Topics

Three weeks ago, I blocked the entire subnets for the Censys menace
167.94.146.0/24, 167.94.145.0/24. and 167.94.138.0/24

I've also blocked IN ADDITION, the individual IP addresses that still get through the firewall and suck up my bandwidth. What's the point of a firewall if it still has holes in it for the scanner menaces? I sometimes think there are more scanners than people on the internet.

Is this deliberate? Is OPNSense set up to allow certain addresses through it or have they devised a strategy that gives them access no matter what? In which case, it's time you did something about it.

I find this VERY disturbing. NO ONE has the right to probe my servers and try to access my mail server without my permission.

Don't tell me it's MY mistake. the firewall blocks everyone else in the blocklist including subnets, but Censys, Shodan and some others that are blocked by individual IP addresses keep coming back.

And PLEASE don't tell me that these are all 'benign' and for my own good. How would you like it if I came around to your home every day and checked all the doors and windows, hoping to find one open?

I've got 3 x DNS servers. The Master server has 4 forwarders. One to the AD server, one to my ISP's DNS, one to Google and one to Dynu.

It's all worked fine until the big update, now the DNS forwarders are 'unavailable' (but I can ping them from the server).

dig acme-v02.api.letsencrypt.org

; <<>> DiG 9.11.36-RedHat-9.11.36-11.el8_9.1 <<>> acme-
v02.api.letsencrypt.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: FORMERR, id: 16823
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 521eb6b59732065e (echoed)
;; QUESTION SECTION:
;acme-v02.api.letsencrypt.org.   IN   A

;; Query time: 1 msec
;; SERVER: 192.168.0.240#53(192.168.0.240)
;; WHEN: Tue May 14 17:05:49 CEST 2024
;; MSG SIZE  rcvd: 69

Something to do with DNS must have changed since I first setup OPNS a long time ago and I never set anything other than aliases and rules. Never touched the DNS or anything else, it's a really simple system, just block the criminals.

Can anyone help please, it's become a major issue

I need to whitelist Let's Encrypt Certbot's Acme Challenge through.

With my limited knowledge, I created this firewall WAN rule:

Action - Pass
Interface - WAN
Direction - In
TCP Version - IPV4
Protocol - TCP
Source - any
Destination - Single Host - 72.xx.xxx.xxx The public IP of the mail server /32
Destination Port Range 80 to 443 (or do I need one rule for each?)
Gateway - ?? Default (or should it be) My internal or Wan-ppoe?

I left it at default.

I moved the rule to the top of my list of blocked IP addresses (Country Block), but it doesn't work.

The people at Let's Encrypt tell me that I've managed to block some of the AcmeChallenge servers, and I had hoped that this would fix it.

What have I done wrong?

This isn't the first time this has happened.

107.170.237.26 is blocked by Internet Defense. I caught this same IP address a week ago, trying to hack my mail server., so I added it to my own block list.

Yesterday the same IP tried again to hack my mail server
Accepted POP3 connection with: 107.170.237.26
19:11:05 1CF *** NEW PHYS. CONNECTION, Tbl Entry=0, Socket=82
19:11:05 1CF POP3 command: MGLNDD_xxx.xxx.xxx.xxx_110
19:11:06 1CF POP3 session ended: 107.170.237.26
19:11:06 1CF *** PHYSICAL PORT DISCONNECTED, Tbl Entry=0, Socket=82

Not just this one attempt TEN TIMES.

This IP belongs to stretchoid, who have close to 2,000 of these so-called 'research scanners' all running world-wide on Digital Ocean.

Don't come with the BS that this is 'ethical hacking' to make the world a better place. To be an ethical hacker YOU NEED PERMISSION.

If I go around houses checking the front and back doors of every house, what do you think Mr Plod is going to say when I tell him "it's only for research."?

My question is:
Is this a BUG in OPNSense or is it a deliberate back door for the US Alphabet agencies.

Oh and before you tell me, I haven't entered it properly, I have checked it.

Enter an IP address to show in which aliases it is used.
107.170.237.26
internet_defence
stretchoid_drop (my own block list)

This is NOT the first stretchoid IP address that has succeeded in bypassing OPNsense. The two previous ocassions I thought maybe it was me. IT ISN'T.

I've found googleuserbots that I add to my block list, but they simply ignore it and keep coming back. I've picked up several other IP addresses that simply ignore blocks and keep popping up. How is this possible? Does OPNsense allow certain IP addresses unconditional access?

