From owner-freebsd-questions@freebsd.org Sun Feb 3 15:26:57 2019 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 706E514D287D for ; Sun, 3 Feb 2019 15:26:57 +0000 (UTC) (envelope-from srs0=zv/g=qk=sigsegv.be=kristof@codepro.be) Received: from venus.codepro.be (venus.codepro.be [5.9.86.228]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.codepro.be", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 977E4734BF for ; Sun, 3 Feb 2019 15:26:55 +0000 (UTC) (envelope-from srs0=zv/g=qk=sigsegv.be=kristof@codepro.be) Received: from [192.168.228.1] (ptr-8rh08jykuk8yge5dgxt.18120a2.ip6.access.telenet.be [IPv6:2a02:1811:240e:402:21c7:f3e1:842c:3401]) (Authenticated sender: kp) by venus.codepro.be (Postfix) with ESMTPSA id 814C330F1D; Sun, 3 Feb 2019 16:26:47 +0100 (CET) From: "Kristof Provost" To: ASV Cc: "questions list" Subject: Re: PF issue since 11.2-RELEASE Date: Sun, 03 Feb 2019 16:26:38 +0100 X-Mailer: MailMate (2.0BETAr6135) Message-ID: <764DE990-3AC5-43F5-A05B-68C3346AB819@sigsegv.be> In-Reply-To: <8918ed58705259aebcf0b5254fd28d161b4d31b5.camel@inhio.net> References: <989e79372513e9769c6857b531f14df8ce0b6f3a.camel@inhio.net> <51F0845A-2BB3-4BC9-977D-BB0E6C305ED3@FreeBSD.org> <20190129193609.GB57976@vega.codepro.be> <2677833F-B2C4-4CCD-B82F-4F3F84B7FFF8@sigsegv.be> <8918ed58705259aebcf0b5254fd28d161b4d31b5.camel@inhio.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_AA52C6EB-7CA0-4178-B059-2CB47B6265B0_="; micalg=pgp-sha256; protocol="application/pgp-signature" X-Rspamd-Queue-Id: 977E4734BF X-Spamd-Bar: ----- Authentication-Results: mx1.freebsd.org; dmarc=fail reason="" header.from=sigsegv.be (policy=none); spf=pass (mx1.freebsd.org: domain of srs0=zv/g=qk=sigsegv.be=kristof@codepro.be designates 5.9.86.228 as permitted sender) smtp.mailfrom=srs0=zv/g=qk=sigsegv.be=kristof@codepro.be X-Spamd-Result: default: False [-5.46 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; DMARC_POLICY_SOFTFAIL(0.10)[sigsegv.be : SPF not aligned (relaxed), No valid DKIM,none]; RCVD_TLS_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:5.9.86.228]; IP_SCORE(-0.79)[ipnet: 5.9.0.0/16(-1.67), asn: 24940(-2.26), country: DE(-0.01)]; HAS_ATTACHMENT(0.00)[]; MIME_GOOD(-0.20)[multipart/signed,multipart/alternative,text/plain]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; NEURAL_HAM_SHORT(-0.46)[-0.460,0]; TO_MATCH_ENVRCPT_SOME(0.00)[]; TO_DN_ALL(0.00)[]; RCVD_IN_DNSWL_MED(-0.20)[228.86.9.5.list.dnswl.org : 127.0.9.2]; RCPT_COUNT_TWO(0.00)[2]; MX_GOOD(-0.01)[mx2.codepro.be,mx1.codepro.be]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; SIGNED_PGP(-2.00)[]; FORGED_SENDER(0.30)[kristof@sigsegv.be,srs0=zv/g=qk=sigsegv.be=kristof@codepro.be]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:+]; ASN(0.00)[asn:24940, ipnet:5.9.0.0/16, country:DE]; FROM_NEQ_ENVFROM(0.00)[kristof@sigsegv.be,srs0=zv/g=qk=sigsegv.be=kristof@codepro.be]; MID_RHS_MATCH_FROM(0.00)[]; RCVD_COUNT_TWO(0.00)[2] X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Feb 