[7.090] Launching bittorrent killed webadmin access, and http traffic

I launched bittorent, and it killed my webadmin access entirely, as well as my Lotus Notes access, and normal http traffic.

As soon as I quit the torrent app, everything returned to normal.

It also killed my access to My Astaro, as well as access to my online banking.. almost like the encrypted torrent traffic stopped all encrypted traffic from passing through ASG...

Parents

0 ReD-MaN over 17 years ago

Ok, just heard from my wife, that this also killed her secure SMTP email to gmail while I was running torrents.

As soon as I killed it, it worked for her.

This is pretty bad, since I can basically DoS my household now just by running torrents... haha
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 17 years ago in reply to ReD-MaN

I've seen this before with previous versions of V7 ... what happens if you turn off network accounting? What process do you see eating the machine in TOP when this happens? Could be our old friend pfilter-reporter.....

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 17 years ago in reply to BrucekConvergent

Wow.. it was portscan detection. Funny thing is I have had that enabled for a long time, didn't make any changes except the new beta up2date today.

Had to add my laptop to the skip source list for an exception to portscan detection.

That was horrible.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 17 years ago in reply to ReD-MaN

It's likely that it's not so much the portscan detection... it's the massive amount of drops it produced that pfilter-reporter tried to process... kind of an indirect issue -- at least that's my take on it.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 17 years ago in reply to BrucekConvergent

pfilter-reporter has finally dropped in cpu usage.. man.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 drees over 17 years ago in reply to ReD-MaN

Yep, William reported the same issue on v7, oh about 10 months ago and again 4-5 months ago.

HIgh loads on Astaro
possible astaro v7.005 security issue

Not good when you can DoS the firewall so easily. Anyone see if it's possible to do the same from remotely as well? I don't see why you wouldn't be able to...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Simon Shaw over 17 years ago in reply to drees

I run uTorrent behind ASL just about all the time, using v6 and v7... I don't see any performance impact...
Portscan detect, IDS, Accounting etc etc all turned on.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 17 years ago in reply to Simon Shaw

I do as well, and never had to exempt my machine from PSD before. However this time I do.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PaulMeredith over 17 years ago in reply to ReD-MaN

I am getting this too.  I have a 7.091 box running on a small P3 1Ghz 512 RAM in front of Suse 10.3.  As soon as I brought up Firefox I lost all connection to the Net.  I started top on the Astaro and an ips process eating cycles.

Then I looked in the ips.log file.

2007:11:28-15:54:12 (none) ulogd[2558]: id="2102" severity="info" sys="SecureNet" sub="ips" name="portscan detected" action="portscan" fwrule="60017" initf="
eth0" dstmac="00:04:5a:84:3e[:D]f" srcmac="00:0c:f1:eb:46:04" srcip="192.168.2.20" dstip="192.168.2.100" proto="6" length="60" tos="0x00" prec="0x00" ttl="64"
srcport="50182" dstport="8080" tcpflags="SYN"

2.20 is my suse box, 2.100 is the Astaro.
I started Firefox restoring a session of 4 tabs.  I am using the http proxy in transparent mode.

I did start Azureus about the same time as firefox.  I really am not sure which one caused the issue, but as soon as I changed the ips- portscan setting to log only instead of drop traffic everything was back to being normal.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Atticka over 17 years ago in reply to PaulMeredith

Similar experience here, launching a torrent will generally peg the CPU %100 until the torrent is stopped, the interface and other network operations will stop (web, email, etc.. all unresponsive).

I have noticed that its a little better in the beta.

Currently running:
P4 3GHZ
1GB of RAM
Intel PRO 100 NIC's
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 William Warren over 17 years ago in reply to BrucekConvergent

Yep, same issue that we've seen before... that process can get nasty when it processes all the drops that Bittorrent causes... not that it's necessarily the fault of Bittorrent, the firewall should withstand drops without "dying"... it's a tough problem, though, from what I understand.

It's tough for astaro. I have never had an ipcop or smoothwall or untangle machine fall over just because of running bitorrent. Also astaro v4 and v5 also never had this issue. It's endemic to v7.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 17 years ago in reply to William Warren

That's kind of how I meant it... I haven't had this kind of problem with other firewall products either and Bittorrent... there apparently is some issue with the pfilter-reporter and / or portscan modules. Hopefully they'll get it squared away at some point.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BrucekConvergent over 17 years ago in reply to William Warren

That's kind of how I meant it... I haven't had this kind of problem with other firewall products either and Bittorrent... there apparently is some issue with the pfilter-reporter and / or portscan modules. Hopefully they'll get it squared away at some point.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 drees over 17 years ago in reply to BrucekConvergent

Hopefully they'll get it squared away at some point.

This should be a top priority fix for a number of reasons:

1. It can result in a DoS. This is a serious security bug.
2. The problem has been known for nearly a year now.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 17 years ago in reply to drees

I don't disagree that it should be a top priority item... perhaps after they get the proxy issues nailed down with this 7.100 update, they can get that fixed.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 17 years ago in reply to BrucekConvergent

The thing that is really funny, I didn't have this problem with the earlier betas.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 drees over 17 years ago in reply to ReD-MaN

Yeah, I suspect the bug was perhaps mostly fixed at one point and may have resurfaced according to the reports in the forums.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Simon Shaw over 17 years ago in reply to drees

I still cannot replicate this on the latest beta.

I am running PSD, IDS etc etc.

Downloading a torrent flat stick and seeding about 20, CPU use on Astaro is less than 5%

TOP shows snorts using most at 3% or so. pfilter less than 1%

Using uTorrent 1.7.5
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 drees over 17 years ago in reply to Simon Shaw

Simon, did you set up appropriate NAT/packet filter rules to allow inbound connections as well?

I wonder if it mainly happens when the firewall isn't configured properly to allow inbound BitTorrent connections to the client.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 17 years ago in reply to drees

I have the needed packet filter rules to allow the traffic.

What it looked like to me was PSD, since it was going crazy.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 drees over 17 years ago in reply to ReD-MaN

ReD-MaN, do you exclude your LAN from PSD? Simon, how about you?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Simon Shaw over 17 years ago in reply to drees

I have a NAT rule to forward TCP+UDP port to the torrent client machine.
I also have inbound and outbound packet filter rules.

PSD is turned ON for client network.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 17 years ago in reply to Simon Shaw

I didn't exclude my machine from PSD until this problem occured. Prior to that it was not excluded.

Just disabled the exclusion, and wham, can't use webadmi anymore.

Enable it, and it works.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[7.090] Launching bittorrent killed webadmin access, and http traffic

Submitted a Tech Support Case lately from the Support Portal?