IPS Network Problem

Support
, ,
12

It blocks the connections between external DNS and NS.
Never blocked before today.

The ISP configurations have not been changed I have only updated.

01/15/2018-13:37:29.861972 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:37:34.864795 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:37:40.933204 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:37:53.943631 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:37:58.944839 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:04.923913 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:17.636564 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:18.547584 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:18.572829 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:19.638377 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:21.573975 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:21.574404 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:22.638169 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:25.574221 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:25.574444 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:28.782735 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:29.577889 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:29.603190 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:30.605567 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:32.603833 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:32.604321 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:36.604775 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:36.606805 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:43.788041 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …
01/15/2018-13:38:43.789587 [Drop] [] [1:2001117:6] ET DNS Standard query response, Name Error [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} …

13

Is DELETED the only blocked category in the logfile? What about setting it to “disable”?

Is it only the TROJAN category? Does setting it to “Alarm” work?

14

I can confirm that the package update doesn’t break ours installations.

As pointed out by @pasing, probably something changed inside the rules.

15

I have extracted some examples from /var/log/suricata/fast.log:

ET DELETED Nginx Server in use - Often Hostile Traffic
"hostname": “ocsp.int-x3.letsencrypt.org”

ET DNS Standard query response, Name Error

ET DELETED Likely Binary in HTTP by Type Flowbit
"hostname": “www.shallalist.de”

ET USER_AGENTS Go HTTP Client User-Agent
"hostname": “static.nvd.nist.gov”,

ET DELETED Tomcat Successful default credential login from external source

@giacomo @mrmarkuz do you have any suggestions for solving the problem?

16

I have the same problem of @pasing. If you disabled DNS category does it works?

17

I reported this almost a week ago here.

I included a list of the rules I had active at the time.

Cheers.

18

It seems the rules are more strict now so easiest way is to set the blocked categories to “Alert”.

1 Like
19

Is this the solution?

20

No, it’s just a workaround to make networking available again. I am afraid there is no easy solution. You have to update to catch the newest threats but these updates may change IPS behaviour.

21

Yesterday i apply this update:
Jan 13 04:01:17 Updated: nethserver-pulledpork.noarch 2.1.2-1.ns7

And today when try connect via openvpn, the conecction is sucessfull but i can access to the
resources of my lan, and check the everbox inbox and see this:

BLOCKED ET TROJAN Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4) [**] [Classification: A Network Trojan was detected] [Priority: 1] {UDP} …

All by the port 1194.

So i disable the suricata service and everithyng is work fine again.

My question is that blocked is a false positive, because i try via smarthphone and the same result.

1 Like
22

I assume it’s a false positive as @pasing reported similar behaviour:

1 Like
23

The problem immobilizes NS. After the update, if I keep setting the rule blocks on trojan when I try to access the VPS the system goes to lock and doesn’t work even on the server-manager side. Web pages do not load. Everything returns normally if I disconnect the client.

Set to the alarm is an invalid solution in terms of security. It’s useful only for a buffer solution.

The rule that blocks OpenVPN client is this: http://doc.emergingthreats.net/2009206

1 Like
24

Anyone has got a solution?
I have to set rules (DNS,DELETED,USER_AGENT) on Alarm?

25

This is my log.
Category DNS, DELETED, USER_AGENT are already set on Alarm.

