Taming the beasts… aka suricata blueprint

Sorry about that floating rule, I later added the giant red warning. The floating rule should only apply to the pfsense's ports, and that shouldn't block any other traffic.

As far as the lists go, it's near the end of the script. There are instructions in the script to enable/disable the lists. Enabling a list is usually removing the # in front of the line containing the list.

Mr. Jingles

:'( :-[ ???

( >:( )

How on earth can this be possible? I even logged out and logged in again. Where on earth does it get this directory from?

It is not difficult to remain the eternal noob when this happens ( ;D >:( )

[b]EDIT: it appears it hadn't saved the first: userfolder=/home/badips

Probably because I had the file open in both WinSCP and via the Diagnostics/edit file. I saved it in the latter, but apparently since it was also open in WinSCP it didn't tell me it couldn't write but simply said nothing.

pfsense_pfiprep.jpg_thumb

Mr. Jingles

@jflsakfja:

Sorry about that floating rule, I later added the giant red warning. The floating rule should only apply to the pfsense's ports, and that shouldn't block any other traffic.

As far as the lists go, it's near the end of the script. There are instructions in the script to enable/disable the lists. Enabling a list is usually removing the # in front of the line containing the list.

Thanks Jflsakfja ;D

Next up Floating tab:
Set up a rule but make these changes:

| Action | Block |
| Quick | TICKED!!! |
| Interface | Hold CTRL and click on all interfaces EXCEPT LAN(admin) and SYNC |
| Direction | any |
| Source | any |
| Destination | any |

DON'T CHANGE DESTINATION PORT RANGE!!!

So when I add new floating rule, the above reads to block any source, any direction, to any destination (I left the ports to 'other', which is the default when I created a new floating rule, so I didn't change it per the red text), effectively blocking all LAN out (I think, at least when I disabled the rule I had internet access again).

Remember: eternal noobs will be eternal noobs ;D

Re-reading it does make sense on why it blocked out traffic. I meant to say create a new floating rule, based on the previous allow rule, but this time around change the pass to a block, keeping the destination ports the same.

A)1 normal pass rule for the ports active on the interface you want to administer pfsense from.

B)1 floating rule block rule for ALL interfaces EXCEPT the one you want to administer pfsense from.

Both rules should have their destination as the alias for pfsense's ports. The allow rule well, obviously allows traffic to those ports on your admin (LAN?) interface, but the floating rule should block all traffic for those ports, on each and every >other< interface.

I don't have access to a pfsense system since I'm out of town for the weekend, one can only post so much from memory :p.

Mr. Jingles

@BBcan177:

I have been working on a script

As I am working my way down this thread on the instructions I arrived at your script: thank you very much for creating it ;D

I only understand 10% of what it does (given my eternal noob status), but I do know that this is quite some work. My hero-list on this board keeps on getting bigger, I just added you to it as well ;D

Thank you & bye,

Mr. Jingles

@jflsakfja:

Re-reading it does make sense on why it blocked out traffic. I meant to say create a new floating rule, based on the previous allow rule, but this time around change the pass to a block, keeping the destination ports the same.

A)1 normal pass rule for the ports active on the interface you want to administer pfsense from.

B)1 floating rule block rule for ALL interfaces EXCEPT the one you want to administer pfsense from.

Both rules should have their destination as the alias for pfsense's ports. The allow rule well, obviously allows traffic to those ports on your admin (LAN?) interface, but the floating rule should block all traffic for those ports, on each and every >other< interface.

I don't have access to a pfsense system since I'm out of town for the weekend, one can only post so much from memory :p.

Thank you Jfl :P

BBcan177

I came across this site "infragard" https://www.infragard.org/node

InfraGard is a partnership between the FBI and the private sector.
It is an association of persons who represent businesses, academic institutions,
state and local law enforcement agencies, and other participants dedicated to
sharing information and intelligence to prevent hostile acts against the U.S.

Unfortunately, you need to give them your first born to gain access to their Files.

