This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Snort blocking connections to our internal web server

I’m curious if anyone can help me with an issue I’m having with snort. We have an Astaro box covering our internet connection with a webserver and workstations behind it. All worked well until I upgraded to 6.203, now when a user tries to access our webserver via it’s DNS name (or external IP address) snort kicks in and blocks it with the following in the Intrusion Protection System log:

2006:06:19-16:54:47 (none) snort[20617]: [116:151:1] (snort decoder) Bad Traffic Same Src/Dst IP {PROTO006} (our IP Address):80 -> (our IP Address):35782

If the user punches in the internal IP address of the server then everything works fine, but most people around here aren’t happy with that answer, anyone have a suggestion?

I tried looking through the Intrusion Protection rules but couldn’t find anything, not sure if it’s somewhere else or I’m just blind.

This thread was automatically locked due to age.

Parents

0 wwwolf_01 over 19 years ago

Thanks for the heads up guys.
Under Packet Filter >> Advanced I tried setting the Spoof Protection to Off, Normal and Strict with no change. One odd thing I’ve noticed, I looked at the logs again and the connection to my web server is not being blocked (i.e port 57587 -> port 80) but only the return connection (i.e. port 80 -> port 57587).
I’ve got a temp. work around by setting up my own local DNS server, but it’s still not the perfect solution, any other ideas?
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 19 years ago in reply to wwwolf_01

Look in one of the other folders in the forum, there's one entitled "6.203 Update" that someone posted a workaround that Astaro support gave him.. it involves disabling some of the Snort features manually. Here's the link.. it's near the bottom of the page:

https://community.sophos.com/products/unified-threat-management/astaroorg/f/52/t/25649
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BrucekConvergent over 19 years ago in reply to wwwolf_01

Look in one of the other folders in the forum, there's one entitled "6.203 Update" that someone posted a workaround that Astaro support gave him.. it involves disabling some of the Snort features manually. Here's the link.. it's near the bottom of the page:

https://community.sophos.com/products/unified-threat-management/astaroorg/f/52/t/25649
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data