OpenSense Firewall Rule with Divert To -> Intrusion Detection -> Pass then Block

[chrisq]

I'm not sure if this is with the latest version or a Suricata update.

I am using pass rules with divert to, in the previous version it would pass.

I ended up taking removing Suricate Divert To -> Intrusion Detection as when this was enabled on the latest update I see a Pass in the firewall rule log and then a block for the same traffic on the same rule.

This was for a connection that was nat'd from port 122 to a destination port 22, the WAN allow rule to 22 with an allow the traffic to the host. Disabling divert to fixed the issue but really want this to work as previously.

[chrisq]

Just an update, had some more time to test today. With divert on it does actually go to suricata, I got it to log ssh traffic and see that suricata got the traffic, alerted and allowed it but the firewall still blocks it with divert to on.

[franco]

So which rule blocks it? And/or make sure it's passed with a quick rule...

[chrisq]

Yeah, its a quick rule, it is an allow rule with divert to set to Intrusion detection.

When divert to Intrusion Detection enabled:
In the firewall I get 2 log items back to back for the same rule an allow and then a block on the same rule for the traffic.
In surricata I can see that it received the traffic and allowed it.

When I disable the divert to on the rule:
The connection works fine and the allow rule works.

The issue is that it blocks no matter what when divert to is set to intrusion detection so this is not what it's meant to do.

[franco]

Maybe I'm missing the obvious here, but which block rule? And did you check which packets are being blocked and how many bytes they may have?

There's a reason stateful firewalls reject out of state packets for example.

[chrisq]

There is no block rule (except for the default block but it never hits that). The rule is an allow rule. The firewall just logs it as a block in its log against the allow rule. I just logged an issue on the github site, not sure if its just me but happened on 2 separate routers I updated to 26.7. The traffic is blocked until removing divert to from the allow rule.

[franco]

Again: which rule blocks the traffic?

[chrisq]

The rule that is set to allow/pass the in traffic on port 22, that is the rule that blocks it.

But it only blocks at the firewall level if the "Divert To" option is set. Otherwise it works as it should but skips the IDS but this is not ideal as I want the IDS to check it as it previously did.

[franco]

Okay, now show a screenshot of the block details from the live log and if there's anything in IDS logs about this.


Cheers,
Franco

[chrisq]

So this is on the accepted rule when Divert To is set to Intrusion Detection.

Pass then Block the matching the accept rule.

---
And if I remove Divert To on the rule it no longer blocks, but does not go through IDS.