Firewall Logs
-
Yes, Our pfSense is accessible publicly via domain and public IP. but only https port is open.
Do you think there are bad guys playing around?
-
Yeah something is trying to hit a page in the firewall that doesn't exist either maliciously or through poor config.
I would guess from those URLs they are trying to hit commonly exploitable pages.
If that's coming from the WAN why is that open?
If it's coming from the LAN something there maybe compromised. Could still just be something badly configured.
Lock down the GUI access.
Steve
-
@Jawhead said in Firewall Logs:
Do you think there are bad guys playing around?
Noop.
These page requests /posts are looking harmless.
For now.Having the GUI open and accessible from the Internet is pure madness.
-
@stephenw10 Hi Steve, thanks for the inputs, We use to manage remotely the firewall. What would you recommend for locking down the firewall? Is there a guide for hardening a pfSense?
-
In one word : OpenVPN.
-
@Gertjan Yes, we have used OpenVPN to access internal server, any other options aside from OpenVPN.
-
If you are already using OpenVPN, you have two choices :
Modify the current setup, so you can access the GUI from LAN, when you are connected to the "internal server".
Or, activate an independent OpenVPN server on pfSense - use another port number if 1194 is already natted to your "internal server".
I guess you have already all the knowledge needed to access the GUI over OpenVPN. The big advantage is that only the people user credentials and/or certs can access the GUI. -
@Jawhead said in Firewall Logs:
Yes, Our pfSense is accessible publicly via domain and public IP. but only https port is open.
Yeah that is just plain moronic to be honest.... Yeah your logs are going to be full of shit for starters..
As suggested vpn in to manage, or atleast lock down the access to the gui from your source IP your going to be managing from.
-
That looks like the kind of stuff you see from captive portal redirecting requests from unauthenticated clients to the web server.
-
Thank you for the inputs guys really appreciate it, for the meantime, I just disable the public access and push to use OpenVPN instead.
