This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Question regarding HTTP and PF rules

Hi All

I am viewing multiple blocks on my firewall regarding HTTP/HTTPS traffic. I am using https proxy and my understanding is that once a packet is in the system it will be dealt by only one function (for example either pf or proxy). I am trying to understand why my client 192.168.2.11 has so many blocks on the pf when the host is using https proxy(Transparent mode).

Log of the pf

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="85.115.22.3" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49193" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.133" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49195" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.240.206.90" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49191" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="213.144.15.19" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49189" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="95.154.193.105" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49187" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.118" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49197" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="213.144.15.19" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49189" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.133" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49195" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.240.206.90" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49191" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="85.115.22.3" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49193" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="95.154.193.105" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49187" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.118" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49197" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="213.144.15.19" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49189" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="85.115.22.3" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49193" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:39 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.133" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49195" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:40 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.240.206.90" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49191" dstport="443" tcpflags="ACK FIN" 

2009:12:16-18:39:40 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="95.154.193.105" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49187" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:41 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="66.102.13.118" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49197" dstport="80" tcpflags="ACK FIN" 

2009:12:16-18:39:41 stuffman ulogd[3355]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" seq="0" initf="eth1" outitf="eth2" dstmac="00:b0:c2:02:e4:4f" srcmac="00:b0:c2:02:e3:c7" srcip="192.168.2.11" dstip="213.144.15.19" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="49189" dstport="443" tcpflags="ACK FIN"

Aming the destinations are: Google, Astaro etc. (Most of these drops are from websites I have RSS defined on the outlook client)

From the logs it seems that the handshake is wrong and therefore Astaro pf blocks it. However, on my executive reports I am getting port 80 and 443 as the top on the blocked services.

Any help will be much appreciated

This thread was automatically locked due to age.

logfiles_20091216232946.zip

Parents

0 wingman over 16 years ago

your are right. That's what happening! I am guessing that setting ostats.mozilla.com, on the skiplist will resolve the issue

However, I am trying to reduce the number or hosts on the transparent skiplist. Any other ideas of how to resolve it? I've set the Mozilla cooperation on the skiplist cause that's the only way I can update firefox/thunderbird/download addons etc

same thing happens to 85.115.22.3 and 66.240.206.90

The are users that have these ip (blackhat and Astaro ) for RSS but I can see multiple blocks on the firewall and these ip are not defined anywhere on the HTTP proxy as exceptions. I can see both entries going via the proxy

2009:12:19-10:24:01 stuffman httpproxy[10056]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.17" user="" statuscode="200" cached="0" profile="REF_gTJkfSrJvf (Trusted clients HTTPS)" filteraction="REF_DefaultHTTPCFFBlockAction (Zone 1)" size="379302" time="4551 ms" request="0xb1ccf238" url="www.blackhat.com/.../xml"
2009:12:19-10:24:01 stuffman httpproxy[10056]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.11" user="wingman" statuscode="200" cached="0" profile="REF_gTJkfSrJvf (Trusted clients HTTPS)" filteraction="REF_DefaultHTTPCFFBlockAction (Zone 1)" size="79416" time="594 ms" request="0xb1ccf4d0" url="up2date.astaro.com/.../xml"

However, I can see the relevant blocks on the pf for ports 80,443

10:27:05	Default DROP	TCP	
192.168.2.17	:	56314
→	
85.115.22.3	:	80
[ACK FIN]	len=40	ttl=127	tos=0x00	
10:27:06	Default DROP	TCP	
192.168.2.11	:	56310
→	
66.240.206.90	:	443
[ACK FIN]	len=40	ttl=127	tos=0x00

Reply

0 wingman over 16 years ago

2009:12:19-10:24:01 stuffman httpproxy[10056]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.17" user="" statuscode="200" cached="0" profile="REF_gTJkfSrJvf (Trusted clients HTTPS)" filteraction="REF_DefaultHTTPCFFBlockAction (Zone 1)" size="379302" time="4551 ms" request="0xb1ccf238" url="www.blackhat.com/.../xml"
2009:12:19-10:24:01 stuffman httpproxy[10056]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.11" user="wingman" statuscode="200" cached="0" profile="REF_gTJkfSrJvf (Trusted clients HTTPS)" filteraction="REF_DefaultHTTPCFFBlockAction (Zone 1)" size="79416" time="594 ms" request="0xb1ccf4d0" url="up2date.astaro.com/.../xml"

However, I can see the relevant blocks on the pf for ports 80,443

10:27:05	Default DROP	TCP	
192.168.2.17	:	56314
→	
85.115.22.3	:	80
[ACK FIN]	len=40	ttl=127	tos=0x00	
10:27:06	Default DROP	TCP	
192.168.2.11	:	56310
→	
66.240.206.90	:	443
[ACK FIN]	len=40	ttl=127	tos=0x00

Children

0 trialrider over 16 years ago in reply to wingman

You can use exceptions too. So you're connections can be scanned by AV, checked for certificates and blocked file extensions and so on.

HTTPS traffic is the only one who is allowed by PF because our ASG needed to be up to 7.502. Transparent skiplist is used to keep away clients from the internet.
--
MfG, Steffen
Cancel
Vote Up 0 Vote Down

Cancel
0 wingman over 16 years ago in reply to trialrider

You can use exceptions too. So you're connections can be scanned by AV, checked for certificates and blocked file extensions and so on.

HTTPS traffic is the only one who is allowed by PF because our ASG needed to be up to 7.502. Transparent skiplist is used to keep away clients from the internet.
--
MfG, Steffen

So are you suggesting to put the specific URL under exceptions? The clients are able to receive the RSS feeds from Astaro,blackhat but pf still blocks traffic
Cancel
Vote Up 0 Vote Down

Cancel