Blocking and can't figure out why
-
OK, so I realize this might be a bit basic for some of you, so please excuse the noob question. My pfSense box is blocking videos from Facebook and I just can't seem to figure out why! I get the attached error in my Firewall logs but I don't know how to do anything about it! If I go into my WAN rules there's nothing and in my LAN rules there's nothing. I have been through every single setting and don't see anyway to disable this rule that is blocking. A little background to set the stage and maybe help.
First, I am running the latest version (just upgraded, was doing this on the older version too though). I'm running 2 external interfaces, one to my regular ISP and a VPN interface (going through the ISP of course). I do this because I'm in Germany (U.S. Military stationed here) and I want to have different IP's for different systems (my Firestick TV needs a U.S. IP for Netflix, but my workstation doesn't need the overhead of the VPN or to be on a U.S. IP for most things, so it goes out the regular WAN). A few weeks ago I decided to try to install SNORT on the box but for some reason the service kept hanging and wouldn't run…so I uninstalled that package and installed Suricata. I have this problem even when I disable the Suricata service...so I don't think it's that service that's blocking. Also, if I create a default ANY-ANY pass rule and put it at the top of my LAN rules the problem goes away, but of course I don't want to do this for obvious reasons.
Any ideas? I'm driving myself nuts here... Appreciate your help
Randy
-
rdjack,
Firstly thank you for your service…awesome!I'll try to help...I had a similar experience when I first installed Snort, I too didn't get it working at first and then uninstalled it, I was left with similar "ghost" blocking. Based on your screen shot it is clearly an old "Snort rule" blocking IMO. I suspect some remnants are left from the Snort package.
I am not logged into my console so going a little on memory but try installing the Snort package again, make sure the setting to "keep settings" is not checked(i.e. when you uninstall the Snort package, no settings are saved)....make sure to save. Look in the Snort alert tab, clear any alerts...make sure to save. I might also suggest you "force reload" the rules again. Then uninstall the Snort package...
Another option is keep the package and make sure you are monitoring only(To do this, on the "General Tab" of Snort there is a check box that allows you to use Snort to block traffic when alerts are noticed or monitor only...I think the check box is "Kill or block" alerts).
It drove me nuts as well but I suspect your issue is with some old Snort rules that are still blocking...
If I am missing something I would defer to the forum to correct me...
Good luck and thanks again...
-
under diag, look in your snort2c table - what is in there?
-
@Velcro: Thanks for the assist. I did what you suggested, but I haven't uninstalled yet. I installed the package and cleared alerts and blocks (there was 1 alert and 4 blocks, different IP's though). I also unchecked that box. Snort still isn't starting, here's what I get in my System-General log when I try to start it.
Aug 12 10:18:44 snort 66676 FATAL ERROR: /usr/local/etc/snort/snort_63209_em0/rules/snort.rules(4230) byte_test rule option cannot extract more than 4 bytes without valid string prefix.
.
.
.
Aug 12 10:18:26 snort 66676 AppInfo: AppId 503 is UNKNOWN
Aug 12 10:18:26 snort 66676 AppInfo: AppId 503 is UNKNOWN
Aug 12 10:18:26 snort 66676 AppInfo: AppId 503 is UNKNOWN
Aug 12 10:18:26 snort 66676 AppInfo: AppId 503 is UNKNOWN
Aug 12 10:18:26 snort 66676 AppInfo: AppId 4115 is UNKNOWN
Aug 12 10:18:26 snort 66676 AppInfo: AppId 4126 is UNKNOWN
Aug 12 10:18:26 snort 66676 Invalid direct client application AppId, 4126, for 0x80a842950 0x818f916c0
Aug 12 10:18:26 snort 66676 Invalid path pattern string.
Aug 12 10:18:26 snort 66676 Invalid path pattern string.
Aug 12 10:18:26 snort 66676 AppInfo: AppId 4043 is UNKNOWN
Aug 12 10:18:26 snort 66676 AppInfo: AppId 4109 is UNKNOWN
Aug 12 10:18:25 SnortStartup 66536 Snort START for WAN Snort(63209_em0)…
My Facebook videos seem to be working (slower though). Although, I do have an "Allow Anything" rule for the IP I'm testing from...need to test from another box, will do today.
I would like to try your second recommendation to keep Snort and in monitoring mode, but again with the start fail I'm not sure thats possible.
@johnpoz: I'm not exactly sure what you mean. Under the Diagnostics menu? If so I'm not sure where to find the table you reference. Are you talking about traversing the file system and going into a diag system folder to find the table? I have not attempted to do any troubleshooting from the shell yet, only from the GUI.
Thanks to both for the reply. Maybe you have more info?
Randy -
diagnostic menu, tables - snort2c - what is it it?
-
John, wow….I TOTALLY missed that! LOL. Ok, so it has 3 IP's in it, but none that are being blocked, as far as I can tell. I'll keep my eyes on that now that they're open to it! :-) I'm still new to pfSense, so learning every day!
Randy
-
Running IPS is a STEEP learning curve - and going to be FULL of false positives, etc.. I really really really suggest that you run in monitor mode only until you have trimmed your rules to remove unwanted triggers on false garbage..
Or you going to run into all kinds of issues of stuff not working/blocked that you want to allow and that there is nothing wrong with..
