I've setup virus entries in the firewall filter and set them to send to the syslog. Apparently I have two different kinds of viruses. Now #1 this is all that appears in the log. Can this firewall entry be mistaking something a cellphone was trying to do for a virus?
#2 though, okay this is the blaster virus but why the hell is it trying to talk to an ip address that does not exist on our network (192.168.1.100)?mobile-166-147-113-103.mycingular.net ) :1029, len 153mobile-166-147-113-103.mycingular.net ) :1029, len 52mobile-166-147-113-103.mycingular.net ) :1029, len 1532011-09-27 08:02:24 Daemon.Info 192.168.16.252 Sep 27 07:18:35 MikroTik BLASTER VIRUS ON TCP forward: in:LAN out:WAN, src-mac 00:23:15:99:xx:xx, proto TCP (SYN), 192.168.16.20 (JEFF-LAPTOP) :49342->192.168.1.100 (unresolved) :139, len 52
Anybody have any idea about this? I looked at the users computer and he has a shared network drive pointing to that 192.168.1.100 ip, and he has to use a sonicwall sslvpn to connect to it.
CCDKP
October 13, 2011, 3:33pm
3
What are you using for “virus rules”?
Typically just filtering based on a single port number is prone to a LOT of false positives and is not recommended. From the best I can tell, your “virus” in example 1 is someone’s phone making an ssl connection back to their company’s webpage (most likely Exchange ActiveSync).
My general rule with “virus” filters is don’t use them unless you explicitly understand how and what they are flagging and have a reason to be flagging it. If you couldn’t write that rule yourself, it will probably just cause you trouble down the road, ESPECIALLY with port based filters. Since most viruses change ports now anyway, it really defeats the point even more so.
That said, it isn’t a bad idea to have a few logging things just to keep an eye on certain “high value” indicators. Watching for excessive use of SMTP (TCP 25), Windows File Sharing (TCP 445,139 & UDP 137,138), and maybe MS SQL (TCP 1433,1434). Again, some traffic on these is normal or can be simple misconfigurations. What you want to look for is things like 10 new connections in a 30 second window, which indicates something actively scanning and looking for outside hosts.
CCDKP:
What are you using for “virus rules”?
Typically just filtering based on a single port number is prone to a LOT of false positives and is not recommended. From the best I can tell, your “virus” in example 1 is someone’s phone making an ssl connection back to their company’s webpage (most likely Exchange ActiveSync).
My general rule with “virus” filters is don’t use them unless you explicitly understand how and what they are flagging and have a reason to be flagging it. If you couldn’t write that rule yourself, it will probably just cause you trouble down the road, ESPECIALLY with port based filters. Since most viruses change ports now anyway, it really defeats the point even more so.
That said, it isn’t a bad idea to have a few logging things just to keep an eye on certain “high value” indicators. Watching for excessive use of SMTP (TCP 25), Windows File Sharing (TCP 445,139 & UDP 137,138), and maybe MS SQL (TCP 1433,1434). Again, some traffic on these is normal or can be simple misconfigurations. What you want to look for is things like 10 new connections in a 30 second window, which indicates something actively scanning and looking for outside hosts.
Yea they are port based. I setup these rules based off an online course for Mikrotik I had found. I figured false positives would be pretty high with this method. Has someone scripted a better set of rules out there that really can detect them in a better manner? Here are my firewall rules. Thanks!
CCDKP
October 18, 2011, 1:47pm
5
On of the big reasons you are seeing false positives is because when a computer makes an outbound connection, it picks a random source port greater than 1024. While this packet would make it through your rules, the return packet could trip your virus rules as it could be a “virus” destination port.
Honestly, since most viruses use random ports anymore, I wouldn’t suggest running one of these lists, they don’t do anything besides cause trouble and waste your time chasing viruses which aren’t there. Just monitor a few “risky” ports like I mentioned above and you should be fine.
If you still want to run one, some considerations:
An “allow established” rule at the top will stop false positives on return packets. It will also greatly reduce CPU load as each packet won’t have to be matched against the whole chain.
At the bottom you are only allowing ICMP, TCP, and UDP, then blindly dropping all other IP protocols. You are breaking lots of things including PPTP vpn’s (IP47 GRE), 6to4 IPv6 tunneling (IP41 IPv6), and anything using IPSEC (IP50 ESP, IP51 AH).