• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Had my pfSense been compromised?

Scheduled Pinned Locked Moved Firewalling
79 Posts 11 Posters 14.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    johnpoz LAYER 8 Global Moderator
    last edited by johnpoz Oct 15, 2019, 11:44 AM Oct 15, 2019, 11:31 AM

    So I just turned UPnP on - to test.. And then set my plex to use UPnP vs the static forward I have setup.

    So I disabled my normal port forward.. Then enable UPnP

    And I get this.
    upnp.jpg

    After doing a can you see me for the port listed in the UPnP status 21735

    Is not coming up with that ID number.. A google for that ID and pfsense came up with this thread
    https://forum.netgate.com/topic/128685/firewall-log-showing-strange-pass-entry

    Can we see the raw firewall logs for these entries. Like in that thread.

    example - here is the raw entry for one of those passed via upnp

    Oct 15 06:10:27 	filterlog: 224,0,miniupnpd,0,igb1,match,pass,in,4,0x0,,42,13284,0,DF,6,tcp,60,52.202.215.126,192.168.9.10,58368,32400,0,S,2623792563,,26883,,mss;sackOK;TS;nop;wscale
    

    You can see from the log that miniupnpd there.. So lets see the raw for these entries.

    From that other thread
    Mar 25 14:42:05 pfSense filterlog: 4294967295,,,0,re0,short,pass,in,4,0x0,,239,10359,0,DF,6,tcp,36,105.212.87.78,[MYIPADDRESS],2123,23,-4,S,errormsg='[bad hdr length 20 - too long, > 16]',

    Not exactly sure what "short" means as the reason...

    An intelligent man is sometimes forced to be drunk to spend time with his fools
    If you get confused: Listen to the Music Play
    Please don't Chat/PM me for help, unless mod related
    SG-4860 24.11 | Lab VMs 2.8, 24.11

    H 1 Reply Last reply Oct 15, 2019, 11:58 AM Reply Quote 0
    • H
      hulleyrob @johnpoz
      last edited by Oct 15, 2019, 11:58 AM

      @johnpoz yeah sure i did look at those last night but couldnt see anything that looked much differant from in the screenshot but maybe you will see something i cannot. Will post as soon as i get home from work. Thanks to everyone for input and testing this.

      1 Reply Last reply Reply Quote 0
      • A
        ASIC
        last edited by Oct 15, 2019, 12:50 PM

        Here is my raw filter log for this:
        Oct 14 20:42:00 filterlog: 4294967295,,,0,pppoe0,short,pass,in,4,0x0,,241,53405,0,none,17,udp,27,103.240.140.10,[MYIPADDRESS],1810,1985,7

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz Oct 15, 2019, 1:20 PM Oct 15, 2019, 12:59 PM

          @ASIC said in Had my pfSense been compromised?:

          short,

          I have no idea what that means... Have never seen that in the logs before.

          Found this;
          reason res - the reason that action was taken. Possible reasons are match, bad-offset, fragment, short, normalize, memory, bad-timestamp, congestion, ip-option, proto-cksum, state-mismatch, state-insert, state-limit, src-limit and synproxy.

          But not sure what "short" actually means?

          edit: Ok looks there have been some that match on short (2) - but still not actually finding anything that describes what it actually means

          [2.4.4-RELEASE][admin@sg4860.local.lan]/root: pfctl -s info
          Status: Enabled for 30 days 22:17:00          Debug: Urgent
          
          Interface Stats for igb0              IPv4             IPv6
            Bytes In                    350478233746         69232705
            Bytes Out                  1405455628533       1128183040
            Packets In
              Passed                       466867557           311496
              Blocked                           8876                1
            Packets Out
              Passed                       999590646          1171599
              Blocked                              0                0
          
          State Table                          Total             Rate
            current entries                      404               
            searches                      3535810440         1323.2/s
            inserts                         15778842            5.9/s
            removals                        15778438            5.9/s
          Counters
            match                           16542390            6.2/s
            bad-offset                             0            0.0/s
            fragment                              64            0.0/s
            short                                  2            0.0/s
            normalize                             21            0.0/s
            memory                                 0            0.0/s
            bad-timestamp                          0            0.0/s
            congestion                             0            0.0/s
            ip-option                            125            0.0/s
            proto-cksum                            0            0.0/s
            state-mismatch                      2834            0.0/s
            state-insert                           0            0.0/s
            state-limit                            0            0.0/s
            src-limit                              0            0.0/s
            synproxy                               0            0.0/s
            map-failed                             0            0.0/s
          [2.4.4-RELEASE][admin@sg4860.local.lan]/root: 
          

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • B
            bchan @ASIC
            last edited by Oct 15, 2019, 1:26 PM

            @ASIC said in Had my pfSense been compromised?:

            Rule description is @4294967295.

            Same id as mine.🤔

            A 1 Reply Last reply Oct 15, 2019, 1:29 PM Reply Quote 0
            • A
              ASIC @bchan
              last edited by Oct 15, 2019, 1:29 PM

              @bchan said in Had my pfSense been compromised?:

              4294967295

              Maybe because 4294967295(Dec) is equal to FFFFFFFF(Hex).

