[7.090] Launching bittorrent killed webadmin access, and http traffic

I launched bittorent, and it killed my webadmin access entirely, as well as my Lotus Notes access, and normal http traffic.

As soon as I quit the torrent app, everything returned to normal.

It also killed my access to My Astaro, as well as access to my online banking.. almost like the encrypted torrent traffic stopped all encrypted traffic from passing through ASG...

Parents

0 ReD-MaN over 17 years ago

Ok, just heard from my wife, that this also killed her secure SMTP email to gmail while I was running torrents.

As soon as I killed it, it worked for her.

This is pretty bad, since I can basically DoS my household now just by running torrents... haha
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 17 years ago in reply to ReD-MaN

I've seen this before with previous versions of V7 ... what happens if you turn off network accounting? What process do you see eating the machine in TOP when this happens? Could be our old friend pfilter-reporter.....

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 17 years ago in reply to drees

I don't disagree that it should be a top priority item... perhaps after they get the proxy issues nailed down with this 7.100 update, they can get that fixed.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 17 years ago in reply to BrucekConvergent

The thing that is really funny, I didn't have this problem with the earlier betas.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 drees over 17 years ago in reply to ReD-MaN

Yeah, I suspect the bug was perhaps mostly fixed at one point and may have resurfaced according to the reports in the forums.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Simon Shaw over 17 years ago in reply to drees

I still cannot replicate this on the latest beta.

I am running PSD, IDS etc etc.

Downloading a torrent flat stick and seeding about 20, CPU use on Astaro is less than 5%

TOP shows snorts using most at 3% or so. pfilter less than 1%

Using uTorrent 1.7.5
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 drees over 17 years ago in reply to Simon Shaw

Simon, did you set up appropriate NAT/packet filter rules to allow inbound connections as well?

I wonder if it mainly happens when the firewall isn't configured properly to allow inbound BitTorrent connections to the client.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 17 years ago in reply to drees

I have the needed packet filter rules to allow the traffic.

What it looked like to me was PSD, since it was going crazy.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 drees over 17 years ago in reply to ReD-MaN

ReD-MaN, do you exclude your LAN from PSD? Simon, how about you?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Simon Shaw over 17 years ago in reply to drees

I have a NAT rule to forward TCP+UDP port to the torrent client machine.
I also have inbound and outbound packet filter rules.

PSD is turned ON for client network.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 17 years ago in reply to Simon Shaw

I didn't exclude my machine from PSD until this problem occured. Prior to that it was not excluded.

Just disabled the exclusion, and wham, can't use webadmi anymore.

Enable it, and it works.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 17 years ago in reply to Simon Shaw

It may have something to do with the different Bittorrent clients that are available; maybe you guys should compare notes on which clients seem to cause it (I don't use Bittorrent at all anymore)... that would probably help Astaro get to the bottom of it.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BrucekConvergent over 17 years ago in reply to Simon Shaw

It may have something to do with the different Bittorrent clients that are available; maybe you guys should compare notes on which clients seem to cause it (I don't use Bittorrent at all anymore)... that would probably help Astaro get to the bottom of it.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 ReD-MaN over 17 years ago in reply to BrucekConvergent

I am using Azureus Vuze version 3.0.3.4.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Simon Shaw over 17 years ago in reply to ReD-MaN

uTorrent > *
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ScottL over 17 years ago in reply to Simon Shaw

I am running utorrent and my machine does get locked up(web proxy timeouts) if I start utorrent up without excluding my PC's address from portscan detection.

-Scott
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Simon Shaw over 17 years ago in reply to ScottL

Sorry, I *AM* getting lockups, if I allow PSD for internal network as source.

I don't see much benefit from stopping portscans that originate INSIDE my network so always had this excluded from PSD. My apologies.

If I turn PSD on for internal network I get mass PSD notification emails and webmin locks up.

:~
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 drees over 17 years ago in reply to Simon Shaw

OK, that seems to verify that PSD is indeed the issue, if it is possible to trigger remotely, this would be even more serious. Anyone try running nmap against a v7 firewall? If someone has one and is willing to do some testing with me, I can fire up nmap to see if we can trigger the issue remotely.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ReD-MaN over 17 years ago in reply to drees

Drees, sure thing.

I will PM you my ip.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Atticka over 17 years ago in reply to ReD-MaN

The wording for the Port Scan protection is not clear.

I understood you're supposed to add the LAN interface to protect your LAN from external port scans from the WAN?

From the interface:
To start the Intrusion Protection System, please specify your Local networks and a policy to apply to detected attacks.

From the help page
Local Networks: Select the networks that should be protected by the Intrusion Protection System (IPS). If no local network is selected, intrusion protection will automatically be deactivated and no traffic is monitored.

So if I want to protect my LAN I need to have it specified in the IPS list according to this.

Anti-Port scan is set to drop traffic and limit logging.
No exceptions are set.
NAT and packet filter rules are set for P2P traffic, forwarding packet to the machine with the torrent client running.
Running uTorrent (latest version)

Since the beta I have noticed a HUGE increase in performance with torrent downloads, the latest version seem to help solve some of these issue's.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 drees over 17 years ago in reply to Atticka

Well, ReD-MaN and I tried using nmap to trigger the pfilter-report to go into 100% cpu mode, but couldn't. Not sure why BitTorrent is able to trigger it from the LAN, but lots of concurrent TCP connections isn't it.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Simon Shaw over 17 years ago in reply to drees

You can exempt LAN as *source* for portscans.
I can't see this being a problem.

I still get portscan notifications when someone on the internet at large tries to portscan our firewall.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[7.090] Launching bittorrent killed webadmin access, and http traffic

Submitted a Tech Support Case lately from the Support Portal?