ABE blocking local LAN systems identified by local DNS?

Discussions about the Application Boundaries Enforcer (ABE) module
Kumba
Posts: 1
Joined: Mon Oct 08, 2012 10:38 pm

ABE blocking local LAN systems identified by local DNS?

Post by Kumba »

I have several resources on my local LAN identified by DNS names running on a local DNS server. However, one of these services, which has software that uses a redirect, is getting blocked by ABE and I can't figure out what syntax to use to allow it.

Currently tried:

Code: Select all

Site LOCAL
Allow from LOCAL .internalserver
Deny
Where ".internalserver" is the name of my internal machine experiencing the problem. But this doesn't work. I even tried using the FQDN of that machine and still can't get it to work. The resource is also on port 8000, so I am not certain if ABE is getting confused by the port syntax on the URL.

Thoughts?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: ABE blocking local LAN systems identified by local DNS?

Post by Thrawn »

I have the same problem, reported at http://forums.informaction.com/viewtopi ... 23&t=10184. Do you see the same kind of message in Tools - Web Developer - Error Console?
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: ABE blocking local LAN systems identified by local DNS?

Post by Giorgio Maone »

Could you please PM me the exact messages you get, the DNS records of each entry involved and any custom ABE rule/attempt you may currently have?
Thanks.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: ABE blocking local LAN systems identified by local DNS?

Post by Thrawn »

Success!
Giorgio Maone wrote:Could you try to change your LOCAL rule into

Code: Select all

Site LOCAL
Accept from LOCAL 
Accept from 161.143.xxx.xxx
Deny
?

LOCAL doesn't like to stay with other addresses in a from clause (I know, it should be documented).
Giorgio Maone wrote:Sorry, forgot all the redirections must be listed in the same Accept clause.
Please try

Code: Select all

Site LOCAL
Accept from LOCAL
Accept from localhost 161.143.xxx.xxx
Deny
That works! Thanks much :).

So, the OP's rule should be something like:

Code: Select all

Site LOCAL
Accept from LOCAL
Accept from .internalsite
Deny
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3369
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: ABE blocking local LAN systems identified by local DNS?

Post by GµårÐïåñ »

Interesting, good to know because my LOCAL on the same line as others has never been an issue. Now that's a head scratcher. Giorgio, is this something relatively new to ABE or been like this always?
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (world is a vampire) Gecko/99999999 (browsers are zombies) AntidoteXXX (users are the virus)
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: ABE blocking local LAN systems identified by local DNS?

Post by Thrawn »

GµårÐïåñ wrote:Interesting, good to know because my LOCAL on the same line as others has never been an issue. Now that's a head scratcher. Giorgio, is this something relatively new to ABE or been like this always?
It doesn't usually cause trouble. You can still link from external sites to local ones. Looks like the problem only occurs if the local site then redirects you.
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:16.0) Gecko/20100101 Firefox/16.0
finamenon
Posts: 2
Joined: Sun Dec 16, 2012 5:19 am

Re: ABE blocking local LAN systems identified by local DNS?

Post by finamenon »

After reading this thread over many times, and this one http://forums.informaction.com/viewtopi ... 23&t=10184, I still can not get ABE to stop blocking my redirects. I have an external domain that redirects to a site I host on the same network, but despite all attempts, it still won't let me use the redirect unless I manually type it in the browser. Anyone have any ideas?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: ABE blocking local LAN systems identified by local DNS?

Post by Thrawn »

finamenon wrote:After reading this thread over many times, and this one http://forums.informaction.com/viewtopi ... 23&t=10184, I still can not get ABE to stop blocking my redirects. I have an external domain that redirects to a site I host on the same network, but despite all attempts, it still won't let me use the redirect unless I manually type it in the browser. Anyone have any ideas?
What have you attempted?

If 'externalsite.com' redirects to 'localsite', then your rules should look like:

Code: Select all

Site localsite
Accept from LOCAL
Accept GET from externalsite.com
Deny

# Default rule
Site LOCAL
Accept from LOCAL
Deny
If 'externalsite.com' links to 'localsite/url1', which then redirects to 'localsite/url2', then your rules should look like:

Code: Select all

Site localsite
Accept from LOCAL
Accept GET from localsite externalsite.com

# Default rule
...
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:17.0) Gecko/20100101 Firefox/17.0
finamenon
Posts: 2
Joined: Sun Dec 16, 2012 5:19 am

Re: ABE blocking local LAN systems identified by local DNS?

Post by finamenon »

Thrawn wrote:
finamenon wrote:After reading this thread over many times, and this one http://forums.informaction.com/viewtopi ... 23&t=10184, I still can not get ABE to stop blocking my redirects. I have an external domain that redirects to a site I host on the same network, but despite all attempts, it still won't let me use the redirect unless I manually type it in the browser. Anyone have any ideas?
What have you attempted?

If 'externalsite.com' redirects to 'localsite', then your rules should look like:

Code: Select all

Site localsite
Accept from LOCAL
Accept GET from externalsite.com
Deny

# Default rule
Site LOCAL
Accept from LOCAL
Deny
If 'externalsite.com' links to 'localsite/url1', which then redirects to 'localsite/url2', then your rules should look like:

Code: Select all

Site localsite
Accept from LOCAL
Accept GET from localsite externalsite.com

# Default rule
...
The second method did it. Thank you :D
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0
Post Reply