Like these

vsftpd:
    Authentication Failures:
       unknown (158.54.211.130.bc.googleusercontent.com): 1 Time(s)
       unknown (183.127.77.34.bc.googleusercontent.com): 1 Time(s)
       unknown (32.248.140.34.bc.googleusercontent.com): 1 Time(s)
       unknown (55.96.76.34.bc.googleusercontent.com): 1 Time(s)
       unknown (inspire.census.shodan.io): 1 Time(s)
    Invalid Users:
       Unknown Account: 5 Time(s)

This is driving me up the wall.

We have an old CentOS 7.3 server. We have  2 x SMP Forums running on it and a Welcome webpage.

It's worked for years and has never been updated.

We have a /29 network and we use xxx.xxx.xxx.57 as a Gateway and 58,59,60,61, and 62 are available. We only used 58 and 59. 58 is the old CentOS server and 59 is our mail server.

We use the OPNsense Firewall and the centos box does shftp, and the 2 Forums with Letsencrypt SSL certs. It works perfectly.

After installing a new Alma server, we cloned setup a new Virtual IP for xxx.xxx.xxx.60.
Setup an alias for Alma server (cloned centos and changed the necessary)

Cloned the Port forwarding from centos and changed the necessary.

Closed the Centos WAN rules and changed the necessary.

Copied the two Forums over to the same locations, copied the /etc/httpd/conf.d files for the Forums

Time to change the DNS. We have our own DNS servers. Entered the new server and internal address xxx.xxx.xxx.213 (the old one was 203).

Because we host a sub-domain in our office of the main domain (on a hosting site). We use Dynu to handle the sub-domain DNS. Added the new server took out the centos and entered xxx.xxx.xxx.60 for the 2 x forums the www page. IDENTICAL to the centos, just IP addresses different.

It's all gotta work, no?

Right, NO it doesn't.

I can ping xxx.xxx.xxx.60 from my workstation, from in the Alma server, no problem
If I try http://xxx.xxx.xxx.60 from any PC or from the Alma box. It times out.
I try to telnet to 80, 443, 20,21, SSH, (all these ports are configured on the OPNsense EXACTLY the same as the centos. NOTHING, NADA.

Now for the fun part. If I start the old centos server. NOW I can telnet and get the apache page when I type http://xxx.xxx.xxx.60.

WTF am I doing wrong. it MUST be the firewall. I've checked the firewall is setup on Alma EXACTLY the same as centos. SELinux is disabled (I hate it).

Can anyone out there help?

I've just installed and setup OPNsense. I THOUGHT I understood how the Virtual IPs, Aliases and Rules work, but I'm missing something here.

I have 4 Virtual IPs
Mailserver,
Webserver1
Webserver2
Plex

Both Webservers are on CentOS (one on CentOS 7 and the other CentOS 8) both are Virtual servers on Apache (I upgraded from Smoothwall Express 3.1 and they were working fine before the upgrade. In fact if I down the OPNsense and reload Smoothwall it all still works, so it's me. I've dome something stupid or I'm missing something.

I have 3 x DNS servers all have entries for the servers.

In NET--> Virtual IPs --> Settings I have xxx.xxx.xxx.xxx/29 one for each Virtual IP
In Aliases I have:
Mailserver and Mailserver Ports
Webserver1 and Webserver1 Ports
Webserver2 and Webserver2 Ports
Plex and Plex Ports

In NAT Port Forward, I have an entry for each of the above
Interface -WAN
TCPIP - IPV4
Protocol - TCP
Destination - one of the Virtual IP addresses
Destination Port Range - the Alias for Port range
Redirect Target IP - Alias of the server.

In Rules I have an entry Pass for each one.
My Mailserver works fine
Plex works fine.
Both my CentOS Webservers work INTERNAL, but no one can connect to them from EXTERNAL.

I thought Ports 80 and 443 are open by default. I was obviously wrong. I tried putting those ports into the Alias as well - same result

A customer tried to ping and tracert. Nada.

What have I missed / done wrong?

If I go to a VPN and try to access the site after a LONG wait I get the message:
write tcp 10.238.1.122:46489: write: connection timed out

WTF does 10.238.1.122 Nothing to do with us. we are on a 192.168.0.0/24 network