Snort Blocking WAN IP address

3dinfluence

I'm running the following versions
pfSense: 2.0 Beta5 build from Thu Feb 17 02:14:25 EST 2011
snort package: 2.8.6.1 pkg v. 1.35

I'm also running Squid as a transparent proxy and the WAN IP address keeps getting blocked b/c of alerts on "(http_inspect) NON-RFC DEFINED CHAR".

Looking at /usr/local/etc/snort/whitelist/ the appropriate networks and ip addresses are in the defaultwlist as well as a custom list that I created. But the IP is still getting blocked. Is this a bug or a configuration problem?

Thanks,
David

piperfect

I am having the same problem. My WAN IP keeps getting blocked for various alerts even though it is white listed.

_igor_

I had the same thing, WAN was blocked after a while, so looking at the alerts i found the ping to my ISP was causing that. I disabled all ping-entries at snort and it works now. I excluded before the ping(reply) to/from ISP, whitelisted the whole WAN-IP-range from ISP, but without any change. Hope that helps.

3dinfluence

What alert was the pings from your ISP triggering? The thing that's causing my problems is a http pre-process filter alert.
–
David

_igor_

This ones:

229	3	ICMP	ICMP PING	 Misc activity	My_IP	empty	->	ISP_IP	empty	1:384:5	03/03-14:17:25
230	3	ICMP	ICMP Echo Reply	 Misc activity	ISP_IP	empty	->	My_IP	empty	1:408:5	03/03-14:17:24

3dinfluence

Hmm that's different than the alert I was getting. I haven't had much time lately to look into this more. For now I just have snort set to log alerts but not block.
–
David