06/Apr/2011:03:05:36 -0400] "GET /webdav/sip2.php?&IP=47.112.250 HTTP/1.1" 404 1188 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
                  46.29.255.122 - - [06/Apr/2011:03:05:40 -0400] "GET /webdav/sip2.php?&IP=47.113.98 HTTP/1.1" 404 1188 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
                  46.29.255.122 - - [06/Apr/2011:03:05:40 -0400] "GET /webdav/sip2.php?&IP=47.113.198 HTTP/1.1" 404 1188 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
                  46.29.255.122 - - [06/Apr/2011:03:05:45 -0400] "GET /webdav/sip2.php?&IP=47.114.45 HTTP/1.1" 404 1188 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
                  46.29.255.122 - - [06/Apr/2011:03:05:45 -0400] "GET /webdav/sip2.php?&IP=47.114.145 HTTP/1.1" 404 1188 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
                  46.29.255.122 - - [06/Apr/2011:03:05:45 -0400] "GET /webdav/sip2.php?&IP=47.114.245 HTTP/1.1" 404 1188 "-" "Opera/9.21 (Windows NT 5.1; U; en)"

                  I find a single IP address, which I blocked. Now, everything seems back to normal. Any security advice welcome.

                  BTW, That wasn't my real WAN IP. I changed a few digits.

                  1 Reply Last reply Reply Quote 0
                  • chpalmerC
                    chpalmer
                    last edited by

                    Get used to those attacks!  Thats why its important to keep your house in order…

                    :)

                    Triggering snowflakes one by one..
                    Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                    1 Reply Last reply Reply Quote 0
                    • R
                      RChadwick
                      last edited by

                      I'm working on it! I've found the problem was my server got hacked, and it's fixed now. What can I do on the pfsense side to help in the future?

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.