Temporarily block IP?
-
pfSense needs to have a way to temporarily block an IP.
In the firewall logs, you can add an IP to block in the EasyRule by clicking on the - sign, but it goes into that alias permanently. Is there a way, SSH script, package, etc to make that only last an hour or two?
-
Afaik, 'pf' isn't 'iptables' (yet) so no module to add that learns the firewall to make 'rules with a count down' timer.
I'm just inventing that option just right now, maybe it doesn't even exist for iptables."Temporarily block IP?" : this means that the firewall rule set has to be reloaded with "modified" rule(s) as soon as this timer (your one hour) expires.
The good news : pfSense can apply rules based upon 'time'.
The bad news : it's somewhat tedious to set up a schedule just for "ones, one hour", and then create a rule that you attach to this time schedule so the firewall get reloaded when the time is "up"/"over".A "one click here and blast the IP from your firewall" button will need a timer rule/thing/scheduler, and a controlled 'reload rules again' when expired.
That's a lot of GUI glue ware (PHP script) for a simple button. -
@Gertjan It's something some enterprise firewalls can do. I was just wondering... it doesn't sound like it's feasible here.
-
@valnar curious on the use case - who/what are you looking to block? Personally if going to take the time block and ip or netblock.. It would be permanently.
I mean I can kind of see failtoban for ssh, some user typo's their password a few times or something. But to be honest shouldn't even be allowing password auth these days ;) should be public key only.
-
@johnpoz People scanning open ports, which are probably not their static IP. Reducing log clutter when it happens. Someone actively hitting one of my open services (which are secure, sure...but still!).
This kind of functionality is used all the time in Palo Alto, CheckPoint, etc, albeit a bit more automated in conjunction with their IPS modules.
-
@valnar Snort/Suricata in the default legacy blocking mode has a timer on all blocks, and would probably pick up whatever the scan is based on the configuration.
-
At another level, servers in our data center use fail2ban or similar to also flag and block by IP.
-
@valnar said in Temporarily block IP?:
People scanning open ports, which are probably not their static IP
So your saying someone is scanning you from IP X, but then say tmrw some other user has that IP and would have legit reason to access your resources?
I try and block all known scanners, this is perm ban - sorry there is never going to be a valid user coming from say shodan servers, or for that matter digital ocean. If I found some IP scanning my ports.. And I didn't want them doing that I would just block them.. Find it highly unlikely a user of my services would be doing that, or would somehow get that IP at a later date.. If so - they should contact me that they can not access something.
Now sure this would be different when serving services to a large public amount of users.. Have you looked to who owns these IPs that are scanning you? Is it from some isp ip space that you have valid users in? Or is it some IP or ASN from cdn or vpn or hosting service - why would you ever have valid users using those IPs?
Now sure if some isp in a country you do business or want to provide resources to has an IP scanning you - blocking the whole isp netblock or asn could be problematic - but a single IP or 2, what are thee odds some valid user would end up with that IP sometime in the future? That wants to access your resource(s).
-
@johnpoz I was just asking if it was possible. I realize permaban is fine too. I do block known scanners with pfBlockerNG lists.
Other firewalls have this feature so was curious.
The benefit? I don't have a (manual) static list that grows for years on end.
-
@valnar yeah sure they have the feature - is it pretty much a useless feature, that too ;)
I see little point in dynamically blocking someone just to open them up again after X amount of time. Once a bad IP, always a bad IP ;)
But as mentioned you could prob run IPS to do that.. But now a days any exposed service is encrypted - and ips is of little use unless its seeing in the clear stuff.. Other than for a port scan sort of block.
But pretty sure you could do something like what your asking with one if not both of the IPS packages you could install.. Or maybe with crowdsec - pretty sure have seen methods of installing that, I wouldn't suggest that until its an actual approved pfsense package.
But always away to skin the cat. Pretty sure have seen some people using fail2ban and scripts that block and then unblock via adding an ip to alias, and then later removing the alias, etc.
Personally just seems all a bit pointless as a security stance.
-
@valnar Considering that pfSense is just software on top of an open operating system, it's definitely feasible. It just depends on how much time & effort you're willing to put into it to create your solution yourself. Others have already mentioned Snort/Suricata which works but seems like overkill to me. I don't spend any time worrying about doorknob-rattlers. I trust my door is secure and locked.
Privacy Policy · Cookie Policy