Can someone explain this behavior
-
2.5.2-RELEASE (amd64) seeing events like this in my log:
This makes no sense. There are three blocking rules for this interface:
Only the bottom rule is set to log. The first rule is set to block IPv4 broadcasts, but not log. The second rule is set to block all IPv6, but not log. The last rule is set to block anything IPv4 left, and log it. This is what the middle rule looks like:
Can someone explain to me why this rule isn't matched? and why a log entry is still being created?
-
@eshwayri because you have IPv6 blocked - and it creates a rule that would be above those?
You should enabled description being shown so you know what rule is blocking what.
-
@johnpoz No; I don't have that set.
Good idea to add that filed, but...
So, as you can see it's being blocked by the rule that was told NOT to log, but it logged it anyway.
-
Ah I have to check this box to NOT block IPv6. I flipped that; let's see if it fixes it.
-
@eshwayri You did have it set ;) unchecked is block.. As you can see by the description in your logs ;)
-
@johnpoz Thank you. The logic on that option is inverted, and it didn't compute.
