Ipguard package



  • I really liked the idea on this package.. but somehow, even if I add the mac-ip pairs, still ipguard gives the machine a de:ad mac address.. lotsa flipflops..
    any idea on this matter? is there any configuration should i worried about? oh im
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.249 f4:6d:4:6d:ff:c3 (de:ad:96:87:d0:9e)
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.215 de:ad:36:87:f7:6c (de:ad:96:87:d0:9e)
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.33 de:ad:36:87:f7:6c (de:ad:96:87:d0:9e)
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.215 de:ad:96:87:d0:9e (de:ad:36:87:f7:6c)
    Aug 29 20:47:34 isfw arpwatch: reused old ethernet address 192.168.100.215 50:e5:49:a6:c9:64 (de:ad:96:87:d0:9e)
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.215 de:ad:36:87:f7:6c (de:ad:96:87:d0:9e)
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.33 de:ad:36:87:f7:6c (de:ad:96:87:d0:9e)
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.215 de:ad:96:87:d0:9e (de:ad:36:87:f7:6c)
    Aug 29 20:47:34 isfw arpwatch: reused old ethernet address 192.168.100.215 50:e5:49:a6:c9:64 (de:ad:96:87:d0:9e)
    Aug 29 20:47:34 isfw arpwatch: reused old ethernet address 192.168.100.249 de:ad:36:87:f7:6c (f4:6d:4:6d:ff:c3)
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.249 f4:6d:4:6d:ff:c3 (de:ad:36:87:f7:6c)
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.215 de:ad:96:87:d0:9e (50:e5:49:a6:c9:64)
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.215 50:e5:49:a6:c9:64 (de:ad:96:87:d0:9e)
    Aug 29 20:47:34 isfw arpwatch: flip flop 192.168.100.38 de:ad:96:87:d0:9e (de:ad:36:87:f7:6c)



  • For the flipflops, I have a systen with wireless bridges that mess with MAC addresses (ARP-NAT?) I see this on wireless clients hopping from one bridge to another. Are you running anything like that?



  • i dont have any wireless on my network, flipflops only appear when i turn ipguard to ON. dont know why it didnt recognize the mac-ip pairs defined on the ether file.



  • @rjcrowder:

    I've gotta be doing something wrong… I can't seem to get Ipguard working for what I want. This is what is in my /usr/local/etc/ipguard_lan.conf

    00:e0:52:c2:e0:c4 192.168.5.1 pfsense LAN interface
    00:25:ae:28:38:a9 192.168.5.200 XBox-Wired
    00:0d:4b:bd:d1:61 192.168.5.201 roku-basement
    00:0d:4b:df:c1:3d 192.168.5.202 roku-den
    cc:6d:a0:1f:a5:11 192.168.5.203 roku-family-rm
    00:0d:4b:e8:1e:59 192.168.5.204 roku-master-bdrm
    00:13:72:98:dc:2b 192.168.5.205 rjc-nas
    00:22:58:7b:85:97 192.168.5.206 Brother-MFC-J430W
    00:00:00:00:00:00 192.168.5.0/24 lan net

    I'm trying to set it up so that no MAC other than those listed above can use the 200-207 IP addresses on my network and get out to the internet - but to no avail. I can set my laptop to 206 address (Brother-MFC-J430W listed above) and it seems to have no affect whatsoever. I can browse the internet, etc. What am I doing wrong?

    Additional info about my setup... I'm using Squid and Dansguardian. The reason I'm trying to stop other MAC's from taking the 200-207 addresses is that 192.168.5.200/29 is allowed out without going through Dans (I have firewall rules that block all other addresses from hitting the internet directly).

    Thanks for any help!

    I ended up solving my problem by writing a little shell script that executes tcpdump looking for packets with sources range 192.168.5.200/29. It then compares the MAC address on each packet to a list of valid MAC/IP pairs. If a mismatch is found, it shuts down the WAN interface (assumption being a rogue MAC has taken one of my unfiltered IP addresses)! A little draconian, but effective. Added a startup/shutdown script for it and it accomplishes what I want…

    However - I thought I could accomplish the same thing with ipguard... can anyone tell me? Thanks!



  • Bump…

    Not a big deal because I got it working with the tcpdump shell script, but I'm still wondering if my use case was valid for ipguard? i.e. should I be able to make ipguard work to block invalid mac/ip combos from accessing the internet?

    Anyone? Thanks...



  • try to reduce your network range on your allow list and move pfsense ip to 254 for example.

