Ipguard package

marcelloc · Oct 31, 2012, 1:38 PM

I've tested this package without snort without issues, I'll try it again on virtual lab.

islandwifibill · Nov 15, 2012, 4:00 AM

Hey there guys,

Here's the problem I'm running into and I'm hoping ipguard can turn the trick….

I have a wifi client who for whatever reason is always trying to set a static IP that conflicts with an ip address in my static range, which causes temporary problems from time to time.

I'd like to make sure that these addresses are not in conflict in situations like this. Since my static devices are all known and well documented, would the correct approach be to enter them all in ipguard, thereby (hopefully, I think?) ensuring that no other mac address can inadvertently obtain access to my LAN (wifi) using a reserved, static ip?

???

marcelloc · Nov 15, 2012, 5:32 AM

Sure, ipguard can help.

Did you tried static mapping on pfSense dhcp+ Deny unknown clients?

islandwifibill · Nov 15, 2012, 5:40 AM

@marcelloc:

Surge, ipguard can help.

Did you tried static mapping on pfSense dhcp+ Deny unknown clients?

No, and here's why: I run a WISP and I don't want to deny unknown clients. They can sign up online thru the captive portal and that's $$ ;D

However, I did try mapping it to an IP address, but pfSense tells me that I can't do that inside of the dynamic IP range….. which seems silly, actually.

cleancodex · Nov 16, 2012, 5:34 AM

Dear marcelloc,

i did download the ipguard last week and installed it on my pfsense 2.0.1 (amd64)
however, the services didnt run even i tried to start it manually
then a few days later i remove it back because i thought there was an error while it was installed
somehow, i cant find it again from the "packages" list, did you remove it?
how can i use this good features? im ran a wisp as well and i hope that i dont need to deny unknown clients ;)
waiting for your kind reply

thanks
cleancodex

marcelloc · Nov 16, 2012, 5:52 AM

cleancodex,

check on installed packages tab, I did not removed the service.

There is a depedencie that is not included on this package yet.

you need to install libcap first. You can do this using pkg_add from freebsd repo or installing snort package before ipguard.

I'll try to fix it as soon as possible.

tanvir · Dec 7, 2012, 7:46 AM

hello all,
there is prblm wth pfsense , installed ipguard-dev but in services status it shows not started , i go to firewall select ipguard, check to enable this rule , create a rule but still nothing happens … wht shuld i do next ???

tanvir · Dec 7, 2012, 7:53 AM

same prblm faced

z3r0tech · Dec 7, 2012, 2:18 PM

is this package done with dependencies?

marcelloc · Dec 7, 2012, 6:28 PM

@z3r0tech:

is this package done with dependencies?

not yet. still need manual fix.

z3r0tech · Dec 8, 2012, 7:02 AM

@marcelloc:

@z3r0tech:

is this package done with dependencies?

not yet. still need manual fix.

thanks, what are the dependencies needed for this package? i'm gonna test this and install manually all the dependencies first…

marcelloc · Dec 10, 2012, 1:53 PM

@z3r0tech:

thanks, what are the dependencies needed for this package? i'm gonna test this and install manually all the dependencies first…

try just lippcap if it works, I'll push a fix to install process on 2.0.x.

amd64
http://files.pfsense.org/packages/amd64/8/All/libpcap-1.3.0.tbz

i386
http://files.pfsense.org/packages/8/All/libpcap-1.3.0.tbz

z3r0tech · Dec 12, 2012, 6:42 AM

thanks! will test later and post results…

sand_hero · Dec 26, 2012, 10:47 PM

very Thx For who made this package alive :) AND THX FOR PFSENSE ITS FREEEEEEEEEEEE :) AND VERY HELPFUL :)

senser · Feb 25, 2013, 10:23 AM

about the libipcap: its there on 2.0.x: /lib/libpcap.so.7
I have linked /lib/libpcap.so.7 to /lib/libpcap.so.1 and the binary from the v0.1 package is happy.
so, you can either create the link when you install the package or compile the bin to use /lib/libpcap.so.7

there are some issues with the webgui: sorting (moving things up or down) is not permanent and there are empty entries shown for previously deleted mac/ip address sets.
otherwise, nice package! I hope it's still being worked on. :)

senser · Feb 25, 2013, 10:51 AM

two more things I would like to suggest:

drop root privileges (add '-s nobody' to the startup parameters).
don't use '-u 300', instead send SIGHUP to the process to reload the config when the user clicks save.

marcelloc · Feb 25, 2013, 12:54 PM

I'll take a look on it as soon as time permits.

rolysent · May 10, 2013, 3:07 AM

Hi,

I have a problem with ipguard. I guess it is not working with DHCP. In my network, I have allocated IP addresses for WIFI clients ranging from 172.16.4.150-172.16.4.250 but when I run ipguard, wifi users can't obtain IP addresses. Can anyone help me please. Thanks.

chevot · Jun 14, 2013, 3:49 AM

Hello there,
I'm Using Ip guard on my pfsense captive portal to to restricted user for change ip address, here's my scenario :

–----------------------------------------------------------------------------------------------------------------------------------------------------------

Internet ----------WAN (20.20.20.221/24)* pfsense (captive portal + Ipguard)*LAN (192.168.1.1/24) ---------------- client PC

My ipguard rule :

on wan 00:0c:29:ed:61:11 20.20.20.221 Pfsense WAN Interface
on lan 00:0c:29:ed:63:1e 192.168.1.1 Pfsense LAN Interface
on wan 00:00:00:00:00:00 20.20.20.0/24 WAN Net
on lan 1c:65:9d:b9:4f:f5 192.168.1.90 PC Manager

another my firewall rules:

allow LAN & WAN to any rule

I'm using dhcp client for another client, and mapping dchp static for special client

my purpose is to block another client with dhcp to using PC manager Ip Address using static IP on 192.168.1.90

the problem that i face is another user using dhcp client can use the PC manager Ip address with changing their ip address to static and using PC Manager Ip Address.

How can I can create best ip guard rule with this situation?
can anyone hel me. Thanks

axaios · Aug 10, 2013, 7:37 AM

Ipguard is great! Tried it yesterday and is really what I was looking for. I have a suggestion though. Say I have a network client that I want to restrict to a single IP but I want everyone else to get IP through DHCP on the same subnet. It would be nice if overlapping rules were supported and followed priorities. Example:

00:00:00:00:00:00 192.168.0.0/24 Everyone is able to get any IP in this subnet
00:0c:29:ed:61:11 192.168.0.150 This computer can only get this IP. So this rule has a higher priority than the first one.

I tried configuring that way and it didn't work.

As an alternate scenario I could try to register every single client's mac address but it really is a big annoyance. Hope the above could work.

Ipguard package

We use the mighty pf, we cannot be fooled.

We use the mighty pf, we cannot be fooled.