PfBlockerNG
-
2. Alerts Tab Improvements. I have also added a "Filter Regex" which will allow you to filter the Alerts better. Please use a "regex-style" search pattern.
Thanks for that.
Alerts tab as a whole is noticeably faster on system with (and even without) larger then default 500k logs.Filter options is a welcomed addition.
-
I'm using the Suppress List feature. However, it has an inconvenience: I wanted to "unlist" some allowed IPs, so I deleted them from the pfBlockerNGSuppress Alias, but the widget always reports them as suppressed :(
Run a "Force Update" and it will update the suppression count but the IPs you un-suppressed will not be restored until the next "Cron" event. You also have the choice of a "Force Reload" which will reload all previously downloaded lists to reflect the current settings.
I did that, nothing happens. Even rebooted pfSense without result.
Can you be a little more specific? You had IPs in the pfBlockerNGSuppress alias.. You removed one or more IPs. Then what happened? or not happened?
When you say "the widget always shows them as suppressed", are you saying the the Supp: xx count doesn't match the number of IPs in the Suppress Alias?
What is the Supp Count, and how many IPs are in the alias? Also can you view the file
/var/db/pfblockerng/pfbsuppression.txt
and see how that compares to the IPs in the Alias?
From what I understand, you are referring to "Suppression" with the "+" icon, and not a WhiteList Alias as those are two different things.
-
BBcan177 - first I'd like to say a personal thank you for your efforts.
So far so good with the block lists but one thing that is perplexing me in the alert logs is a random alert that has been generated a few times over a 24 hour period. It's the only one detected outbound from my LAN interface. The rule being triggered links to a blacklist that I am using from infiltrated.net. In the list column it shows "No Match". Can you explain what this means?
-
BBcan177 - first I'd like to say a personal thank you for your efforts.
Thanks! Just don't smite me.. Someone out there already has it out for me! :D
So far so good with the block lists but one thing that is perplexing me in the alert logs is a random alert that has been generated a few times over a 24 hour period.
If you make rule changes, this can re-order the Rule Numbers, and the logs can become out of sync. Clear the Firewall log and it should be fine after that!
-
Yeah, I need to make things clearer. You know what they say, "A picture is worth a 1,000 words.". Well attached is a screen cap of what I have.
Hi Bummer,
I finally realized why your Whitelist was placed above the Blocked Rules in the firewall even without changing the Rules order. Typically When you have permit Rules, you would change the Rules Order in the "General Tab" to have the Permit rules above the Block rules… But after looking at this picture, I see that your first rule is a "Permit" rule, so that is why its being placed above the Blocked Rules... It was just odd when I saw that in that Teamviewer session today.
-
I'm using the Suppress List feature. However, it has an inconvenience: I wanted to "unlist" some allowed IPs, so I deleted them from the pfBlockerNGSuppress Alias, but the widget always reports them as suppressed :(
Run a "Force Update" and it will update the suppression count but the IPs you un-suppressed will not be restored until the next "Cron" event. You also have the choice of a "Force Reload" which will reload all previously downloaded lists to reflect the current settings.
I did that, nothing happens. Even rebooted pfSense without result.
Can you be a little more specific? You had IPs in the pfBlockerNGSuppress alias.. You removed one or more IPs. Then what happened? or not happened?
When you say "the widget always shows them as suppressed", are you saying the the Supp: xx count doesn't match the number of IPs in the Suppress Alias?
What is the Supp Count, and how many IPs are in the alias? Also can you view the file
/var/db/pfblockerng/pfbsuppression.txtand see how that compares to the IPs in the Alias?
From what I understand, you are referring to "Suppression" with the "+" icon, and not a WhiteList Alias as those are two different things.
I had 12 IPs in the pfBlockerNGSuppress alias; then, I removed 10 of them. Committing a Force & Cron Update didn't do anything, so I decided to un-flag the "use Suppression" in the settings, commit changes via force Cron, then I enabled use Suppression again.
This resulted in 2 IPs left (so, it's OK until this step).Then I wanted to delete this 2 (last) IPs. I used the same procedure as above, but «the Supp: xx count doesn't match the number of IPs in the Suppress Alias» as you correctly wrote.
Now I simply deleted the pfBlockerNGSuppress alias, committed Force & Cron, and finally the last 2 IPs went away :)
-
Panz, I followed through your posts and tried to duplicate what you described. I couldn't do it. Worked as expected, have you had any more problems with this?
-
I deleted them from the pfBlockerNGSuppress Alias, but the widget always reports them as suppressed
Panz, I followed through your posts and tried to duplicate what you described. I couldn't do it. Worked as expected, have you had any more problems with this?
I could not duplicate this issue in my testing. If I delete an IP is the pfBlockerNGSuppress Alias and run a "Force Update" the widget gets updated accordingly. If I add an IP and "Force Update", it also updates accordingly. However, if you clear all the IPs in the Suppress Alias, and "Force Update", it doesn't clear the Count in the widget. I have a fix, but will add this to the next version, as its more cosmetic and does not affect the "Suppression" function.
-
Yes, I can duplicate this issue. It goes away if I manually delete the Alias.
-
Even after clearing the firewall logs this alert gets generated at 5:10am every day generating from my physical host windows box. From the system logs the only thing that I see running at that ungodly hour is the adobe flash updater. In the firewall logs there are 9 outbound attempts with my WAN address listed as the destination. I am using the reputation feature of pfBlockerNG but still can't figure out why my LAN IP of 192.168.1.200 would get blocked.