    00:e0:52:c2:e0:c4 192.168.5.254 pfsense LAN interface
    .
    .
    .
    00:00:00:00:00:00 192.168.5.0/25 lan net



  • OK… seems like I tried that, but I will play around with it some more... Before I do though, I just want to confirm. What I'm trying to do is what ipguard was intended to accomplish? i.e. make sure that ip/mac combinations (or ranges) are valid and keep invalid combos from accessing network resources?

    Also (again I'll play more to confirm) I turned on the verbose logging and from what I could tell, it appeared that ipguard was catching the invalid mac/ip combination and returning the bogus mac address on the ARP request/reply. However, everything still worked for the IP address involved. It shouldn't... correct?

    Thanks again...



  • On my tests, it was easier to lost access to pfsense then full access.

    Maybe your 00:00:00:00:00:00 192.168.5.0/24 ipguard lan net rule permits all lan access.



  • This package seems to not work correctly with: 2.1-BETA0 (amd64).

    After installing the package there is no addition of Ipguard to the services drop down menu.



  • It's on firewall menu  ;)

    I'm not sure if I tested it's dirs and pbi install on 2.1



  • I have ipguard-dev installed on 2.1-BETA0. It puts a link to its exe into /usr/local/sbin, so the package startup code works fine as is.

    [2.1-BETA0][root@pfsense.localdomain]/(8): ls -l /usr/local/sbin/ipguard
    lrwxr-xr-x  1 root  wheel  35 Oct  8 19:06 /usr/local/sbin/ipguard -> /usr/pbi/ipguard-i386/.sbin/ipguard
    
    

    The 2.1, FreeBSD 8.3, pbi-based package version is working.



  • I'll include pfsense 2.1 folder check as soon as possible…



  • @marcelloc - I don't think any folder/version checks are needed. The PBI installation puts the link to the exe in /usr/local/sbin already - so running /usr/local/sbin/ipguard works on 2.1. The conf file goes in /usr/local/etc fine. I think it all works out of the same folders in 2.0.1 and 2.1.



  • @phil.davis:

    I think it all works out of the same folders in 2.0.1 and 2.1.

    good! Thank's for the info. :)



  • i installed ipguard on pfsense 2.01 32bit, when i click on the start button in the Services menu it just doesnt start. There is a message saying it started but in the menu it keeps being stopped. Is there a way to start it manually (command line) or see the logs for when a service start?



  • Check your config first and save settings. Then go to console and check if its running with "PS ax "



  • nope not running

    EDIT:I accessed pfsense in ssh and when I try to launch ip guard it says this:

    /libexec/ld-elf.so.1: Shared object "libpcap.so.1" not found, required by "ipguard"



  • what version of pfsense are you running?



  • 2.0.1-RELEASE (i386)
    i fixed this issue by installing snort, which installed the missing dependencies but now i've got another problem
    in /var/log/ipguard_fxp0.log i get:
    error pcap_open_live(): fxp0: No such device exists (BIOCSETIF failed: Device not configured)



  • I've tested this package without snort without issues, I'll try it again on virtual lab.



  • Hey there guys,

    Here's the problem I'm running into and I'm hoping ipguard can turn the trick….

    I have a wifi client who for whatever reason is always trying to set a static IP that conflicts with an ip address in my static range, which causes temporary problems from time to time.

    I'd like to make sure that these addresses are not in conflict in situations like this.  Since my static devices are all known and well documented, would the correct approach be to enter them all in ipguard, thereby (hopefully, I think?) ensuring that no other mac address can inadvertently obtain access to my LAN (wifi) using a reserved, static ip?

    ???



  • Sure, ipguard can help.

    Did you tried static mapping on pfSense dhcp+ Deny unknown clients?



  • @marcelloc:

    Surge, ipguard can help.

    Did you tried static mapping on pfSense dhcp+ Deny unknown clients?

    No, and here's why:  I run a WISP and I don't want to deny unknown clients.  They can sign up online thru the captive portal and that's $$  ;D

    However, I did try mapping it to an IP address, but pfSense tells me that I can't do that inside of the dynamic IP range…..  which seems silly, actually.



  • Dear marcelloc,

    i did download the ipguard last week and installed it on my pfsense 2.0.1 (amd64)
    however, the services didnt run even i tried to start it manually
    then a few days later i remove it back because i thought there was an error while it was installed
    somehow, i cant find it again from the "packages" list, did you remove it?
    how can i use this good features? im ran a wisp as well and i hope that i dont need to deny unknown clients  ;)
    waiting for your kind reply

    thanks
    cleancodex



  • cleancodex,

    check on installed packages tab, I did not removed the service.

    There is a depedencie that is not included on this package yet.

    you need to install libcap first. You can do this using pkg_add from freebsd repo or installing snort package before ipguard.

    I'll try to fix it as soon as possible.



