Weird issue in 2.5.2. Suricata wont lift blocks and routing stops to internal mailserver.

Cool_Corona

Only thing to solve it, is to reboot.

Only 20 days uptime since last reboot.

Nothing unusual to see and report. Everything looks normal.

Routing to other services behind the FW works with no issues.

SteveITS

@cool_corona In Global Settings, what is "Remove Blocked Hosts Interval" set to?

Cool_Corona

@steveits Never but deleting blocks manually and restarting Suricata doesnt clear it. Only a reboot will.

And I only have one Suricata process running.

fireodo

@cool_corona said in Weird issue in 2.5.2. Suricata wont lift blocks and routing stops to internal mailserver.:

@steveits Never but deleting blocks manually and restarting Suricata doesnt clear it. Only a reboot will.

And I only have one Suricata process running.

Hi, no answer to your question but why dont you put your question on the IDS/IPS category so @bmeeks can look at it?

Have a fine weekend,
fireodo

SteveITS

@cool_corona Hmm well I’ve not set to never do have no experience. But we delete blocks all the time.

After deleting a block is the ip still in the table when viewed via Diagnostics? I believe it’s the snort2c table or similarly named.

bmeeks

@cool_corona said in Weird issue in 2.5.2. Suricata wont lift blocks and routing stops to internal mailserver.:

@steveits Never but deleting blocks manually and restarting Suricata doesnt clear it. Only a reboot will.

And I only have one Suricata process running.

What happens after the reboot? Does the block return quickly?

You may simply have repeated triggers of the same rule causing recurring blocks. The "auto-remove blocks" cron task will only remove IP addresses that have not seen any further traffic since the initial block. So if the "remove blocked hosts" setting is configured for one hour, then the task will only remove IP addresses from the table that have not seen traffic for the last hour or more. If traffic is still repeatedly hammering the blocked IP, it should stay in the table and not be cleared. This is a FreeBSD system function, it is not a part of the Snort or Suricata packages. The IDS/IPS packages simply call that FreeBSD system function via a call to the pfctl packet filter utility to do the work.

While the block is in place, go to DIAGNOSTICS > TABLES and select the snort2c table in the drop-down there. You will see a list of the IP addresses currently in that table. These are the IPs being "blocked" at that time. You can manually remove IP addresses there. Try that and see it it works.

Cool_Corona

@bmeeks HI Bill

No blocks as of yet. Its been 23 hrs since reboot and everything is running as it should.

No issues with the service behind pfsense since reboot.