2019 15:26:57 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_AA52C6EB-7CA0-4178-B059-2CB47B6265B0_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 1 Feb 2019, at 10:33, ASV wrote: > On Thu, 2019-01-31 at 22:00 +0100, Kristof Provost wrote: >> On 31 Jan 2019, at 12:11, ASV wrote: >>> Good afternoon, >>> one good news and one bad news. >>> >>> Good news is that it was that bloody zero missing which was >>> "freaking >>> out" PF during the reload. How could I missed that? Perhaps >>> erroneously >>> removed during the upgrade somehow or it was there but not causing >>> problems?! I'll never know. But it's fixed so thank you very much >>> for >>> the good catch! >>> >>> The bad news is that PF is still not enforcing the rules within the >>> anchors. So fail2ban keeps populating the tables where the >>> previously >>> mentioned rules are in place (reposted below) but these IPs keeps >>> bombing me with connection attempts passing the firewall with no >>> problems at all. Killing the states, reloading, restarting (PF and >>> fail2ban) doesn't fix that. >>> >>> # pfctl -a f2b/asterisk-udp -t f2b-asterisk-udp -s rules >>> block drop quick proto udp from to any port =3D >>> sip >>> block drop quick proto udp from to any port =3D >>> sip-tls >>> >>> # pfctl -a f2b/asterisk-tcp -t f2b-asterisk-tcp -s rules >>> block drop quick proto tcp from to any port =3D >>> sip >>> block drop quick proto tcp from to any port =3D >>> sip-tls >> >> I don=E2=80=99t use anchors myself, but don=E2=80=99t you need to call= them from your >> main ruleset? > Anchors are called and the blocking rule is set within: > > anchor f2b { > anchor asterisk { > block in quick log to any > } > } > You have to =E2=80=98anchor "f2b/*=E2=80=9D=E2=80=99 in your main ruleset= to get anchor =E2=80=98f2b/asterisk-tcp=E2=80=99 to be used. Regards, Kristof --=_MailMate_AA52C6EB-7CA0-4178-B059-2CB47B6265B0_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQJHBAEBCAAxFiEE4RTZ6pCe1GmPVxelfRWRxp768oYFAlxXCC4THGtyaXN0b2ZA c2lnc2Vndi5iZQAKCRB9FZHGnvryhppyEACLd+FevUQIFAeAHwXSunEQJK5BjZvz riKHoSa4F63kPcemOXV5iS1yM7hC58/PmuxixbgzUNZO3Q2Zp3JCOhBgjhZHdro2 ziFpDMSNH3BpbuQb6AMjREZO+ztWyTxVKeGqhxkwsagvPbE47CMDDGcro4cATty/ w7fyCSJKr2cKOu8y2vsw/qyNJNvGFJ0cBDh4SZ7VJLFHC0lMYXsCyhuOF6fySTuz IABr6MOfTX5/4L3SlosD/cLdA7upAH9inVXKvQPLQlEFJZpXpQpyQzKXhY99yenO 4kkx2TnskRs172K25KE8n/I18yjDe5DFh79L9Bm6ff0xoq+2teSgpMBm26l/ljhl nFHnepgocQ8meHKZh0c2OXWnU19VHRe5k9s0IouaK2266StJFttnHH1CCwZNLReu MdaiiCCNmdM887vEM2tLWYfCprdD4QGGeOvXqv9PsVZrKjMKC0qtYUgAdwXl2FHH UTPSeJ5jrlFjZbbFx6UYrboCIOxVoasm7PQAUIMa5BW/OuNiOL3zf/wuYxR8Qqn3 vu2iQB1BuJsJ3s2CoMjbUqe0RCbC6lAfgPFyjM9oX8qxVr1TDSVIgibXGsw8Sfdx KNaawv9VFK3QYISidVXW7+4THJhv3It7Q5k6eArUlB0Z/EXzyvwPDkEJtUMToNTD 4ikBVuBCSxhQYg== =2yPK -----END PGP SIGNATURE----- --=_MailMate_AA52C6EB-7CA0-4178-B059-2CB47B6265B0_=--