Snort Blocking WAN IP address



  • I'm running the following versions
      pfSense: 2.0 Beta5 build from Thu Feb 17 02:14:25 EST 2011
      snort package: 2.8.6.1 pkg v. 1.35

    I'm also running Squid as a transparent proxy and the WAN IP address keeps getting blocked b/c of alerts on "(http_inspect) NON-RFC DEFINED CHAR".

    Looking at /usr/local/etc/snort/whitelist/ the appropriate networks and ip addresses are in the defaultwlist as well as a custom list that I created.  But the IP is still getting blocked.  Is this a bug or a configuration problem?

    Thanks,
    David



  • I am having the same problem.  My WAN IP keeps getting blocked for various alerts even though it is white listed.



  • I had the same thing, WAN was blocked after a while, so looking at the alerts i found the ping to my ISP was causing that. I disabled all ping-entries at snort and it works now. I excluded before the ping(reply) to/from ISP, whitelisted the whole WAN-IP-range from ISP, but without any change. Hope that helps.



  • What alert was the pings from your ISP triggering?  The thing that's causing my problems is a http pre-process filter alert.

    David



  • This ones:

    229	3	ICMP	ICMP PING	 Misc activity	My_IP	empty	->	ISP_IP	empty	1:384:5	03/03-14:17:25
    230	3	ICMP	ICMP Echo Reply	 Misc activity	ISP_IP	empty	->	My_IP	empty	1:408:5	03/03-14:17:24
    


  • Hmm that's different than the alert I was getting.  I haven't had much time lately to look into this more.  For now I just have snort set to log alerts but not block.

    David


Log in to reply