Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Had my pfSense been compromised?

    Scheduled Pinned Locked Moved Firewalling
    79 Posts 11 Posters 15.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      Not sure call it weird, he had or still has UPnP running - this for explains what he saw in the logs.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      H 1 Reply Last reply Reply Quote 0
      • H
        hulleyrob @johnpoz
        last edited by

        @johnpoz sorry i meant weird how we both had connections from the same IP address and the same ports. But i aggree it does look like upnp is running on his firewall.

        1 Reply Last reply Reply Quote 0
        • provelsP
          provels
          last edited by

          Suppose this could be any number of IoT's phoning home? TV, etc.?

          Peder

          MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
          BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

          H 1 Reply Last reply Reply Quote 0
          • H
            hulleyrob @provels
            last edited by hulleyrob

            @provels yeah I thought that too but I tried them one by one tonight and didn't see anything however looking closer at the rules that were opened up it all seems to be Microsoft authentication stuff and I don't run Windows.Screenshot 2019-10-14 at 19.13.00.jpg
            Also I have now added a rule to the ACLs for upnp to stop low ports being opened.

            provelsP 1 Reply Last reply Reply Quote 0
            • provelsP
              provels @hulleyrob
              last edited by

              @hulleyrob Maybe it's "Steven's Phone"...
              https://alltvspots.com/tag/xfinity-stevens-phone/

              Peder

              MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
              BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

              H 1 Reply Last reply Reply Quote 1
              • H
                hulleyrob @provels
                last edited by

                @provels haha yeah is windows phone even a thing anymore? Could be anything i suppose but I’m going to keep a more careful eye on it for a while.

                provelsP 1 Reply Last reply Reply Quote 0
                • provelsP
                  provels @hulleyrob
                  last edited by provels

                  @hulleyrob Glad you asked! I have 2 - 1 Nokia, 1 MS; one for use, one for backup. MS sold 2 and I bought them both! Going on 5 years, same battery, Windows 10, updates monthly. Makes calls and texts, takes pictures, navigation, in-a-pinch Internet, a few apps (not app-happy here). Best $30 (x2) I ever spent. Consumer Cellular, $25/month. I'll stop now.

                  Peder

                  MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                  BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    514 is syslog, 995 is pop3 ssl, 546 and 547 is dhcpv6... 990 ftps

                    WTF why would any devices open those? 445 is smb over tcp.. 389 LDAP

                    Those are not unique to windows...But I would be concerned with stuff opening those up... Which is why you never run freaking UPnP... Its was a horrible idea from day one..

                    Why not just sniff on your interface for the UPnP ports and see what is hitting them.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 1
                    • A
                      ASIC
                      last edited by

                      Hi, I have exactly the same problem - weird incoming connections from the same ip (103.240.140.10). UPnP is disabled. No open WAN ports, no floating rules. Pfsense 2.4.4-RELEASE-p3 (amd64). I googled this IP and realize it has been blacklisted at some places:
                      http://sanyalnet-cloud-vps.freeddns.org/mirai-ips.txt
                      https://whatismyipaddress.eu/downloads/ip-blacklist.txt
                      I have only Windows 7 PC's in my LAN. They all were shut down when this traffic appear. Sorry for my bad English.
                      Clipboard01.jpg
                      Clipboard02.jpg

                      1 Reply Last reply Reply Quote 0
                      • provelsP
                        provels
                        last edited by

                        https://www.abuseipdb.com/check/103.240.140.10
                        But not why the traffic was passed.

                        Peder

                        MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                        BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Your not even showing your rule Ids or description. For all we know you have an any any rule on your wan?

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • A
                            ASIC
                            last edited by

                            When I place the mouse over the green check on left on the rule, it shows "pass/0". When I click it opens a popup: "The rule that triggered this action is:" Nothing else.

                            1 Reply Last reply Reply Quote 0
                            • A
                              ASIC
                              last edited by

                              Rule description is @4294967295.

                              H B 2 Replies Last reply Reply Quote 0
                              • H
                                hulleyrob @ASIC
                                last edited by hulleyrob

                                Does anyone have an idea where the rule id comes from as it looks like we all have the same rule ID number creating these rules maybe this will give us an idea of where they are coming from?

                                Ideally there would be some logging or history but as everyone has said upnp is a bad idea for most people so i guess thats why it doesnt exist.

                                Also they are also 8 seconds apart in batches but this could be the time that the service runs each time?

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  So I just turned UPnP on - to test.. And then set my plex to use UPnP vs the static forward I have setup.

