pfSense keeps disconnecting/reconnecting in UniFi Controller

dragonfire1119

@johnpoz I noticed another thing that happens in the Netgate logs it's blocking my WAN IP for abuse 1.

Aug 30 13:31:59 sshguard	84939	Blocking "(My IP)" for 160 secs (1 attacks in 0 secs, after 1 abuses over 0 secs.)
Aug 30 13:31:59	sshguard	84939	Attack from "(My IP)" on service SSH with danger 10.
Aug 30 13:31:59	sshd	84405	Did not receive identification string from (My IP) port 46863

This is happening right around the time. I'm not sure why this happens since I'm new to Netgate? ntopng is fine on the flows.

johnpoz

Its blocking your lan IP? Why are you trying to login to ssh without sending the correct info?

I can generate those on the fly by trying to connect to ssh from a box on my network - but I have public key auth setup

Aug 30 13:52:35 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:35 	sshd 	83302 	Connection closed by authenticating user root 192.168.2.12 port 34882 [preauth]
Aug 30 13:52:34 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:34 	sshd 	82979 	Connection closed by authenticating user root 192.168.2.12 port 34880 [preauth]
Aug 30 13:52:32 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:32 	sshd 	82701 	Connection closed by authenticating user root 192.168.2.12 port 34878 [preauth]
Aug 30 13:52:30 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:30 	sshd 	82337 	Connection closed by authenticating user root 192.168.2.12 port 34876 [preauth]
Aug 30 13:52:26 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:26 	sshd 	80674 	Connection closed by authenticating user root 192.168.2.12 port 34874 [preauth]

root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user#

dragonfire1119

@johnpoz No, it's blocking my static WAN IP.

I had an issue in the beginning with the ISP and they were being attacked and I finally got to a level 2 he moved me to a different GPON and static IP. Because the NTOPNG was saying my ISP was a flow flooder. I thought the attack was gone but I'm not sure if it's gone or just gotten smarter and getting around the NTOPNG flow log.

This SSH request is coming from my ISP because the (My IP) is my WAN IP.

You got me thinking about if there is anything in the logs. The Unifi Controller is reporting right that it's disconnecting.

I've gone and looked at the logs when my echo's drop streaming and the forum shows me the red box down on the bottom right and sure enough, Netgate is saying it blocked my WAN IP again.

Do you think I'm on the right track?

I really appreciate your help on this.

johnpoz

@dragonfire1119 said in pfSense keeps disconnecting/reconnecting in UniFi Controller:

This SSH request is coming from my ISP because the (My IP) is my WAN IP.

Huh?? Why would pfsense try talking to itself.. That makes no sense.. Your saying the IP that is being blocked is the IP that pfsense shows for its wan?

dragonfire1119

@johnpoz Yes correct.

johnpoz

Off the top of my head I know of nothing in pfsense that would be talking to itself on ssh.. From itself?

What packages are you running?

dragonfire1119

@johnpoz here is a list of my packages installed and uninstalled:

aws-wizard
bandwidth
ipsec-profile-wizard
Netgate_Firmware_Upgrade
ntopng
Zabbix (Uninstalled though)

johnpoz

@dragonfire1119 ntopng does have the ability to do monitoring - that could be doing it??? I have not played with ntop in along time..

Turn if off for testing - does your problem go away.. Do the sshguard lockouts go away.

Zabbix would also be able to do monitoring.. But you say that is uninstalled.

dragonfire1119

@johnpoz I just disabled it and monitoring it.

bingo600

@johnpoz
I have ntopng + zabbix agent installed.
Have never seen any strange ssh.

/Bingo

johnpoz

@bingo600 yeah I have no idea why something would try and ssh to itself from its own IP? But ntop does have the ability to active monitor.. Atleast the full current version does - not sure about the package version in pfsense.

Not sure if ssh was available as one of the things to check? I know like icmp, ping, http, etc was..

dragonfire1119

@johnpoz Been monitoring it no more logs with blocking so far. We're getting better speeds and 4 ms ping now.

bingo600

@johnpoz

If something from the inside tried to ssh to the "outside/wan"
Would it be natt'ed to the wan first ?

So that wan ssh's wan

If it was comming from real wan (spoof) , then i'd hope the packets would be blocked , and not getting a "ban"

/Bingo

johnpoz

@bingo600 said in pfSense keeps disconnecting/reconnecting in UniFi Controller:

Would it be natt'ed to the wan first ?

No..

I just hit my wan IP from lan side IP, as you can see the state is showing the lan side rfc1918 address.

dragonfire1119

@johnpoz It's been working and I'm streaming music now without interruption or static. So if this stays like this it was the NTOPNG being analyzed as an attacker for some reason. Is there any way to whitelist NTOPNG?

Update: The Unifi Messages have stopped saying disconnected from Netgate.

johnpoz

Well when you have some time, we can re-enable it and go over the settings and see what could be causing the issue.

I will have to fire it up and refresh my memory on its features.. Use to use it all the time, outside of pfsense back in the day.. But never really needed it on home network..

edit: switch just got here - man is that tiny! ;)

mcury

@johnpoz man, that is a nice beer =)

dragonfire1119

@johnpoz wow, that thing is tiny! I don't think that one has POE or anything?

johnpoz

@mcury hehe not really my fav, but its very drinkable on a hot day that is for sure. It was on sale a few days back, $8 for a 12er - limit 2, so got 2.. And yeah have to sport the correct glassware..

Needed something to compare with scale, and didn't have a banana handy - hehehe.. Some of you sure will get that joke. If you hang out on the net you will.

johnpoz

@dragonfire1119 No it can be powered by poe, but no doesn't output any poe.. Will hook it up in the morning to the controller. But damn the thing is tiny..

I could see how they could be handy - especially in a place where you might have some equipment but not any extra power outlets because you can power the thing via poe.

edit: Well got it adopted and updated its firmware. It sees pfsense on the vlan its currently on.. And it sees the mac of switch its connected my sg300-28