We’ve been having a blast with some new intel atom based pfSense firewalls here in the office. The d510 boards perform amazingly well, even with a slew of snort rules loaded up.

We just replaced one of our Juniper SRX series firewalls with one of these little pfSense boxes and wouldn’t you know one of our own snort rules blocked us. Here’s how we got back in:

Gain access to the pfSense shell. We could have walked over to the box but that involved standing up, placing one foot infront of the other and repeating again and again. Bah, who needs all that.

We SSHd to another machine, and from that machine we SSHd to a machine behind our firewall, and from that we SSHd to the LAN IP associated with our firewall. We logged in, chose option 8 (Local Shell), and did the following:

pfctl -t snort2c -T show

This will show you all the IPs that have been blocked by triggering a snort rule

Then run this to remove you IP

pfctl -t snort2c -T delete xxx.xxx.xxx.xxx

You should add your own IPs to the whitelist to prevent this from happening again.