Bogons file from july 1-st contained google netblock

erkko

last time this was updated, 30-36 days ago, it used to contain such netblocks:

0.0.0.0/8
10.0.0.0/8
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.168.0.0/16
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4

file updated from crontab @ july 1:

-rw-r–r-- 1 root wheel 146 Jul 1 05:08 /etc/bogons

0.0.0.0/8
127.0.0.0/8
169.254.0.0/16
192.0.0.0/24
192.0.2.0/24
66.249.0.0/16 <<<<<<<< google has spiders @ 66.249.64.0/19
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4

and todays manual update produced again ok bogons file:

-rw-r--r-- 1 root wheel 132 Jul 20 20:13 /etc/bogons

0.0.0.0/8
127.0.0.0/8
169.254.0.0/16
192.0.0.0/24
192.0.2.0/24
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/4
240.0.0.0/4

does anyone have versions/backups of what has been served at http://files.pfsense.org/bogon-bn-nonagg.txt ?
did this data came originally from iana?
this fluke blocked effectively (and quietly, one might add) google from spidering our websites for 20 days and all of them lost their nice pagerank and moved wayyy deep in google search too :)

rgds,
e

cmb

It's pulled automatically from Cymru's bogon listing here. http://www.team-cymru.org/Services/Bogons/bogon-bn-nonagg.txt Their change log shows no updates since February, and checking 10 boxes that last updated the same as everyone's on July 1, none of them have that in there. No record of that ever being on the server. No idea how you could have gotten that there short of leaving your firewall open with a weak password and someone screwing with you.

erkko

indeed… 4 other pfsense machines had bogons file from same day and no such network in it.
no permanent long-lasting log to look for about webif/ssh accesses, just circular logs?

cmb

yeah not unless you're syslogging.

erkko

did not, fixed that now. changed passwords too everywhere, just in case. thanks man

PS. if someone else looks for webif access logs combined with remote syslog (perhaps that guy: http://forum.pfsense.org/index.php/topic,22171.msg113966.html)

/var/etc/lighty-webConfigurator.conf:
server.errorlog-use-syslog = "enable"
accesslog.use-syslog = "enable"
…restart lighttpd
plus log settings > remote logging etc

cmb

that's weird… good remedial actions, you may want to backup your config, check it for sanity, and wipe out and reinstall it if you don't really trust it and restore the validated config.

erkko

37 days old install. but nevertheless, old config along with old password was indeed restored when this fw replaced old one. will go over the conf with finetooth comb.