Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 2 subscribers
  • Views 2318 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS block periods

NewImage
Is there a way to increase the ban time of an IP address when they set off the IPS? I have an IP trying to brute force a FTP server, but the IPS just disconnects the current session, leaving them able to just reconnect and try again.


This thread was automatically locked due to age.
  • 0
    Please show the line from the log file.

    Cheers - Bob
  • 0
    2013:05:01-17:15:59 keywest snort[16794]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="APP-DETECT failed FTP login attempt" group="242" srcip="192.168.1.2" dstip="176.31.184.48" proto="6" srcport="21" dstport="55500" sid="13360" class="Misc activity" priority="3"  generator="1" msgid="0"
    2013:05:01-17:16:07 keywest snort[16794]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="APP-DETECT failed FTP login attempt" group="242" srcip="192.168.1.2" dstip="176.31.184.48" proto="6" srcport="21" dstport="57128" sid="13360" class="Misc activity" priority="3"  generator="1" msgid="0"
    2013:05:01-17:16:15 keywest snort[16794]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="APP-DETECT failed FTP login attempt" group="242" srcip="192.168.1.2" dstip="176.31.184.48" proto="6" srcport="21" dstport="58614" sid="13360" class="Misc activity" priority="3"  generator="1" msgid="0"
    2013:05:01-17:16:22 keywest snort[16794]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="APP-DETECT failed FTP login attempt" group="242" srcip="192.168.1.2" dstip="176.31.184.48" proto="6" srcport="21" dstport="60150" sid="13360" class="Misc activity" priority="3"  generator="1" msgid="0"
    2013:05:01-17:16:30 keywest snort[16794]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="APP-DETECT failed FTP login attempt" group="242" srcip="192.168.1.2" dstip="176.31.184.48" proto="6" srcport="21" dstport="33410" sid="13360" class="Misc activity" priority="3"  generator="1" msgid="0"
    2013:05:01-17:16:36 keywest snort[16794]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="APP-DETECT failed FTP login attempt" group="242" srcip="192.168.1.2" dstip="176.31.184.48" proto="6" srcport="21" dstport="34952" sid="13360" class="Misc activity" priority="3"  generator="1" msgid="0"
    2013:05:01-17:16:44 keywest snort[16794]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="APP-DETECT failed FTP login attempt" group="242" srcip="192.168.1.2" dstip="176.31.184.48" proto="6" srcport="21" dstport="36480" sid="13360" class="Misc activity" priority="3"  generator="1" msgid="0"
  • 0
    happens all the time where the same IP will have multiple IPS hits. A firewall block on the IP would be great
  • 0
    Hi, 
    Astaro/UTM doesn't really do any time-based blocking, other than:
    1. failed webadmin (and maybe SSH) logins will trigger a temporary block, if that feature is enabled. IIRC, the time period is configurable.

    2. portscan detection will create a temporary block. I don't know how long it lasts, but afaik it is short.
    Anyways, make sure you have PSD enabled.

    Keep in mind that firewalls with lengthy blocking are subject to DOS attacks; spoofed UDP packets could be created to cause the firewall to block off ISPs or possibly the entire Internet (although most firewalls would probably run out of memory first).

    Barry
  • 0
    It looks like the drops are of the responses being offered by your FTP server.  If you want to block that guy in France (176.31.184.48), just make another DNAT in front of the one for the FTP server and DNAT those packets to a non-existant IP.

    If you have proof that that IP is trying to brute force a password-protected server, you should forward that information to their ISP: abuse@ovh.net.

    Cheers - Bob