Blocked China Mainland via geo ip, yet it still allowed it to get to the firewall

Follow

Christian Massie

• April 16, 2020 05:25

Hello, I was alerted tonight thankfully that SSH was being fussed on my Firewalla from an identified IP in China mainland. However I had set a rule to block China mainland, how was this bypassed? I had checked the rule and verified the IP and captured the MAC it was presenting (I imagine spoofed of some sort due to its vastly misidentifying characteristics) and blocked it on my edge firewall, but this is concerning that it somehow got the ability to guess ssh. I run Nessus and other things internally, but it comes from the inside when searching. I run a Palo Alto firewall on the edge, and was testing this firewall for its capabilities. There are things I have noticed that could use a little TLC as far as security goes (obviously without the need for enterprise level as I do) but was wondering if I could have some help understanding why this failed to protect as it should have.

1

• 

  Firewalla

  • April 16, 2020 06:00

  Need to understand your topology a bit.   From reading your notes, is it

  [PA Firewall] <--->[edge firewall?]<---> Firewalla 

  And you are detecting the China IP on the PA system or via Firewalla Alarms?

  Also, feel free to email us help@firewalla.com in case you want a faster reply. 

  1

  Comment actions Permalink
• 

  Christian Massie

  • April 16, 2020 13:31

  PA is the edge, Firewalla is internal. I allowed all traffic for a bit on the PA to test the Firewalla and see what all it could do, and it didn’t block the China IP. I detected it on the Firewalla as I allowed pass through.

  1

  Comment actions Permalink
• 

  Firewalla

  • April 16, 2020 17:51

  Couple quick questions

  1. How are you diverting traffic from your router to firewalla?  I assume you did a port forwarding of ssh, is that right?

  2. How did you see the attack traffic on the firewalla? is it via a sniffer outside firewalla, or inside?

  3. What is the IP address that's attacking? (we need to check the DB and see it is marked in our DB as china)

  1

  Comment actions Permalink
• 

  Christian Massie

  • April 16, 2020 18:45

  Traffic was diverted from the PA (router and firewall) to the Firewalla. Basically became a DMZ. Firewalla then became the only firewall. (This was a test to see if PA ever crashed or failed to block a source somehow that Firewalla would block it with geo ip.

  Attack traffic came through the Firewalla as a guessing SSH. Since I have no active log or anything from the Firewalla (and have not gone in and figured out how to push syslogs to my blade for historical data) all I saw was the alert about 20 to 30 mins after the original traffic began.

  The IP Address of the attacker was 49.88112.77. After completing the Whois it’s from the jiangsu province.

  1

  Comment actions Permalink
• 

  Support

  • April 17, 2020 08:07
  • Edited

  Hi Christian,

  We cannot really stop traffic from "reaching" Firewalla, but stopping it from going to your network is what we can do.

  You case is a little bit special as you set Firewalla in DMZ. We do have feature like inbound firewall implemented, but it's not ready for production and there's no UI for that. If you are willing to try, we can enable that for you manually. Write a mail to help@firewalla.com and there'll be people glad to help you :)

   

  1

  Comment actions Permalink
• 

  Christian Massie

  • April 17, 2020 14:27

  I will gladly do so now. Thank you. Also, the reason kept a lot of the problem here was to have a open discussion about problems we experience so the community can see if they experience something similar. That way folks see a list of current issues or things that are in progress. Really appreciate your time!

  1

  Comment actions Permalink

Please sign in to leave a comment.