Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Blocked ip not in logs

    Scheduled Pinned Locked Moved Firewalling
    23 Posts 7 Posters 3.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      webroy
      last edited by

      is there also a shell commando for resetting all states ? what does this commando do ? pfctl -f /tmp/rules.debug

      thx in advance

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        A quick Google would answer that.  It reloads the ruleset, but I'm now thinking it might not do a flush.  You can flush just the states with:

        pfctl -F states

        Perhaps try this instead:

        pfctl -F all

        which flushes all filters, states, tables etc.

        1 Reply Last reply Reply Quote 0
        • C
          cmb
          last edited by

          there are no states for blocked traffic. If you're blocking something and not getting a log, either it's via a user-configured rule that doesn't have logging enabled, or you disabled logging on the default block rules.

          1 Reply Last reply Reply Quote 0
          • W
            webroy
            last edited by

            Hi CMB, okay thanks. But the block is solved when i completly reboot the pfsense firewall, is there not another option to release all blocked ip without rebooting the pfsense ?

            1 Reply Last reply Reply Quote 0
            • KOMK
              KOM
              last edited by

              Is it consistent like that where a reboot removes the block?  If so, how long after reboot does this magic block return?  Can you give us more information?  Which IP address is being blocked from accessing what server or service?

              1 Reply Last reply Reply Quote 0
              • W
                webroy
                last edited by

                the ip is blocked from every service ping http mysql etc etc we were testing a website… it could be because of the setting max connections per second i changed that value.

                If that is the case, is there another way to reset this beside a reboot of pfsense

                1 Reply Last reply Reply Quote 0
                • KOMK
                  KOM
                  last edited by

                  First, we would need to find the actual root cause of the problem before suggesting a definitive fix.

                  Can you describe with more detail as to what exactly you're trying to do and what exactly is happening to stop you?  You said something about testing a website…  Are you testing accessing a web server on LAN from WAN?

                  1 Reply Last reply Reply Quote 0
                  • W
                    webroy
                    last edited by

                    We we just doing apache request on a server behind the WAN testeing a website by checking the pages if they where working. Our ip was totally blocked and i could not find any thing why that was.

                    I tried to see if the blocked ip was in the logs. in the snort logs in the pfblocker. I disabled the packages no result.

                    After rebooting the firewall i saw that i had setup these in the wan rules which could cause the block :
                    Maximum number of established connections per host (TCP only)
                    Maximum state entries per host
                    Maximum new connections / per second(s) (TCP only)

                    I dont no for sure, but if that was the case, is a complete reboot of the pfsense the only option to clear this ?

                    1 Reply Last reply Reply Quote 0
                    • KOMK
                      KOM
                      last edited by

                      I dont no for sure, but if that was the case, is a complete reboot of the pfsense the only option to clear this ?

                      You keep asking this and I have no idea until we have figured out the real problem.  I have seen cases where cruft left behind by some packages has led to firewall problems, specifically pfBlocker.  If you have the ability, I might suggest recreating your pfSense installation with only defaults, no extra packages, and then do your basic config and test your web server.  I really have a feeling that it's one of the installed packages.

                      How long after reboot does the block return?  Your light testing is not going to breach any thresholds for states, so fiddling with those will likely not be helpful.  If you have made changes, remember to change them back again once you have verified that they don't help your issue.

                      1 Reply Last reply Reply Quote 0
                      • A
                        atrocity
                        last edited by

                        hi,

                        i had the same problem today… Was outside of the wan testing some web server behind PFSense in his lan.
                        I was also unable to find how to unblock our IP.
                        Used a other internet connection to reboot PFSense, but swe can't afford a reboot in a production ...
                        There must be something to find a blocked IP and unblock it.

                        I'm also looking for a Whitelist option, but this also seems not to be present in PFSense.
                        Thanks to let us know
                        Best regards

                        1 Reply Last reply Reply Quote 0
                        • C
                          cmb
                          last edited by

                          There is no circumstance where you have to reboot to "unblock" something. The only circumstances where something gets blocked like that are Snort alerts and you can get locked out from the firewall itself from one particular source IP if you try to log in with a bad username/password 15 times. Either of those can be cleared out under Diagnostics>Tables, or for Snort, within its configuration.

                          1 Reply Last reply Reply Quote 0
                          • A
                            atrocity
                            last edited by

                            i don't have snort installed, but Suricata is installed.
                            I don't activated it. Is Suricata working and filtering also if it's not active ?

                            1 Reply Last reply Reply Quote 0
                            • L
                              lowprofile
                              last edited by

                              I am having the same issue. SO strange. i know it may be the limits like maximum connection, states etc pr. rule which trigger this blacklist, but i can't find any places to un-block. I thought it was possible in "Diag–> "tables"--->"blacklist" but just found out it wasnt there.

                              Somehow it also unblock after certain time. Maybe in hours. Where to look?

                              1 Reply Last reply Reply Quote 0
                              • knight-of-niK
                                knight-of-ni
                                last edited by

                                @webroy:

                                After rebooting the firewall i saw that i had setup these in the wan rules which could cause the block :
                                Maximum number of established connections per host (TCP only)
                                Maximum state entries per host
                                Maximum new connections / per second(s) (TCP only)

                                When any of these rules are tripped, pfsense places the offending ip address in Diagnostics -> Tables -> virusprot

                                The firewall will not respond to the offending address for 1 hour.
                                A reboot will empty the table.

                                1 Reply Last reply Reply Quote 0
                                • L
                                  lowprofile
                                  last edited by

                                  @abauer:

                                  @webroy:

                                  After rebooting the firewall i saw that i had setup these in the wan rules which could cause the block :
                                  Maximum number of established connections per host (TCP only)
                                  Maximum state entries per host
                                  Maximum new connections / per second(s) (TCP only)

                                  When any of these rules are tripped, pfsense places the offending ip address in Diagnostics -> Tables -> virusprot

                                  The firewall will not respond to the offending address for 1 hour.
                                  A reboot will empty the table.

                                  that is a damn good information! I will test if its appears on this list. Someone who know where to adjust the time before it unblock it self?

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    doktornotor Banned
                                    last edited by

                                    Not configurable.

                                    1 Reply Last reply Reply Quote 0
                                    • L
                                      lowprofile
                                      last edited by

                                      @doktornotor:

                                      Not configurable.

                                      Can we add this as a new feature? It must be possible somehow?

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        cmb
                                        last edited by

                                        It is configurable by editing the cron job for "/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot", which can be done with the cron package. The 3600 is the timeout age in seconds.

                                        1 Reply Last reply Reply Quote 0
                                        • L
                                          lowprofile
                                          last edited by

                                          @cmb:

                                          It is configurable by editing the cron job for "/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot", which can be done with the cron package. The 3600 is the timeout age in seconds.

                                          Awesome! thank you!

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.