However, I have come across their most recent data, which can be viewed with these links:

https://publicintelligence.net/fbi-cyber-targeting-gov-networks/
https://publicintelligence.net/siac-cryptowall/
https://publicintelligence.net/fbi-blackshades-bulletins/
http://www.eventtracker.com/support/knowledge-update-et75asig-001/

As these are static Blocklists, I have added the option in the pfIP Rep Script to download
these files once only. (Setting the schedule to "$sch0), should the download fail, you can set
the schedule to "$sch1" and run it and set it back to "$sch0" after it completes.

Two of the links are for domain blocking, this info could be used for Squid or dns sinkholes.

I have also updated the pfIP_Reputation.widget.php to include a "Ack" Acknowledge button to clear any previous "FAIL" Downloads. This will just edit the Daily.log from "FAIL" to "Fail", so you can still review the Daily.log for trending issues with downloading.

Here is a screenshot of the widget

And the link to my GIST for the pfIP_Reputation2.widget.php
https://gist.github.com/BBcan17/67e8c456cb399fbe02ee#file-pfip_reputation2-widget-php

I Have updated the pf IP Reputation Manager Script to version 2.3.4

You can review the revisions in my GIST.

https://gist.github.com/BBcan17/67e8c456cb399fbe02ee

For pfiprep make the changes to your existing file or just overwrite and add your changes as required.

For pfiprepman, just backup the previous 2.3.2/3 version and replace with the latest 2.3.4 version.

Changes to pfiprep

Added the "FBI Suspicious Conus and Oconus Blocklists"
Added the "FBI Facebook FBUID Blocklist"
Added the "Suricata TOR Blocklist to the TOR Section"
INFO - OpenBL supports other Blocklist options that can be set.

Changes to pfiprepman
The Script also now supports extracting IP Blocklists from .XLSX files.

CountryCode Blocklists

With Cinos help, we have made some code improvements.
Added a "perl script - IPCALC" to convert the Ranges to CIDR
Found some other code changes

I recommend running

[ [b]./pfiprep killdb ] with version changes or [ [b] ./pfiprep killdb dskip ]

If you find any Bugs please let me know and I will promptly fix them.

BBcan177

@Hollander:

@BBcan177:

I have been working on a script

As I am working my way down this thread on the instructions I arrived at your script: thank you very much for creating it ;D

I only understand 10% of what it does (given my eternal noob status), but I do know that this is quite some work. My hero-list on this board keeps on getting bigger, I just added you to it as well ;D

Thank you & bye,

This is what Open Source is all about. We've all caught the bug and that's why we enjoy spending time helping each other to advance of Network Security.

In regards to your comments, Thanks, its was lots of work but the best part is when people actually use it. If you have any questions, let us know or send me a PM when you need more help. :o :o

I would recommend leaving most of the settings as is, and then change things after you get it working. I would use the default Group/Tiers instead of adding all of the individual Blocklist aliases.

If anything, this is good practice to learn how to use the shell and other parts of FreeBSD that you never knew existed or maybe never wanted to know ! 8)

Linda

@jflsakfja:

EDIT!!!! MISSED THE QUICK CHECKBOX. TICK THAT!

Now I am confused. In your initial post on creating floating rules using the aliases you indicate NOT to tick Quick.
So just to be sure: To Tick Or Not To Tick? ;)
And does this go for both inbound and outbound?

(BTW: thanks for all the time you put into this thread)

Cino

Tick the quick check box. This tells pfsense to process the rule right away. If its not ticked and let's say you have inbound port 80 opened,that rule would let traffic pass bypassing your floating block/reject rule

To explain the floating rules we need to examine the following examples:

A) 1 non-quick floating rule that blocks traffic to port 80 on interface wan
B) 1 normal (interface) rule that passes traffic to port 80 on interface wan

Floating rules get evaluated first from top to bottom
If the floating rule is NOT quick, then proceed with further matching against other rules
Interface rules get evaluated last from top to bottom

Going through the checklist above, tells us that a packet will first pass through the floating rule, where the rule does match, but is not the terminal match against it, so the packet will continue on until it reaches the terminal match, which is rule B. Although the floating rule says block, the packet will pass since that's the rule that matches it.

In the case that rule A is quick, the packet will immediately match that rule, which says block it, therefore it will be blocked.

Mr. Jingles

We got it working ;D

Half of my normal sites are blocked now :P

( ;D )

(For example: www.geenstijl.nl, the links to the movies in there, the pfSense firewall says the new floating rules block them).

