PFSENSE randomely blocking ports....
-
Spammers are constantly trying to brute force usernames and passwords so, if a weak password is guessed, it can be used to send their spam for a bit.
This happens all day every day no days off.
-
not sure what any of that has to do with site A talking to a mail server at site B over a vpn tunnel?
-
@mrpushner said in PFSENSE randomely blocking ports....:
@johnpoz said in PFSENSE randomely blocking ports....:
nat rules for something coming in via nat rules?
Hi, well that's because the remote networks are on different subnets. No rules, no passage.
The bottom line is that is works, then just stops. PFSense reboot fixes it.
Thx,
Snort?
-
@johnpoz Hi, ok so that is basically my setup with two subnets over OPENVPN tunnel in the 172 arena, just reversed:
Site A 192.168.1/24
Site B 192.168.2/24
Tunnel 172.16.0/24
Printer 192.168.2.50 setup w SMTP settings to 192.168.1.100:587 so it can send scan to email jobs to my SMTP server at 192.168.1.100.I set up rules because I am about certain that this traffic would not go thorough PFSense without them. It works with the rules, but then just stops working randomly.
I seem to be having an issues seeing ANY of these going though PFS in the logs, I have the logs turned on for the rules, but do not see ANY entries like:
"Source = 192.168.2.50:XXXX.....Destination = 192.168.1.100:587....TCP" or the like so I can't pick up on why it stops working.
I found that PFS box reboot usually fixes and it starts working again but that is no fix, and SO ANNOYING.
I'm on 2.3.5.
Thank,
MP
-
@derelict Hi, nope no Snort installed (I do use Squid and Squidguard).
-
What rules you setting up this would not be a NAT this would be a simple firewall run on your openvpn interface, which I believe defaults to any any..
-
@johnpoz Hi, ok yes that would be true but I had to open up the SMTP server to a smart phone user as well...and THAT'S why I have the rules to limit any random hits on the server. Sorry if I left that out.
MP
-
If you turn off the NATting and FW rules for the tunnel and just leave the routing in place, does it work? I am a big fan of configuring the most basic requirements to establish communications, test, and then add complexity after each validated test.
Upgrading to the most current pfSense release may help (always a good idea, you are a few versions behind).
-
I'm not even sure how you could use a NAT rule here without breaking something. Can we see a picture of these rules?
Steve
-
@stephenw10 Hi, Here is one that gets messed up:
I have another machine that does not have these problems, same setup, but different subnet machine to the 1.x smtp server.
Starting to wonder if its somehow the printer goofing up. I'm looking into getting its logs right now. It works, then stops. I found that the only fix was to reboot the 1.x subnet PFsense box. Other reboots of printer or remote PFS did nothing.
I am going to run the PFS update just to be sure.Thx for the help you guys,
MP
-
Yeah sorry but that rule has ZERO to do with access through your vpn tunnel -- ZERO!!!
-
@johnpoz Humm...I must say I'm feeling a bit dumb....so then how are the packets handled across sub nets? One of my biggest headaches with VPN's was getting them to work across sub nets. Maybe that was my pre netbios days...
I will kill those and see what happens but I SWEAR I could not get this working at all without them.
Thx!
-
@mrpushner said in PFSENSE randomely blocking ports....:
so then how are the packets handled across subnets?
Simple... firewall rules on the originating subnet (network) pointing to the other subnet. Or, in pfsense talk - Source = originating subnet, Destination = the other subnet you want to pass the traffic to.
Jeff
-
@akuma1x Hi, yes And I can see those plainly in the VPN setup...I just have a mental block from my old VPN days, when it was not easy to get sub nets to "talk" over VPN. Thanks.
-
Mmm, it's OpenVPN it should just route between the ends like any other subnet.
The only possible way I could see that doing anything is if you have NAT reflection enabled (on that rule or globally) and the printer in trying to hit port 587 on the public WAN IP.
In that situation it would be reflected back to the mail server over the tunnel. But that would be a misconfiguration on the printer.Steve