01/15/2018-09:24:05.005962 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 2.20.251.27:80 -> 192.168.1.2:36478
01/15/2018-09:24:05.350406 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 212.73.221.199:80 -> 192.168.1.2:37762
01/15/2018-09:24:05.606746 [Drop] [] [1:2002750:27] ET DELETED Reserved IP Space Traffic - Bogon Nets 2 [] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 104.106.86.135:443 -> 192.168.1.2:33380
01/15/2018-09:24:06.172086 [Drop] [] [1:2002750:27] ET DELETED Reserved IP Space Traffic - Bogon Nets 2 [] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 104.16.207.165:443 -> 192.168.1.2:52072
01/15/2018-09:24:06.177960 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 172.217.23.78:80 -> 192.168.8.251:9130
01/15/2018-09:24:06.212958 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 172.217.23.78:80 -> 192.168.8.251:9131
01/15/2018-09:24:06.222750 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 216.58.205.46:80 -> 192.168.8.251:9132
01/15/2018-09:24:06.465201 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 2.20.251.27:80 -> 192.168.1.2:36504
01/15/2018-09:24:06.586432 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 2.20.251.35:80 -> 192.168.1.2:47288
01/15/2018-09:24:06.755024 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 193.45.6.13:80 -> 192.168.1.2:44558
01/15/2018-09:24:07.138333 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 212.73.221.205:80 -> 192.168.1.2:49148
01/15/2018-09:24:07.248673 [Drop] [] [1:2008054:7] ET DELETED Nginx Server in use - Often Hostile Traffic [] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 89.238.68.201:80 -> 192.168.1.2:34776
01/15/2018-09:24:07.526212 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 204.79.197.223:80 -> 192.168.1.2:35118
01/15/2018-09:24:07.736948 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 2.20.251.27:80 -> 192.168.1.2:36538
01/15/2018-09:24:07.988301 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 193.45.6.7:80 -> 192.168.1.2:41878
01/15/2018-09:24:08.015995 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 37.48.82.67:80 -> 192.168.1.2:39018
01/15/2018-09:24:08.139694 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 94.75.236.122:80 -> 192.168.1.2:59074
01/15/2018-09:24:08.305304 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 195.122.169.7:80 -> 192.168.1.2:34126
01/15/2018-09:24:08.346769 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 80.231.123.131:80 -> 192.168.1.2:43956
01/15/2018-09:24:08.457304 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 195.122.169.18:80 -> 192.168.1.2:40146
01/15/2018-09:24:08.601482 [Drop] [] [1:2002750:27] ET DELETED Reserved IP Space Traffic - Bogon Nets 2 [] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 185.26.182.117:443 -> 192.168.1.2:46782
01/15/2018-09:24:08.726988 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 193.45.6.7:80 -> 192.168.1.2:41906
01/15/2018-09:24:08.893996 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 2.20.251.27:80 -> 192.168.1.2:36572
01/15/2018-09:24:09.334481 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 37.48.82.67:80 -> 192.168.1.2:39050
01/15/2018-09:24:09.475456 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 37.48.82.67:80 -> 192.168.1.2:39054
01/15/2018-09:24:09.507773 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 193.45.6.7:80 -> 192.168.1.2:41918
01/15/2018-09:24:09.552478 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 80.239.174.47:80 -> 192.168.1.2:52382
01/15/2018-09:24:09.637261 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 80.239.174.47:80 -> 192.168.1.2:52386
01/15/2018-09:24:09.801301 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 80.231.123.131:80 -> 192.168.1.2:43994
01/15/2018-09:24:09.904974 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 193.45.6.7:80 -> 192.168.1.2:41932
01/15/2018-09:24:10.261262 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 193.45.6.7:80 -> 192.168.1.2:41940
01/15/2018-09:24:10.346685 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 37.48.82.67:80 -> 192.168.1.2:39084
01/15/2018-09:24:10.531719 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 2.20.251.35:80 -> 192.168.1.2:47404
01/15/2018-09:24:10.607371 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 2.20.251.35:80 -> 192.168.1.2:47406
01/15/2018-09:24:10.797104 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 2.20.251.11:80 -> 192.168.1.2:55228
01/15/2018-09:24:10.860939 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 212.73.221.199:80 -> 192.168.1.2:37908
01/15/2018-09:24:10.870938 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 23.50.149.163:80 -> 192.168.1.2:50586
01/15/2018-09:24:10.961451 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 80.239.174.47:80 -> 192.168.1.2:52430
01/15/2018-09:24:11.047211 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 195.122.169.18:80 -> 192.168.1.2:40220
01/15/2018-09:24:11.186432 [Drop] [] [1:2002750:27] ET DELETED Reserved IP Space Traffic - Bogon Nets 2 [] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 104.244.46.167:443 -> 192.168.1.2:54182
01/15/2018-09:24:11.264202 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 195.122.169.7:80 -> 192.168.1.2:34216
01/15/2018-09:24:11.321900 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 80.239.197.103:80 -> 192.168.1.2:39408
01/15/2018-09:24:11.671958 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 37.48.82.67:80 -> 192.168.1.2:39128
01/15/2018-09:24:11.723180 [Drop] [] [1:2007670:10] ET DELETED Likely Binary in HTTP by Type Flowbit [] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 93.184.220.29:80 -> 192.168.1.2:50744

