pfSense + Snort: (spp_frag3) Fragmentation overlap.

[fdem 0]

Hi,

 

I'm using pfSense 2.1.4-RELEASE (amd64) + pfblocker + snort.

When using AirVPN from a Win7-64bit machine inside my LAN network (official OpenVPN client v. 2.3.4-I001), after a few minutes, I get this messages in the Service --> Snort --> Blocked:

• (spp_frag3) Fragmentation overlap or
• (spp_frag3) Fragmentation overlap + (spp_frag3) Teardrop attack.

In this situation the OpenVPN client on the Win7 machine stops working (yellow icon).

Three days ago pfSense notified me "PF was wedged/busy and has been reset"

I had to restart pfSense!!! :-(

pfblocker filters:

• Bluetack IP Filter
• ET blockrules compromised
• ET fwrules emerging Block IPs

SNORT rules: VRT paid Subscriber + ETOpen.

 

Thanks.

[pfSense_fan 181]

I used snort for over a year on pfSense while connected to AirVPN (now using Suricata) and never had this issue.

 

This begs the questions though... why use the Windows OpenVPN Client when you can use pfSense to connect instead? Your connection is safer using pfense as the OpenVPN client.

 

Another thing to point out... unless you pay for bluetack, the free bluetack lists are a year to two years out dated. Bluetack became a premium service some time ago and the free lists have not been updated since.

 

 

Also... reading up just now what a teardrop attack is, you most likely get that warning because your bootloader and system tunables are not optimized for your system.

 

Really though, use pfSense as the OpenVPN client and this will go away.

[fdem 0]

Hi pfSense_fan

 

sorry for my late reply. Yes I'm going to implement your solution, so pfSense will be connected to AirVPN as a client.

 

But, I'm wondering why my bootloader and system tunables are not optimized for my system...

 

My setup:

 

pfSense firewall 2.1.5-RELEASE (amd64)
motherboard: MSI C847MS-E33 Micro ATX (with Intel Celeron CPU 847 @ 1.10 GHz) ~ PSU: Corsair VS350 ~ RAM: Kingston KVR1333D3E9S 4096 MB 240-pin DIMM DDR3 SDRAM 1.5 volt ~ NIC: Intel EXPI9301CTBLK (LAN) ~ NIC: D-Link DFE-528TX (WiFi) ~ Hard Disk: Western Digital WD10JFCX Red.