Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 1 subscriber
  • Views 1937 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Question regarding HTTP and PF rules

wingman
Hi All

I am viewing multiple blocks on my firewall regarding HTTP/HTTPS traffic. I am using https proxy and my understanding is that once a packet is in the system it will be dealt by only one function (for example either pf or proxy).  I am trying to understand why my client 192.168.2.11 has so many blocks on the pf when the host is using https proxy(Transparent mode).

Log of the pf 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="85.115.22.3" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49193" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.133" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49195" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.240.206.90" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49191" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="213.144.15.19" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49189" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="95.154.193.105" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49187" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.118" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49197" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="213.144.15.19" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49189" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.133" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49195" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.240.206.90" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49191" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="85.115.22.3" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49193" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="95.154.193.105" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49187" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.118" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49197" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="213.144.15.19" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49189" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="85.115.22.3" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49193" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.133" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49195" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:40 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.240.206.90" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49191" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:40 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="95.154.193.105" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49187" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:41 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.118" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49197" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:41 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="213.144.15.19" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49189" dstport="443" tcpflags="ACK FIN" 



Aming the destinations are: Google, Astaro etc. (Most of these drops are from websites I have RSS defined on the outlook client)

From the logs it seems that the handshake is wrong and therefore Astaro pf blocks it. However, on my executive reports I am getting port 80 and 443 as the top on the blocked services.


Any help will be much appreciated


This thread was automatically locked due to age.
logfiles_20091216232946.zip
  • 0
    Something in your Skiplist, maybe your client or target URLs? If so you need PFRs.

    Or is your client not allowed to the web proxy?
    -- 
    HTH & MfG, Steffen
  • 0
    all the blogs all from my outlook client (RSS). Let me see if I got that correct,

    I have for example the Mozilla (63.245.208.0/20) network and signing.ebay.co.uk on my skiplist 

    However,on my http log I can see the traffic :s

    2009:12:18-20:24:46 stuffman httpproxy[10056]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.11" user="wingman" statuscode="302" cached="0" profile="REF_gTJkfSrJvf (Trusted clients HTTPS)" filteraction="REF_DefaultHTTPCFFBlockAction (Zone 1)" size="0" time="1229 ms" request="0x880f798" url="ostats.mozilla.com/.../s41077227918431


    2009:12:18-20:45:37 stuffman httpproxy[10056]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.11" user="wingman" statuscode="200" cached="0" profile="REF_gTJkfSrJvf (Trusted clients HTTPS)" filteraction="REF_DefaultHTTPCFFBlockAction (Zone 1)" size="162" time="219 ms" request="0x87fcfb0" url="signin.ebay.com/.../eBayISAPI.dll



    I have no pf with regards to Mozilla/ebay, but it seems that the requests are  going via the HTTP proxy. (HTTPS Certificate is now shown on the ebay webpage
    Any hint Guys?
  • 0 in reply to wingman
    Are you sure the network definition is correct? 

    For me that mozilla domain resolves to 63.235.133.14, or did you typo in the post?
  • 0 in reply to dilandau
    Are you sure the network definition is correct? 

    For me that mozilla domain resolves to 63.235.133.14, or did you typo in the post?


    Mozilla Corporation is 63.245.208.0/20 (63.245.208.0 - 63.245.223.255 )


    The relevant information for the ip you've provided (63.235.133.14):


    OrgName:    Qwest Communications Company  LLC 
     OrgID:      QCC-21 
     Address:    1801 California Street 
     City:       Denver 
     StateProv:  CO 
     PostalCode: 80202 
     Country:    US 
     NetRange:   63.232.0.0 - 63.235.255.255 
     CIDR:       63.232.0.0/14
  • 0 in reply to wingman
    I guess that answers your question why it's showing up in the logs.

    http://ostats.mozilla.com , resolves to 63.235.133.14

    then it must redirect you to Firefox web browser & Thunderbird email client | Mozilla Europe, which is the block you have added to the skip list.
  • 0
    your are right. That's what happening! I am guessing that setting ostats.mozilla.com, on the skiplist will resolve the issue 

    However, I am trying to reduce the number or hosts on the transparent skiplist. Any other ideas of how to resolve it? I've set the Mozilla cooperation on the skiplist cause that's the only way I can update firefox/thunderbird/download addons etc
  • 0
    your are right. That's what happening! I am guessing that setting ostats.mozilla.com, on the skiplist will resolve the issue 

    However, I am trying to reduce the number or hosts on the transparent skiplist. Any other ideas of how to resolve it? I've set the Mozilla cooperation on the skiplist cause that's the only way I can update firefox/thunderbird/download addons etc

    same thing happens to 85.115.22.3 and  66.240.206.90

    The are users that have these ip (blackhat and Astaro ) for RSS but I can see multiple blocks on the firewall and these ip are not defined anywhere on the HTTP proxy as exceptions. I can see both entries going via the proxy


    2009:12:19-10:24:01 stuffman httpproxy[10056]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.17" user="" statuscode="200" cached="0" profile="REF_gTJkfSrJvf (Trusted clients HTTPS)" filteraction="REF_DefaultHTTPCFFBlockAction (Zone 1)" size="379302" time="4551 ms" request="0xb1ccf238" url="www.blackhat.com/.../xml"
    2009:12:19-10:24:01 stuffman httpproxy[10056]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.11" user="wingman" statuscode="200" cached="0" profile="REF_gTJkfSrJvf (Trusted clients HTTPS)" filteraction="REF_DefaultHTTPCFFBlockAction (Zone 1)" size="79416" time="594 ms" request="0xb1ccf4d0" url="up2date.astaro.com/.../xml"


    However, I can see the relevant blocks on the pf for ports 80,443

    10:27:05	Default DROP	TCP	
    192.168.2.17	:	56314
    →	
    85.115.22.3	:	80
    [ACK FIN]	len=40	ttl=127	tos=0x00	
    10:27:06	Default DROP	TCP	
    192.168.2.11	:	56310
    →	
    66.240.206.90	:	443
    [ACK FIN]	len=40	ttl=127	tos=0x00
  • 0 in reply to wingman
    You can use exceptions too. So you're connections can be scanned by AV, checked for certificates and blocked file extensions and so on.

    HTTPS traffic is the only one who is allowed by PF because our ASG needed to be up to 7.502. Transparent skiplist is used to keep away clients from the internet.
    -- 
    MfG, Steffen
  • 0 in reply to trialrider
    You can use exceptions too. So you're connections can be scanned by AV, checked for certificates and blocked file extensions and so on.

    HTTPS traffic is the only one who is allowed by PF because our ASG needed to be up to 7.502. Transparent skiplist is used to keep away clients from the internet.
    -- 
    MfG, Steffen


    So are you suggesting to put the specific URL under exceptions? The clients are able to receive the RSS feeds from Astaro,blackhat but  pf still blocks traffic
  • 0
    The issue was resolved by removing the RSS for the clients as I kept getting the blocks on ASG.(Astaro and blackhat)