26

For update NS, I had to disabled Policy, Deleted and Shellcode. If I set a block on this have some problem with yum.

IPS behaves abnormally. If I connect to the VPN from another IP on the same WAN class, the client is not recognized as a Trojan.
Instead, if I connect to an IP class other than the WAN, the client is recognized as a Trojan.

Honestly, I can not find a solution without creating a security hole.

@giacomo there is a way to implement a pass list?

This update is also having repercussions on the local network as the host has problems communicating with other hosts.

is it possible to return to the previous version?

1 Like
27

Oh yes, return to the previous version can be a solution… anyone know if it is possible?

28

I see a little bit of confusion in this post, let’s try to clear some points :slight_smile:

  1. Latest nethserver-pulledpork doesn’t brake anything, it just uses new optimized rule format for Suricata 4.0
  2. When implementing an IPS/IDS on your network you must tune the configuration and block only relevant categories
  3. Rules are automatically updated overnight and could change their own behavior

We didn’t experimented any issue so far, this is our current production configuration for Suricata:

suricata=service
    AlertCategories=ET-emerging-current_events,ET-emerging-dos,ET-emerging-ftp,ET-emerging-games,ET-emerging-inappropriate,ET-emerging-info,ET-emerging-misc,ET-emerging-mobile_malware,ET-emerging-p2p,ET-emerging-scan,ET-emerging-shellcode,ET-emerging-sql,ET-emerging-trojan,ET-emerging-voip,ET-emerging-web_client,ET-emerging-worm
    BlockCategories=ET-botcc.portgrouped,ET-botcc,ET-ciarmy,ET-compromised,ET-drop,ET-dshield,ET-emerging-activex,ET-emerging-attack_response,ET-emerging-exploit,ET-emerging-malware,ET-emerging-netbios
    status=enabled

Yes, you can use yum downgrade but it will have no effect on your problems.

We could find a way but it’s quite difficult at firewall level because you need to bypass also established connections.
If you want to add exceptions, the simplest way is to hack the Suricata rules. :wink:

The traffic between LAN hosts doesn’t flow through the gateway, therefore it can’t be affected.

1 Like
29

Please see this other thread:

The Deleted category is for rules that should not be used.
Please, review the manual:
http://docs.nethserver.org/en/v7/suricata.html

4 Likes
30

@filippo_carletti, @giacomo thanks for the clarifications and sorry for my insistence.

Now I have clear what is a correct set of rule for the production environment.

Perhaps, the set of old rules I had set before the update they were less restrictive and even if they were all set to block, it didn’t create the problems listed above.

2 Likes
31

My Alerts : Deteted, Trojan, Shellcode, Policy, TFTP, all rest are block.

Deleted are rules that have been deleted (pretty self explanatory), Trojan was blocking amazon prime video, shellcode blocks centos repos, so blocking nethserver updates, policy blocks nextcloud desktop app, and I am currently fixing a bricked router and need tftp to communicate :smiley:

New rules, new policies on implementing them. I like suricata 4 upgrade.