So far so good with the block lists but one thing that is perplexing me in the alert logs is a random alert that has been generated a few times over a 24 hour period.
If you make rule changes, this can re-order the Rule Numbers, and the logs can become out of sync. Clear the Firewall log and it should be fine after that!
-
The rule being triggered links to a blacklist that I am using from infiltrated.net. In the list column it shows "No Match". Can you explain what this means?
Hi Heisenberg1977,
I can't see the Destination IP as you have obfuscated it.
Try to run the one of the following commands from the shell or from the GUI Diagnostics:Command :
[ Using [b]1.2.3.4 as an IP, change it to reflect the IP that is in question ]
grep "^1.2.3." /var/db/aliastables/pfB_Infiltratednet.txt
or
grep "^1.2." /var/db/aliastables/pfB_Infiltratednet.txt
or
grep "^1." /var/db/aliastables/pfB_Infiltratednet.txtI assume that the IP being blocked is in a large CIDR that the Alerts tab is not matching. You will have to sift tru the output and see if you can find a match.
Note - you can also try changing the path/folder to the following if you have multiple Lists inside an Alias, as the /var/db/aliastables folder is a compilation of all the lists in an alias.
/var/db/pfblockerng/deny/*
or You can view the Aliastable in the Log Browser, and scroll tru the list to see what IP CIDR is the cause of the Block.
-
Yes, I can duplicate this issue. It goes away if I manually delete the Alias.
Can you confirm that adding/removing a single IP doesn't update the widget Suppress count (following a "Force Update") or is the issue removing all of the IPs in an Alias? Are you hitting "Save" and then "Apply" to save the Alias after making changes? This is a full install of pfSense correct? Its not a Nano, or Ramdisk Install?
-
Yes, I can duplicate this issue. It goes away if I manually delete the Alias.
Can you confirm that adding/removing a single IP doesn't update the widget Suppress count (following a "Force Update") or is the issue removing all of the IPs in an Alias? Are you hitting "Save" and then "Apply" to save the Alias after making changes? This is a full install of pfSense correct? Its not a Nano, or Ramdisk Install?
I can confirm that removing (for example) eight out of ten IPs from the Alias, the widget doesn't update the number correctly. Yes, I always commit a "Force Update" and even a reboot. It's a ful install of pfSense (see my signature for hardware reference).
-
Update: I did a complete software reinstall and the problem went away.
-
I found my WAN IP contained in the Infiltrated Web Attackers list. I've been leased this IP for a while now. The description in the list says that it is compiled on an hourly basis. I am now questioning the accuracy of the list. I don't believe that anything malicious is originating from inside my network. Then again, I could be wrong.
I can't see the Destination IP as you have obfuscated it.
Try to run the one of the following commands from the shell or from the GUI Diagnostics:Command :
[ Using [b]1.2.3.4 as an IP, change it to reflect the IP that is in question ]
grep "^1.2.3." /var/db/aliastables/pfB_Infiltratednet.txt
or
grep "^1.2." /var/db/aliastables/pfB_Infiltratednet.txt
or
grep "^1." /var/db/aliastables/pfB_Infiltratednet.txtI assume that the IP being blocked is in a large CIDR that the Alerts tab is not matching. You will have to sift tru the output and see if you can find a match.
Note - you can also try changing the path/folder to the following if you have multiple Lists inside an Alias, as the /var/db/aliastables folder is a compilation of all the lists in an alias.
/var/db/pfblockerng/deny/*
or You can view the Aliastable in the Log Browser, and scroll tru the list to see what IP CIDR is the cause of the Block.
-
I found my WAN IP contained in the Infiltrated Web Attackers list
Send an email to webattackers @ infiltrated [dot] net and ask to be taken off the list. As a safe measure, you can always add your WAN ip to the suppress list.
Infiltrated is run by J. Oquendo
Some of his recent posts…
http://seclists.org/nanog/2015/Feb/326
http://seclists.org/nanog/2015/Feb/351 -
BBcan177,
You're the man! He has an answer for everything! :)
-
Yes for sure. BBCan177 I will be making a contribution for your efforts soon. I am a big fan of pfBlockerNG.
Now I am concerned that my leased IP is on a web attackers blacklist. I am hoping to find the time to configure Splunk as a SIEM. In the meantime I am trying to look into a few entries found in the logs to determine the source. I installed the Sysinternals SysMon tool so that I could get a verbose look at network connections originating from my Windows box but I cannot find a few of the entries that are being flagged in pfBlockerNG. Take for instance a http call out to 184.168.229.128 is flagged by the Alienvault blocklist. I thought I could trace back by source port in syslog but it is nowhere to be found in my event logs. Any ideas?
-
Hi Heisenberg1977,
In the Alerts Tab, you can click on the "!" icon for any alerted IP and it will open a second page which does a DNS Resolve. Clicking on "DNS Lookup" will open a page with several Sites where you can lookup the IP to gather some intel.
I am a big fan of "Security Onion"… You should check it out!
http://blog.securityonion.net/p/securityonion.html
https://code.google.com/p/security-onion/wiki/IntroductionToSecurityOnion -
I just found the lookup feature a few minutes before you posted it. Real nice!. I'm still searching for a good Windows tool that will allow me to have a granular look at all network activity. Sysmon's ability to write to the event logs is great as it gives the ability to easily go back and search. It's logging a lot of stuff but my search did not pick up anything with destination address 184.168.x.x unfortunately.
