While exploring the
configuration options on the Juniper SRX firewall, I stumbled upon the
so-called firewall filters. These filters are not to be mistaken for the
firewall policy rules. They are something different, but can be used
for achieving similar goals.
In
my case, I wanted to see if it was possible to quickly block a list of
IP addresses (or subnets) without the hassle of creating addressbook
entries (Address Sets). My list of IP addresses consists of known hosts that participate in the criminal ZeuS network.
These IP addresses are either Command&Control servers or servers
used to transfer (captured) data to. In any case, servers you don't want
to communicate with.
The
solution on the SRX is to create a firewall filter containing the list
with hosts / networks. The filter, in my case, is applied to the
outgoing interface (fe-0/0/0).
Normally, one would enable logging on each security policy. If you have
hundreds of policies, and you want/need logging for troubleshooting, it
takes a while (and some serious) effort to enable this for all policies.
Ever since the upgrade to Apple
OS X Mountain Lion (10.8) on my MacBook (v5.1) I encountered wireless
problems every now and then. These 'experiences' are documented in two
different blog posts here and here.
At
the time I was also running an 'old' version of Little Snitch (v2.x).
After installing v3.0.1 my problems seemed to have solved... Seemed,
until I upgraded Little Snitch to v3.0.2.
After
the (mandatory) reboot my wireless connections were gone. The adapter
wouldn't go active. The symptoms being the exactly the same as before.
So I have no doubt, that Little Snitch had something to do with it.
A while back I had regular issues with the wireless adapter on my MacBook after I had upgraded to OSX Mountain Lion, but after the removal of Little Snitch (I still ran the beta version) it seemed that times were a changing... Seemed that is.
This morning I was fiddling about with my photo website, and needed to see the results in several different browsers. One of them being Google Chrome.
Trying to launch the Chrome app, it crashed immediately. Reopening didn't help. So I tried to download a newer version, since I hadn't updated mine since the upgrade to Mountain Lion. The result; It still crashed. Even after removing all Chrome (and Google) references on the disk, it still crashed.
So, it became time to consult the book of knowledge, and see what the Internets had to say about my little ordeal.
At the house I have currently two ISP delivering broadband. Well, broadband isn't the correct word, since the the one of them is only a mere 256kbps (I think). The other is a 'whopping' 20Mbps.
The 20Mb connection is provided by XS4ALL, and the 256kbps is for free (if you have a phone subscription with Ziggo). The 256kbp is the minimum they provide to transport the phone calls, but if you're a masochist you can also browse the internet over that connection.
So, two ISP @ home. Combine that with a Juniper SRX firewall, and a dual ISP setup is born. The theory of that setup is that I connect both ISP's to the firewall, and use the 20Mb line as a default internet connection, but when that one dies, I automatically get switched to the backup line (256kbps).
Last night I was minding my own business on the couch, when the wireless connection on my MacBook (UniBody) decided to call it a day. According to the symptoms (no bars visible in the WiFi icon in the menu bar, no visible wireless networks in the vicinity), the WiFi adapter was turned off. Turning the WiFi back on was not possible though.