Firewall not blocking port access?
-
The only port forwarding I have open is to 192.168.3.12 I do have port 80 and port 443 forwarded to 192.168.3.12. What I am not understanding is how am I even seeing anything going to 192.168.3.2? I would think the firewall would block that? I have nothing at 192.168.3.2
-
@xokia Those would be responses from the web server to that device.
-
Where do you have Suricata running: WAN or LAN interface?
If WAN, Suricata sits out in front of the firewall and thus sees inbound traffic before any firewall rules have been applied. This is one reason I recommend running Suricata on internal interfaces and not on the WAN. It will be checking and blocking traffic the subsequent firewall rules are going to block anyway, so you are doing double work for no benefit. Check out these diagrams to see how Suricata is plumbed in pfSense:
-
I have Snort running on my local LAN.
This is actually a durp moment. I had assigned a static IP to my local desktop because I was accessing a new managed switch I purchased to set the switch up for my network. I forgot to switch the desktop IP back. So while I was saying nothing existed at 192.168.3.2 it was actually the machine I was using to access everything. So False alarm.