pfSense using unreasonable amount of bandwidth while idle

CyberMinion · Sep 16, 2020, 5:30 PM

@johnpoz said in pfSense using unreasonable amount of bandwidth while idle:

Do you have any aliases setup? That might have some listing of what you think is IPs? and the filterdns mech is trying to resolve them because it thinks they are fqdn? filterdns out of the box would run every 5 minutes though.

Yes, I have a bunch a aliases in my FW config (they need to be updated, actually)

The "Ports" and "URLs" tabs are empty. Where does filterdns live? Do you mean the component of pfBlocker, or is this something else?

This is clearly one of the weirdest things I have seen around here in a very long time, if not the most weirdest thing.. Its crazy..

Well, at least it's not some stupid thing I should have figured out myself...I wouldn't be surprised if I still did something wrong in config to cause this, though. I have a backup package from about 9 months ago. Not much has been changed in config since then, so I'm thinking of trying restoring to that, just in case that wipes out this problem. That's probably wishful thinking, but its a low-risk change.

johnpoz · Sep 16, 2020, 5:59 PM

Well filterdns runs every 5 minutes out of the box

[2.4.5-RELEASE][admin@sg4860.local.lan]/root: ps -ax | grep filterdns
61721  -  Is        0:10.79 /usr/local/sbin/filterdns -p /var/run/filterdns.pid -i 300 -c /var/etc/filterdns.conf -d 1
17951  0  S+        0:00.00 grep filterdns

You could delete all of those.. Or when its doing it, you could kill off the filterdns process and see if it stops.

I guess its possible that something wrong where you think you have a alias setup as fqdn and not IP with an IP in it, that you might resolve that.. Let me do a little test, brb

What do you have being loaded by URL? I created a alias and then watched my unbound log, and not seeing any odd queries for it as a A or AAAA query. But guess its possible if your loading something via a url where something could get parsed wrong?

Post up what lists your using via url so I can take a look see, in your sniff I did see lists being loaded - but didn't notice any IPs that jumped out at me in them for what was being queried.

CyberMinion · Sep 16, 2020, 6:30 PM

@johnpoz said in pfSense using unreasonable amount of bandwidth while idle:

You could delete all of those.. Or when its doing it, you could kill off the filterdns process and see if it stops.

Interesting...I'll try that.

What do you have being loaded by URL? I created a alias and then watched my unbound log, and not seeing any odd queries for it as a A or AAAA query. But guess its possible if your loading something via a url where something could get parsed wrong?

I have nothing by way of aliases

But I'm using pfBlocker to pull some lists.

Post up what lists your using via url so I can take a look see, in your sniff I did see lists being loaded - but didn't notice any IPs that jumped out at me in them for what was being queried.

Excluding the DNSBL lists, I am using the ones listed here: https://cloud.archnet.us/index.php/s/R2jXJzkJXBoXxkT
(I couldn't include them in this post. Apparently, I'm not allowed to have more than 1 URL in my posts? Or maybe it didn't like one of those URLs specifically? I don't know...the spam filter on this forum is aggressive.)

Do you want my DNSBL lists too? I have many more of those, but I can gather them all if needed.

johnpoz · Sep 16, 2020, 6:54 PM

well this one
https://www.spamhaus.org/drop/asndrop.txt

is a bunch of AS numbers - those would have to be resolved to IP ranges or CIDR blocks..

Why are you loading all these lists? You don't even have any port forwards setup? I just don't get the reason for trying to filter shit when you don't even have anything exposed?

CyberMinion · Sep 16, 2020, 7:03 PM

@johnpoz said in pfSense using unreasonable amount of bandwidth while idle:

well this one
https://www.spamhaus.org/drop/asndrop.txt

is a bunch of AS numbers - those would have to be resolved to IP ranges or CIDR blocks..

Oh..that's interesting. It used to have the IP blocks themselves on that list. I'll remove that one. I should check through all of my lists...it has been almost two years since those were added.

Why are you loading all these lists? You don't even have any port forwards setup? I just don't get the reason for trying to filter shit when you don't even have anything exposed?

I don't have any ports forwarded right now although I did in the past. That is partially because I wasn't sure what was wrong on this network. If I regain confidence that nothing is vulnerable or compromised, I will probably open ports again. To be clear, I want to have open ports, but I'd prefer to make sure everything is shipshape before doing that again. It looks like this is probably a benign issue (although I still need to fix it), but I want to get it working properly first, just the same.

johnpoz · Sep 16, 2020, 7:09 PM

Vs trying to block the planet, if you are going to open up ports - its better to just limit what can talk to your ports. Example - I have plex open for friends and family. They are all in the US.. So I only allow US Ips to talk to that.. I don't load every possible bad guy list and block them - that is just insane to try and do that..

When I had someone outside the US, I added that country..

Sure in a perfect setup would only allow their specific IPs.. But then again they are users - asking them for their IP is like asking a monkey to explain theory of relativity.. And many of them use phones and travel, etc.

I would really if your not going to just nuke this thing from orbit and start over - which is what I would do.. Is turn off all this list shit..

You use bad guy lists, when that is the smaller list. Ie you want to serve up stuff to the globe - that is when you filter bad guy lists. Since that is smaller list ;)

CyberMinion · Sep 21, 2020, 6:29 PM

@johnpoz said in pfSense using unreasonable amount of bandwidth while idle:

Vs trying to block the planet, if you are going to open up ports - its better to just limit what can talk to your ports.
You use bad guy lists, when that is the smaller list. Ie you want to serve up stuff to the globe - that is when you filter bad guy lists. Since that is smaller list ;)

At the risk of continuing down the age-old "block the planet" vs whitelist dispute, the problem is, I plan to have incoming connections from six continents. Whitelist management is going to be a much bigger headache than some low-maintenance blacklists.

I would really if your not going to just nuke this thing from orbit and start over - which is what I would do.. Is turn off all this list shit..

Yeah, I'm leaning that way. I reverted this unit to a backup from December 2019. After fixing a few small things, it seems to be humming along without issues so far. It does still have the aforementioned fragments of the Suricata package, but hopefully that's irrelevant. After about 4 days, I have yet to notice these garbage DNS queries, although I may have missed some.

johnpoz · Sep 21, 2020, 7:47 PM

@CyberMinion said in pfSense using unreasonable amount of bandwidth while idle:

I have yet to notice these garbage DNS queries, although I may have missed some.

You should have ZERO of those - there is NOTHING that should create dns queries like that.. They can not resolve - they are garbage..

CyberMinion · Oct 31, 2020, 5:00 AM

I hate to bump this to the top, but I just wanted to let you know that I have not seen any of this bad behavior from the firewall since restoring from backup. Whatever it was, it seems to be fixed. I just wish I knew the root cause.

Thank you for your help, everyone!

stephenw10 · Oct 31, 2020, 2:22 PM

Mmm, weird. Thanks for following up though. Yeah it would be good to know what it was but that's probably not possible at this point.

Steve