We = WIFE + me. WIFE, since I suffer from brain damage due to an accident, after which I can't concentrate on things suddenly. Combine that with the eternal noob status, and you will understand why WIFE, the love of my life, sometimes has to step in to help me out.

(The brain is a miraculous thing, a thing stupid economists like me will never understand. Because: not only do I have some, what some people might consider, 'advanced' post-academical degrees, but all that knowledge stays available to me. It is just that new knowledge doesn't seem to be allowed in. Perhaps I have a pfSense firewall in my brain now. It would make sense, because then nothing gets through ;D ;D ).

I forgot: Cino, thank you very much for your valuable contributions also: the list is getting longer ;D

Thank you & bye,

I've been setting up multiple pfsenses based on my recommendations in this topic and never had a problem with them blocking legitimate sites (aside from FPs now and then). In particular, a CARP cluster that provides connectivity to a small datacenter that houses web hosting servers, email servers and co-located servers, and internet access to remote clients, rarely gets any false positives. Those false positives are dealt with as soon as possible, which can be seen on the github list, since I took the enable all rules, then start removing rules as they are encountered approach, as recommended in this topic.

There is a reason those sites are blocked. Maybe it's a misconfiguration issue, a suricata false positive, or maybe they are not so legitimate after all.

Mr. Jingles

@jflsakfja:

To explain the floating rules we need to examine the following examples:

A) 1 non-quick floating rule that blocks traffic to port 80 on interface wan
B) 1 normal (interface) rule that passes traffic to port 80 on interface wan

Floating rules get evaluated first from top to bottom

If the floating rule is NOT quick, then proceed with further matching against other rules

Interface rules get evaluated last from top to bottom

Going through the checklist above, tells us that a packet will first pass through the floating rule, where the rule does match, but is not the terminal match against it, so the packet will continue on until it reaches the terminal match, which is rule B. Although the floating rule says block, the packet will pass since that's the rule that matches it.

In the case that rule A is quick, the packet will immediately match that rule, which says block it, therefore it will be blocked.

One of my ever frustrating frustrations (yaah :P ) with the floating rules was that I never understood them. I think your explanation is very clear, so for the zillionth time: thank you, Jfl ;D

What remains is one little question: the source versus destination. You will have to set the rules twice, yes (?) because of the source versus destination difference: suppose you have multiple WAN and multiple LAN (as I do), in order to block connections from and to a specific IP you will have to set two floating rules: 1 for all WAN's where source is the aforementioned IP, and a second floating rule for all LAN's where the destination is the aforementioned IP.

I ask because in many posts (in this forum) as well as 'tutorials' on the internets it is said you only need one floating rule, and I never understood that since it depends on whether traffic is coming from the source or from the destination.

Brains: mysterious things ;D

Mr. Jingles

@jflsakfja:

I've been setting up multiple pfsenses based on my recommendations in this topic and never had a problem with them blocking legitimate sites (aside from FPs now and then). In particular, a CARP cluster that provides connectivity to a small datacenter that houses web hosting servers, email servers and co-located servers, and internet access to remote clients, rarely gets any false positives. Those false positives are dealt with as soon as possible, which can be seen on the github list, since I took the enable all rules, then start removing rules as they are encountered approach, as recommended in this topic.

There is a reason those sites are blocked. Maybe it's a misconfiguration issue, a suricata false positive, or maybe they are not so legitimate after all.

I trust your judgements and knowledge completely, Jfl, you know that; more researching for me to do ;D

BBcan177

ping www.geenstijl.nl

PING www.geenstijl.nl (162.159.255.153): 56 data bytes

(Look at the Original Download Files)
grep "162.159.255.153" /home/USER/orig/*

/home/USER/orig/ET_IPrep.txt:162.159.255.81,15,127
/home/USER/orig/ET_IPrep.txt:162.159.255.81,24,103
/home/USER/orig/ET_IPrep.txt:162.159.255.219,27,55
/home/USER/orig/ET_IPrep.txt:162.159.255.5,27,109

(Look at the final pf Folder files)
grep "^162.159.255." /home/USER/pf/*

/home/USER/pf/ET_IPrep.txt:162.159.255.81
/home/USER/pf/e_tfakeav:162.159.255.81

(Look at the pfSense AliasTable Folder)
grep "^162.159.255." /usr/local/www/aliastables/*

/usr/local/www/aliastables/IR_PRI1:162.159.255.81

I am using the Emerging Threats IQRisk Blocklist, so that is the only list that I see that has any IPs in that Range.

