Blocked IP reaching server anyway
-
@jarhead I didn't set it up by myself. I had an expert with me and we set it up together the first time. He's no longer available. I did pay for support service one other time to review all the settings and they found everything was OK. That was a couple of years ago but there haven't been many changes since then. Mostly just me adding repeat mail server attackers to an Alias when they launch DoS attacks on my mail server and bog it down.
I only have one WAN interface. All the rules apply to that WAN interface.
Is it safe to post pictures of the entire rules pages? I mean, that's giving information that could help someone get around the firewall isn't it? They would know what IPs might be easier to attack or spoof. I guess I could black them out but since it's not hard to find my IP range wouldn't that still be risky?
-
@cdsjerry That command dumps the ruleset as loaded, in the order they are evaluated.
You have a rule that uses an alias to block traffic from specific sources.The example you posted is an "allow from any to my mail server" has the keyword quick. That means if a packet matches this rule, no rule after it matters.
Now look for a deny/block rule that references your badguys alias; is it before or after the example one? If the deny/block rule is after the allow rule, then the deny rule never gets hit.
I don't know what pfSense "Passthrough mode" does so can't answer that.
People often edit the screenshots of the rules, redacting any public IPs or sensitive information.
-
@mer all of the allow rules are below the set of blocks, including the alias. So it should have been blocked by the alias and never moved down to the pass rule.
I'll black out some IPs and post the rule page in just a bit.
-
@mer Here are the 3 pages of WAN rules plus the page of floating rules. The IP we've been looking at is in the Badguys5 alias.
-
@johnpoz I'm still seeing logs in the mail server from IPs that should have been blocked by pfSense. I disabled pfBlocker for a bit since I was getting the error on it mentioned above. I thought perhaps the rest of the rules weren't being loaded once it hit that error. However with it pfBlocker disabled and all the States reset, I'm still having the same issue with IPs in the Badguys5 block rule still getting to the mail server. While the IP listed below is a different IP as the first example seems to be giving me a break for a bit, this IP is in the same alias for blocking and it's getting past pfSense
Dec 28 11:25:15 WAN 38.27.110.8:55033 my.mail.ip.1:25 -
@cdsjerry whenever you add something new to an alias or just specific block on that IP. You have to make sure there are no existing states. Blocks will not take effect until there are no states that match.. States are evaluated before any rules, floating is first, then the interface..
example
These rules are not showing any evaluations - see the 0/0 on them
-
@johnpoz But in this case I've reset the states and it still shows up. Wouldn't resetting the states allow the block to work? Is rebooting the firewall needed or something?
I mean adding an IP to a block list and expecting that IP to then be blocked doesn't seem all the unreasonable to me. I did the Apply. I reset the States. What more has to be done to actually stop traffic from that IP (and all the others on the blocked list)
-
@cdsjerry see my example above - you have 2 rules with badguys alias that are not triggering.
-
@johnpoz I didn't know how to interpret those numbers. So the 0 is showing no "triggers" for that rule, yet the IPs inside that rule are still getting through. I still don't understand that. Why would it not be triggered if that IP is accessing my server? Are you saying a Floating rule is allowing it to pass before it reaches these rules? My Floating rules are posted above, I don't know how it would be getting past? I'm obviously missing something.. but what?
-
@cdsjerry said in Blocked IP reaching server anyway:
yet the IPs inside that rule are still getting through
yea the first 0 is active states - but you would never see those on a block rule. the second 0 is how much traffic for that rule has been evaluated. If you see 0/0 means the rule never triggered so either the rule didn't match the traffic, or a state is allowing the traffic if that rule should block it. Or another rule allows it before that rule is evaluated.
-
@johnpoz OK, so Badguys 5 has been evaluated 7.461 M times since the reset but there are no current states active. Right? There are no WAN rules above this line that ever allow traffic to pass so I'd look at the Floating rules right? But I don't see a floating rule that would pass to the mail server. (picture above).
-
@cdsjerry yeah your badbuys5 has had lots of evaluations 29MBs worth.. and badbuys 2 has some above, so that would prob preven from the 2nd badguys 2 rule from ever seeing traffic. But that badbuys not seeing any evaluations on it..
-
@johnpoz But the IP that's reaching the firewall is in Badguys5, which IS getting evaluations... but is still passing traffic. I'm confused as to why it would pass traffic that's a block.
-
@cdsjerry it wouldn't unless it doesn't match, or there was a state. or some other rule allowed it..
-
@johnpoz The IP is a match. I reset the states so they'd be cleared. There are no pass rules above it, and don't see any floating rule pass. Is there some way to tell why its passing? The log doesn't seem to be any help.
-
@cdsjerry you could log all allow rules to see what is allowing it in..
You could also use pftop from cmd line on pfsense to see age of the state..
Maybe the state didn't get cleared when you tried to clear it, are you saying you actually rebooted pfsense?
-
@johnpoz No I didn't reboot pfSense. I went to Diagnostics / States / Reset States and checked the box to reset the firewall state table and then the reset button.
I haven't seen either of the two IPs that were attacking me for a while now. Maybe it's working or maybe they've just gone away for a while. Over they past few weeks they'll hit me with repeated attempts and then go away for a bit then come back again. Sometimes it's hours. Sometimes it's days. USUALLY when I enter their IP into the Badguys list they aren't able to get through starting right away. That's why these two caught my attention when they were still getting in.
Of course the mail server blocks them after a bit but they can sure slow things down with all their attempts.
-
@cdsjerry Are you positive the IP address in question is actually in the Badguys5 alias? See Diagnostics > Tables and check the actual contents table/alias in question.
You can also do this in Diagnostics > Command prompt:
pfctl -vvss | grep -A3 inter.esting.ip.addressThat will show you any matching states along with the firewall rule that passed the traffic when the state was created.
You can then
pfctl -vvsr | grep -A3 '^@RULENUMBER'to identify the rule. -
@derelict I'm sure that both examples I've been watching are in Badguys5. I've checked a dozen times or more just to make sure I didn't fat-finger it. I even copied / pasted it directly from the server log a couple of times. That's one thing I am sure of.
Our office is closed for the weekend (love / hate holidays). I'll try the commands when I get back but of course I'll need to wait until I also catch them hitting the server close enough to still be in the logs / states.
I know the mail server is blocking them so they aren't actually doing any harm other than slowing down the server or else I'd be in the office after-hours trying to solve this.
-
@cdsjerry said in Blocked IP reaching server anyway:
both examples I've been watching are in Badguys5
but you want to make sure its actually loaded in the table.. This is what he was mentioning. Just looking the alias doesn't mean its actually loaded in the table.
Under diagnostics - look under tables and make sure its loaded there and correct.
example of one of my aliases