  • hello all,
    there is prblm wth pfsense , installed ipguard-dev but in services status it shows not started , i go to firewall select ipguard, check to enable this rule , create a rule but still nothing happens … wht shuld i do next ???



  • same prblm faced



  • is this package done with dependencies?



  • @z3r0tech:

    is this package done with dependencies?

    not yet. still need manual fix.



  • @marcelloc:

    @z3r0tech:

    is this package done with dependencies?

    not yet. still need manual fix.

    thanks, what are the dependencies needed for this package? i'm gonna test this and install manually all the dependencies first…



  • @z3r0tech:

    thanks, what are the dependencies needed for this package? i'm gonna test this and install manually all the dependencies first…

    try just lippcap if it works, I'll push a fix to install process on 2.0.x.

    amd64
    http://files.pfsense.org/packages/amd64/8/All/libpcap-1.3.0.tbz

    i386
    http://files.pfsense.org/packages/8/All/libpcap-1.3.0.tbz



  • thanks! will test later and post results…



  • very Thx For who made this package alive :) AND THX FOR PFSENSE ITS FREEEEEEEEEEEE :) AND VERY HELPFUL :)



  • about the libipcap: its there on 2.0.x: /lib/libpcap.so.7
    I have linked /lib/libpcap.so.7 to /lib/libpcap.so.1 and the binary from the v0.1 package is happy.
    so, you can either create the link when you install the package or compile the bin to use /lib/libpcap.so.7

    there are some issues with the webgui: sorting (moving things up or down) is not permanent and there are empty entries shown for previously deleted mac/ip address sets.
    otherwise, nice package! I hope it's still being worked on. :)



  • two more things I would like to suggest:

    1. drop root privileges (add '-s nobody' to the startup parameters).
    2. don't use '-u 300', instead send SIGHUP to the process to reload the config when the user clicks save.


  • I'll take a look on it as soon as time permits.



  • Hi,

    I have a problem with ipguard. I guess it is not working with DHCP. In my network, I have allocated IP addresses for WIFI clients ranging from 172.16.4.150-172.16.4.250 but when I run ipguard, wifi users can't obtain IP addresses. Can anyone help me please. Thanks.



  • Hello there,
    I'm Using Ip guard on my pfsense captive portal to to restricted user for change ip address, here's my scenario :

    –----------------------------------------------------------------------------------------------------------------------------------------------------------

    Internet ----------WAN (20.20.20.221/24)* pfsense (captive portal + Ipguard)*LAN (192.168.1.1/24) ---------------- client PC

    My ipguard rule :

    on wan 00:0c:29:ed:61:11 20.20.20.221 Pfsense WAN Interface
    on lan 00:0c:29:ed:63:1e 192.168.1.1 Pfsense LAN Interface
    on wan 00:00:00:00:00:00 20.20.20.0/24 WAN Net
    on lan 1c:65:9d:b9:4f:f5 192.168.1.90 PC Manager

    another my firewall rules:

    allow LAN & WAN to any rule

    I'm using dhcp client for another client, and mapping dchp static for special client


    my purpose is to block another client with dhcp to using PC manager Ip Address using static IP on 192.168.1.90

    the problem that i face is another user using dhcp client can use the PC manager Ip address with changing their ip address to static and using PC Manager Ip Address.

    How can I can create best ip guard rule with this situation?
    can anyone hel me. Thanks



  • Ipguard is great! Tried it yesterday and is really what I was looking for. I have a suggestion though. Say I have a network client that I want to restrict to a single IP but I want everyone else to get IP through DHCP on the same subnet. It would be nice if overlapping rules were supported and followed priorities. Example:

    00:00:00:00:00:00    192.168.0.0/24    Everyone is able to get any IP in this subnet
    00:0c:29:ed:61:11    192.168.0.150    This computer can only get this IP. So this rule has a higher priority than the first one.

    I tried configuring that way and it didn't work.

    As an alternate scenario I could try to register every single client's mac address but it really is a big annoyance. Hope the above could work.



  • @axaios:

    Ipguard is great! Tried it yesterday and is really what I was looking for.

    I was hoping you could describe what you are doing with it. I've tried using if several times and have never been able to get it to work the way I expect - I ended up creating custom IPFW rules…

    What I want:
      1.) allow dhcp to assign dynamic IP addresses (i.e. not turn on feature to deny unknown clients).
      2.) block all network access for any client that uses a statically assigned IP address.

    For example, my XBox gets a statically assigned address. If another mac tries to use the same IP address, I want to block them from the network. Is this possible? When I've tried this with IPguard (by adding the mac and IP of the XBox), the second client (stealing the XBox address) seems to work just fine.


Log in to reply