GRC Leaktest Finds A Hole in pfSense - how to fix

gigaboy

Hi,
Have pfSense lastest version install. New installation. No holes with uPnp (good!). But I ran Gibson Research Corps "Leaktest" and immediately found a hole.

https://www.grc.com/lt/leaktest.htm and

https://www.grc.com/lt/howtouse.htm

Wondering if anyone else has experience this problem, and is there a setting inside pfSense to plug it?

Thanks in advance,
Mark

doktornotor

There is no problem except for the Gibson idiot who's been spreading misinformation and FUD for ~15 years.

https://web.archive.org/web/20060118024806/http://grcsucks.com/

gigaboy

OK, it looked like the information was pretty old on the GRC site. Maybe a problem in the past?

doktornotor

You cannot test packet filters on a router with any similar "LeakTest". That thing was designed to detect "leaks" in application-level firewalls on local computer. Run foo.exe. Allow traffic outbound from foo.exe in firewall. Rename foo.exe to bar.exe. Run bar.exe. Is traffic still allowed? Oh noes, you have a giant leak and the world will collapse into blackhole soon. Now, wrap this into tons of FUD and marketing BS and pretend to be a security guru.

That test has NO RELEVANCE WHATSOEVER when it comes to pfSense.

chrcoluk

some of his tools are useful, such as testing dns randomisation and a convenient way of doing a remote portscan. However I agree some of his information is just outdated. e.g. displaying a big warning if your ip is pingable, oh no people can ping me its the end of the world.

doktornotor

@chrcoluk:

displaying a big warning if your ip is pingable, oh no people can ping me its the end of the world.

Even worse when you have a PTR for the IP. T3h noes, NSA knocking on your door.

NOYB

I think an important point to keep in mind with GRS tools is to separate what the tool does vs. the marketing hype. I think the tools are decent at what they do. But take the marketing hype about what the results mean and their significance with a big grain of salt. Understanding the results in context of ones own environment needs is paramount.

grandrivers

well steve said on security now his firewall is pfsense so I assume its free of major problems at least in defualt config