topic Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie in Firewall and Security Management

Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implied ru

mahesh — Tue, 07 May 2024 11:46:08 GMT

Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implied rules. Below is the rule that was added in the gateway.

fwaccel dos rate add -action drop -log regular source cc:BR pkt-rate 0 service any

fwaccel does not block them though the rule blocks Brazil but the idea of the fwaccel rule was to override this implied rule for traffic from Brazil.

Can someone please assist ?

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

the_rock — Tue, 07 May 2024 12:23:39 GMT

Did you try block using updatable object as a country?

Andy

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

G_W_Albrecht — Tue, 07 May 2024 12:51:33 GMT

fwaccel dos is meant for D0S attacks, not Geo IP - you can only blacklist IPs and block DoS attacks using a rate limit...

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

mahesh — Tue, 07 May 2024 12:58:20 GMT

Yes, earlier there was a DDOS attack and customer tried blocking the traffic from Brazil using country code "BR" but it did not work so he added manual rules to block the traffic.

Later, we suspected an issue with IpToCountry mapping and so updated the IpToCountry.csv file and then removed all the manual entries and it almost worked fine. But still observing some 443 traffic from Brazil accepted by Implied rules.

I believe fwaccel rule should block all the traffic coming from Brazil but it is still allowed by Implied rules.

Is there any suggestion ?

Appreciate your help !

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

the_rock — Tue, 07 May 2024 13:06:32 GMT

One thing to check, though dont believe its recommended to modify the implied rules, would be to look at $FWDIR/lim/implied_rules.def file on mgmt server

Andy

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

mahesh — Tue, 07 May 2024 13:09:54 GMT

May I ask what to check exactly in the file ?

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

the_rock — Tue, 07 May 2024 13:10:59 GMT

Not sure at this point. I might be able to make logical guess if you send the implied rule log.

Andy

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

mahesh — Tue, 07 May 2024 13:28:31 GMT

Below is the log screenshot of Smart console logs.

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

the_rock — Tue, 07 May 2024 13:30:44 GMT

Can you double click on one of those logs for details?

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

G_W_Albrecht — Tue, 07 May 2024 13:31:05 GMT

https://support.checkpoint.com/results/sk/sk105740

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

PhoneBoy — Tue, 07 May 2024 22:55:38 GMT

A rate limit of zero should prevent any data from passing, but I don't believe it will prevent the connection from being established.
You may want to confirm this with TAC.

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

mahesh — Wed, 08 May 2024 03:28:54 GMT

I am aware of this sk but the idea of the fwaccel rule was to override this implied rule for traffic from Brazil. It should block all the traffic before hitting Implied rules I believe.

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

CheckPointerXL — Fri, 10 May 2024 20:13:57 GMT

If i remember correctly, with fwaccel dos rules, log about implied rules are shown like accept but traffic is dropped. I will post reference if i found it

Anyway, try traffic from brazil if you can and verify by CLI if traffic is accepted for real or if it is dropped

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

the_rock — Fri, 10 May 2024 20:53:42 GMT

Thats true.

Re: Traffic from Brazil was blocked using fwaccel dos rules but seeing 443 traffic allowed by Implie

the_rock — Sat, 11 May 2024 12:50:30 GMT

@mahesh Were you able to sort this out?

Andy