snort2c host block

lightingman117

I have some rule blocking access to websites:

"Block snort2c hosts (1000000110)"

I don't have snort, pfblocker, suricata (I uninstalled the packages trying to get rid of this error).

I had suricata running in disabled mode previously.
I ran into this error before, but I restarted the FW thinking this was a DNS glitch. It was fixed for about a week. Now it's happening again.

My firewall rules are very straight-forward.
"Allow All - any, any."

lightingman117

the last rule is only me trying to make it go away.

SteveITS

@lightingman117 said in snort2c host block:

suricata (I uninstalled the packages

The snort2c table is used by Suricata internally since most of the code is similar to the Snort package (same maintainer). Not sure how it could have entries....maybe it had a block in it at uninstall time, and if Suricata is removed then Suricata wouldn't prune out expired blocks??

You might try installing Suricata again, and uncheck the option "Keep Suricata Settings After Deinstall" on the Global Settings page, and then uninstall.

NogBadTheBad

@lightingman117 have you tried emptying the snort2c table via Diagnostics -> Tables

SteveITS

@nogbadthebad Ha, I actually did look at that but my snort2c was empty, some others (pfB tables) just had an Update option, and others had no button. Guess I didn't click enough to find one that showed the Empty button. But it does exist. :)

bmeeks

The snort2c table is automatically created by pfSense no matter if the Snort or Suricata packages are installed or not. That table is a default construct in the firewall initialization logic. There is a built-in pfSense pf firewall rule that references that table name. Any IP address placed in that table is blocked. The table is cleared each time pfSense is rebooted, or it can be cleared by manual user action (under DIAGNOSTICS > TABLES you can select the table for viewing and then clear it out).

Once an IP address is placed in that table by a Snort or Suricata installation, it remains there until manually removed or the firewall is rebooted. Thus simply removing the Snort or Suricata package or stopping the associated service will not necessarily clear the table. So blocks can remain even after the package is removed. There is an option on the GLOBAL SETTINGS tab of Snort to clear blocks when uninstalling the package. Suricata does not have this option, but I will add it to a future package update.