I don't believe you are using that list, so not sure which list had that IP. And there is ony 4 IPs listed which is below the threshold of "5" and so it didn't block the whole range.

Atleast you can see that this range has some malicious activity (FakeAv)

Yes, that's why I recommended setting up pairs for floating rules for the list's aliases.

A source rule says the source should be matched. Since it's "them" that send packets to "us" on our wan type interfaces, we should set up the wan side rules to perform their match against the source (list alias). These rules should be block (don't answer the door saying I will not talk to you).

A destination rule says the destination should be matched. Since it's "us" that send packets to "them" on our lan type interfaces, we should set up the lan side (or dmz, or any other internal interface) rules to match based on the destination. Matching against the source will never give a match, since the source is "us". These rules should be reject (answer the door to our internal client saying "You are not allowed to talk to that") so that browsing to a non-legitimate site doesn't take 2 minutes to time out.

@BBcan177:

ping www.geenstijl.nl

PING www.geenstijl.nl (162.159.255.153): 56 data bytes

(Look at the Original Download Files)
grep "162.159.255.153" /home/USER/orig/*

/home/USER/orig/ET_IPrep.txt:162.159.255.81,15,127
/home/USER/orig/ET_IPrep.txt:162.159.255.81,24,103
/home/USER/orig/ET_IPrep.txt:162.159.255.219,27,55
/home/USER/orig/ET_IPrep.txt:162.159.255.5,27,109

(Look at the final pf Folder files)
grep "^162.159.255." /home/USER/pf/*

/home/USER/pf/ET_IPrep.txt:162.159.255.81
/home/USER/pf/e_tfakeav:162.159.255.81

(Look at the pfSense AliasTable Folder)
grep "^162.159.255." /usr/local/www/aliastables/*

/usr/local/www/aliastables/IR_PRI1:162.159.255.81

I am using the Emerging Threats IQRisk Blocklist, so that is the only list that I see that has any IPs in that Range.

I don't believe you are using that list, so not sure which list had that IP. And there is ony 4 IPs listed which is below the threshold of "5" and so it didn't block the whole range.

Atleast you can see that this range has some malicious activity (FakeAv)

IP 162.159.255.153 belongs to cloudflare. Since cloudflare is a CDN (Content Distribution Network) some other site might have used that IP to perform some nefarious act, therefore the IP got listed on one of the lists. Ideally cloudflare will deal with it and the IP will eventually be removed from the list. My only explanation as to why traffic to that IP is blocked.

BBcan177

F*** cloudflare… I have been blocking SPAM from their Network for two weeks now. Everyday its getting past all of the Blocklists, Snort, and my Mail Servers Mail Spam protection. FRESH Spam I guess. I send all of the mail that makes it past my Security Systems to SPAMCOP and hopefully they add it to the list of IPs to Ban.

Re-read my post, "ideally" is the key word ;)

Dealing with abuse (or spam) reports is an activity I don't look forward to. In particular my country's ISPs seem to think they invented the Internet, and all (without ANY exception) do NOT respond to abuse reports merely thinking out loud "Who the F**** are you to tell us our job!?!?!". Hell I've had to deal with a 15month DoS attack, until I had to scream at my upstream's "Head of Technical Department" (a complete and utter idiot, of the variety that no matter how many you seem to get rid of, a thousand more pop up for each one) to add the single IP to their ACL (a NON existent ACL until I forced them to implement it).

The attacker's upstream's response to my constant abuse reports was drum-roll…. they changed his IP. I got a brain aneurysm when they told me that. I thought my upstream's idiotic technical department was the lowest you could go, but apparently there are "innovators" all over the place.

Don't want to name and shame anyone, since there are "innovators" all over the place, even in the justice system, that would think those comments were "libelous" ;)

A small tip to ISPs. If I bother to write an official abuse report to you, citing logs, then that means I'm fed up with your client/system. Do something about it, or consider a career change and let us, that know how to do your job, do it.