OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 18.1 Legacy Series »
  • 18.1.1 IPS still blocking access to joomla admin panel (SOLVED)
« previous next »
  • Print
Pages: 1 [2]

Author Topic: 18.1.1 IPS still blocking access to joomla admin panel (SOLVED)  (Read 3119 times)

elektroinside

  • Hero Member
  • *****
  • Posts: 574
  • Karma: 50
    • View Profile
Re: 18.1.1 IPS still blocking access to joomla admin panel
« Reply #15 on: February 06, 2018, 10:55:02 am »
@Dzioobasek:

Apply the patch (via putty for example), restart your OPNsense just to be sure, then access the Joomla login page.
If blocked, go to your alerts and verify the results.

It has to be there, with the patch, IPS will alert you for all blocked packets (without it, it does for just a few). So if you don't apply it, you might miss the offending rule.
Logged
OPNsense v18 | HW: Gigabyte Z370N-WIFI, i3-8100, 8GB RAM, 60GB SSD, | Controllers: 82575GB-quad, 82574, I221, I219-V | PPPoE: RDS Romania | Down: 980Mbit/s | Up: 500Mbit/s

Team Rebellion Member

Dzioobasek

  • Newbie
  • *
  • Posts: 39
  • Karma: 3
    • View Profile
Re: 18.1.1 IPS still blocking access to joomla admin panel
« Reply #16 on: February 09, 2018, 07:46:29 am »
Quote from: elektroinside on February 06, 2018, 10:55:02 am
@Dzioobasek:

Apply the patch (via putty for example), restart your OPNsense just to be sure, then access the Joomla login page.
If blocked, go to your alerts and verify the results.

Buddy im noob :) I mosty wait for official updates :P Anyway after 18.1.2 I have all rules enabled and updated and its not blocking my joomla admin panel :)
Great work guys.

PS
Does opnsense has any bandwitch controller enabled by default? I have plugged few clients to opnsense and now instead 100mbps i have 40mbps on speedtest.net. When i was only connected client it was running at full speed
« Last Edit: February 09, 2018, 08:33:16 am by Dzioobasek »
Logged

elektroinside

  • Hero Member
  • *****
  • Posts: 574
  • Karma: 50
    • View Profile
Re: 18.1.1 IPS still blocking access to joomla admin panel
« Reply #17 on: February 09, 2018, 08:49:45 am »
Let's find the cause by finding the trigger first:
1. Temporarily disable just the IPS -> speedtest at least twice
2. Temporarily disable IDS entirely -> speedtest at least twice
3. Enable them -> speedtest at least twice

Please report back your findings.

P.S. Remember:  do not enable "promiscuous mode"
« Last Edit: February 09, 2018, 08:53:44 am by elektroinside »
Logged
OPNsense v18 | HW: Gigabyte Z370N-WIFI, i3-8100, 8GB RAM, 60GB SSD, | Controllers: 82575GB-quad, 82574, I221, I219-V | PPPoE: RDS Romania | Down: 980Mbit/s | Up: 500Mbit/s

Team Rebellion Member

Dzioobasek

  • Newbie
  • *
  • Posts: 39
  • Karma: 3
    • View Profile
Re: 18.1.1 IPS still blocking access to joomla admin panel
« Reply #18 on: February 09, 2018, 09:12:53 am »
God im so lame :P
I forgot i was switching gateways when i was accesing joomla and forgot to switch back to opnsense. Now its at full speed again.
Tho it started blocking panel access again but alert are displayed correctly now and i have found rule which was responsible - ET CURRENT_EVENTS Possible Successful Generic Phish (set)
All working like a charm now, thank you guys!
Logged

elektroinside

  • Hero Member
  • *****
  • Posts: 574
  • Karma: 50
    • View Profile
Re: 18.1.1 IPS still blocking access to joomla admin panel (SOLVED)
« Reply #19 on: February 09, 2018, 10:35:22 am »
Awesome :)
You're welcome!
Logged
OPNsense v18 | HW: Gigabyte Z370N-WIFI, i3-8100, 8GB RAM, 60GB SSD, | Controllers: 82575GB-quad, 82574, I221, I219-V | PPPoE: RDS Romania | Down: 980Mbit/s | Up: 500Mbit/s

Team Rebellion Member

  • Print
Pages: 1 [2]
« previous next »
  • OPNsense Forum »
  • Archive »
  • 18.1 Legacy Series »
  • 18.1.1 IPS still blocking access to joomla admin panel (SOLVED)
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2021 All rights reserved
  • SMF 2.0.17 | SMF © 2019, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2