                                  So I disabled my normal port forward.. Then enable UPnP

                                  And I get this.
                                  upnp.jpg

                                  After doing a can you see me for the port listed in the UPnP status 21735

                                  Is not coming up with that ID number.. A google for that ID and pfsense came up with this thread
                                  https://forum.netgate.com/topic/128685/firewall-log-showing-strange-pass-entry

                                  Can we see the raw firewall logs for these entries. Like in that thread.

                                  example - here is the raw entry for one of those passed via upnp

                                  Oct 15 06:10:27 	filterlog: 224,0,miniupnpd,0,igb1,match,pass,in,4,0x0,,42,13284,0,DF,6,tcp,60,52.202.215.126,192.168.9.10,58368,32400,0,S,2623792563,,26883,,mss;sackOK;TS;nop;wscale
                                  

                                  You can see from the log that miniupnpd there.. So lets see the raw for these entries.

                                  From that other thread
                                  Mar 25 14:42:05 pfSense filterlog: 4294967295,,,0,re0,short,pass,in,4,0x0,,239,10359,0,DF,6,tcp,36,105.212.87.78,[MYIPADDRESS],2123,23,-4,S,errormsg='[bad hdr length 20 - too long, > 16]',

                                  Not exactly sure what "short" means as the reason...

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  H 1 Reply Last reply Reply Quote 0
                                  • H
                                    hulleyrob @johnpoz
                                    last edited by

                                    @johnpoz yeah sure i did look at those last night but couldnt see anything that looked much differant from in the screenshot but maybe you will see something i cannot. Will post as soon as i get home from work. Thanks to everyone for input and testing this.

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      ASIC
                                      last edited by

                                      Here is my raw filter log for this:
                                      Oct 14 20:42:00 filterlog: 4294967295,,,0,pppoe0,short,pass,in,4,0x0,,241,53405,0,none,17,udp,27,103.240.140.10,[MYIPADDRESS],1810,1985,7

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by johnpoz

                                        @ASIC said in Had my pfSense been compromised?:

                                        short,

                                        I have no idea what that means... Have never seen that in the logs before.

                                        Found this;
                                        reason res - the reason that action was taken. Possible reasons are match, bad-offset, fragment, short, normalize, memory, bad-timestamp, congestion, ip-option, proto-cksum, state-mismatch, state-insert, state-limit, src-limit and synproxy.

                                        But not sure what "short" actually means?

                                        edit: Ok looks there have been some that match on short (2) - but still not actually finding anything that describes what it actually means

                                        [2.4.4-RELEASE][admin@sg4860.local.lan]/root: pfctl -s info
                                        Status: Enabled for 30 days 22:17:00          Debug: Urgent
                                        
                                        Interface Stats for igb0              IPv4             IPv6
                                          Bytes In                    350478233746         69232705
                                          Bytes Out                  1405455628533       1128183040
                                          Packets In
                                            Passed                       466867557           311496
                                            Blocked                           8876                1
                                          Packets Out
                                            Passed                       999590646          1171599
                                            Blocked                              0                0
                                        
                                        State Table                          Total             Rate
                                          current entries                      404               
                                          searches                      3535810440         1323.2/s
                                          inserts                         15778842            5.9/s
                                          removals                        15778438            5.9/s
                                        Counters
                                          match                           16542390            6.2/s
                                          bad-offset                             0            0.0/s
                                          fragment                              64            0.0/s
                                          short                                  2            0.0/s
                                          normalize                             21            0.0/s
                                          memory                                 0            0.0/s
                                          bad-timestamp                          0            0.0/s
                                          congestion                             0            0.0/s
                                          ip-option                            125            0.0/s
                                          proto-cksum                            0            0.0/s
                                          state-mismatch                      2834            0.0/s
                                          state-insert                           0            0.0/s
                                          state-limit                            0            0.0/s
                                          src-limit                              0            0.0/s
                                          synproxy                               0            0.0/s
                                          map-failed                             0            0.0/s
                                        [2.4.4-RELEASE][admin@sg4860.local.lan]/root: 
                                        

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          bchan @ASIC
                                          last edited by

                                          @ASIC said in Had my pfSense been compromised?:

                                          Rule description is @4294967295.

                                          Same id as mine.🤔

                                          A 1 Reply Last reply Reply Quote 0
                                          • A
                                            ASIC @bchan
                                            last edited by

                                            @bchan said in Had my pfSense been compromised?:

                                            4294967295

                                            Maybe because 4294967295(Dec) is equal to FFFFFFFF(Hex).

                                            1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.