Snort Blocking WAN IP address
-
I'm running the following versions
pfSense: 2.0 Beta5 build from Thu Feb 17 02:14:25 EST 2011
snort package: 2.8.6.1 pkg v. 1.35I'm also running Squid as a transparent proxy and the WAN IP address keeps getting blocked b/c of alerts on "(http_inspect) NON-RFC DEFINED CHAR".
Looking at /usr/local/etc/snort/whitelist/ the appropriate networks and ip addresses are in the defaultwlist as well as a custom list that I created. But the IP is still getting blocked. Is this a bug or a configuration problem?
Thanks,
David -
I am having the same problem. My WAN IP keeps getting blocked for various alerts even though it is white listed.
-
I had the same thing, WAN was blocked after a while, so looking at the alerts i found the ping to my ISP was causing that. I disabled all ping-entries at snort and it works now. I excluded before the ping(reply) to/from ISP, whitelisted the whole WAN-IP-range from ISP, but without any change. Hope that helps.
-
What alert was the pings from your ISP triggering? The thing that's causing my problems is a http pre-process filter alert.
–
David -
This ones:
229 3 ICMP ICMP PING Misc activity My_IP empty -> ISP_IP empty 1:384:5 03/03-14:17:25 230 3 ICMP ICMP Echo Reply Misc activity ISP_IP empty -> My_IP empty 1:408:5 03/03-14:17:24
-
Hmm that's different than the alert I was getting. I haven't had much time lately to look into this more. For now I just have snort set to log alerts but not block.
–
David