              1 Reply Last reply Reply Quote 1
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz Oct 15, 2019, 1:39 PM Oct 15, 2019, 1:38 PM

                Ok so from research so fare

                short packets dropped

                Is that that is suppose to mean.. but why does it say passed then?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • P
                  provels
                  last edited by provels Oct 15, 2019, 1:40 PM Oct 15, 2019, 1:39 PM

                  So there is no outbound traffic to 103.240.140.10 from some device that creates this return Allow temp rule? Since all return traffic is allowed? Create a rule that allows (but logs) all traffic to 103.240.140.10? (LOL, ignore as needed! :)

                  Peder

                  MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                  BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator
                    last edited by Oct 15, 2019, 1:42 PM

                    To be honest I think this is log of traffic that IP or transport header is too short.. But not sure why its saying pass... But I don't think that traffic is actually being passed to anything, not even pfsense.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • H
                      hulleyrob
                      last edited by Oct 15, 2019, 4:43 PM

                      Oct 13 09:14:13 pfSense filterlog: 4294967295,16777216,,0,pppoe0,short,pass,in,4,0x0,,245,35606,0,none,17,udp,27,103.240.140.10,IP_REMOVED,3266,990,7
                      Oct 13 09:14:13 pfSense filterlog: 4294967295,16777216,,0,pppoe0,short,pass,in,4,0x0,,245,35608,0,none,17,udp,27,103.240.140.10,IP_REMOVED,2427,389,7
                      Oct 13 09:14:13 pfSense filterlog: 4294967295,16777216,,0,pppoe0,short,pass,in,4,0x0,,245,35605,0,none,17,udp,27,103.240.140.10,IP_REMOVED,1862,1025,7
                      Oct 13 09:14:13 pfSense filterlog: 4294967295,16777216,,0,pppoe0,short,pass,in,4,0x0,,245,35607,0,none,17,udp,27,103.240.140.10,IP_REMOVED,570,995,7
                      Oct 13 09:14:13 pfSense filterlog: 4294967295,16777216,,0,pppoe0,short,pass,in,4,0x0,,245,35604,0,none,17,udp,27,103.240.140.10,IP_REMOVED,493,514,7
                      Oct 13 09:14:13 pfSense filterlog: 4294967295,16777216,,0,pppoe0,short,pass,in,4,0x0,,245,35609,0,none,17,udp,27,103.240.140.10,IP_REMOVED,2375,445,7
                      Oct 13 09:14:13 pfSense filterlog: 4294967295,16777216,,0,pppoe0,short,pass,in,4,0x0,,245,35602,0,none,17,udp,27,103.240.140.10,IP_REMOVED,162,546,7
                      Oct 13 09:14:13 pfSense filterlog: 4294967295,16777216,,0,pppoe0,short,pass,in,4,0x0,,245,35603,0,none,17,udp,27,103.240.140.10,IP_REMOVED,3871,547,7
                      

                      Here are the entries from my log file.

                      1 Reply Last reply Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator
                        last edited by Oct 15, 2019, 4:45 PM

                        So it seems these are short, ie something wrong with them... But the question is why are they getting logged as passed.. If they are short - they should just be dropped.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        H 1 Reply Last reply Oct 15, 2019, 4:47 PM Reply Quote 0
                        • H
                          hulleyrob @johnpoz
                          last edited by Oct 15, 2019, 4:47 PM

                          @johnpoz if thats all it is it will be a relief as you saw on the screenshot above it looked like something had opened up all those ports.

                          What do I do now, is it worth reporting this somewhere for investigation?

                          1 Reply Last reply Reply Quote 0
                          • J
                            johnpoz LAYER 8 Global Moderator
                            last edited by Oct 15, 2019, 4:54 PM

                            I would hope @jimp or @Derelict might be able to give more details of these "short" log entries..

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • J
                              jimp Rebel Alliance Developer Netgate
                              last edited by Oct 21, 2019, 7:00 PM

                              I can't remember the last time I saw one marked short. It might be a fragment.

                              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                              Need help fast? Netgate Global Support!

                              Do not Chat/PM for help!

                              1 Reply Last reply Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator
                                last edited by Oct 21, 2019, 7:01 PM

                                But the question is why is marked pass?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • J
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by Oct 21, 2019, 7:02 PM

                                  If it's a fragment that is part of an existing connection, it would be passed. It might be that the state recently expired or was purged for some other reason so it was passed in but NAT didn't get applied, for example.

                                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  A 1 Reply Last reply Oct 22, 2019, 7:46 AM Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz Oct 21, 2019, 7:03 PM Oct 21, 2019, 7:03 PM

                                    I doubt its frag, since that is a different counter - see my output from
                                    pfctl -s info

                                    above.

                                    From the logs he lists I doubt its part of an existing connection.. From everything I find short should be dropped, so why is it logged as if it passed?

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      jimp Rebel Alliance Developer Netgate
                                      last edited by Oct 21, 2019, 7:10 PM

                                      I'm not sure, unless it's being misinterpreted by filterlog.

                                      If you can reproduce it reliably, you could capture the pflog output directly and pipe it through tcpdump (as described on https://www.openbsd.org/faq/pf/logging.html ) and see if that agrees.

                                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                      Need help fast? Netgate Global Support!

                                      Do not Chat/PM for help!

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by Oct 21, 2019, 7:19 PM

                                        I can not tried to reporduce it, but you could prob for sure feed short packets via packet creation tool to try and duplicated the problem.

                                        But seems a few users are seeing a bunch of them - as you can see from my counters I have only ever seen 2 of them... But don't recall ever seeming in the the log as pass.. will keep an eye if that counter goes up and see what my log says since feeding all logs to syslog now for retention.. But if get a chance will try and duplicate a short to pfsense and see if can try and see what it logs.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          ASIC @jimp
                                          last edited by Oct 22, 2019, 7:46 AM

                                          @jimp I have PfBlockerNG installed, and GeoIP Asia IP list, which includes 103.240.140.10, and it is applied as denied outbound connections on LAN, so there cannot be any existing connection to that IP.Clipboard01.jpg

                                          1 Reply Last reply Reply Quote 0
                                          57 out of 79
                                          • First post
                                            57/79
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received