Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Need help with Design

    Scheduled Pinned Locked Moved General pfSense Questions
    24 Posts 3 Posters 2.0k Views 3 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S Offline
      stephenw10 Netgate Administrator
      last edited by

      Not excessively because pfSense will just block it anyway. It implies that the 4G router is doing something it shouldn't. Hanlon's razor dictates it's probably just buggy firmware.

      Steve

      D 1 Reply Last reply Reply Quote 0
      • D Offline
        deanfourie @stephenw10
        last edited by

        @stephenw10 but it's possible if the huwawei is compromised, then everything is going through it is vaulnarable to being intercepted?

        Thus, why I don't like it being an upstream gateway rather then being in bridged mode, it's another node sitting on my WAN interface which I cannot intensively monitor.

        B 1 Reply Last reply Reply Quote 0
        • B Offline
          bPsdTZpW @deanfourie
          last edited by

          @deanfourie said in Need help with Design:

          @stephenw10 but it's possible if the huwawei is compromised, then everything is going through it is vaulnarable to being intercepted?

          Sure. And modified if it's plaintext (e.g., DNS responses). This is why I suggest using some form of secure DNS (e.g., DNS over TLS) and a VPN.

          Thus, why I don't like it being an upstream gateway rather then being in bridged mode, it's another node sitting on my WAN interface which I cannot intensively monitor.

          Agree. Alas many ISPs won't let you use bridged mode and/or require you to use their equipment.

          1 Reply Last reply Reply Quote 0
          • D Offline
            deanfourie
            last edited by deanfourie

            This was pulled from my logs today.

            Mar 3 09:17:33 arpwatch 94050 bogon 0.0.0.0 b4:ae:2b:2d:f0:a9
            Mar 3 09:17:34 arpwatch 94050 bogon 0.0.0.0 b4:ae:2b:2d:f0:a9
            Mar 3 09:17:35 arpwatch 94050 bogon 0.0.0.0 b4:ae:2b:2d:f0:a9

            They are everywhere

            Mar 3 14:17:34 arpwatch 94050 bogon 0.0.0.0 b4:ae:2b:2d:f0:a9
            Mar 3 14:17:35 arpwatch 94050 bogon 0.0.0.0 b4:ae:2b:2d:f0:a9
            Mar 3 14:18:00 sshguard 69810 Exiting on signal.

            Mar 3 15:11:05 arpwatch 94050 bogon 0.0.0.0 78:24:af:36:1a:08
            Mar 3 15:11:06 arpwatch 94050 bogon 0.0.0.0 78:24:af:36:1a:08
            Mar 3 15:11:07 arpwatch 94050 bogon 0.0.0.0 78:24:af:36:1a:08
            Mar 3 15:11:08 arpwatch 94050 bogon 0.0.0.0 78:24:af:36:1a:08

            and the list goes on

            Also, I cannot change the LAN subnet mask? What is up with this router? I've never seen that before.

            1 Reply Last reply Reply Quote 0
            • D Offline
              deanfourie
              last edited by

              This post is deleted!
              1 Reply Last reply Reply Quote 0
              • D Offline
                deanfourie
                last edited by

                Ok, so this is starting to look a little bit strange. In ntopng I have devices that are appearing as ghost hosts, and this moves around between devices. This is not a simple network misconfiguration on a basic /24 network.

                Now I'm seeing every time a host connects to the network, there is a ARP entry for that hosts MAC address to ip 0.0.0.0. These constantly change between hosts.

                This looks very suspect to me.

                1 Reply Last reply Reply Quote 0
                • stephenw10S Offline
                  stephenw10 Netgate Administrator
                  last edited by

                  Those are known MAC addresses though? Looks like hosts connecting and broadcasting for DHCP servers to me. Which would be totally normal.

                  D 1 Reply Last reply Reply Quote 0
                  • D Offline
                    deanfourie @stephenw10
                    last edited by

                    @stephenw10 really, do they create arp entries when broadcasting?

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S Offline
                      stephenw10 Netgate Administrator
                      last edited by

                      Not in the arp table but arpwatch does. There's an option to disable it if you don't want to see that:

                      Disables reporting 0.0.0.0 changes, helpful in busy DHCP networks.

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • D Offline
                        deanfourie
                        last edited by

                        I'm still getting this and I honestly don't like it.

                        Why am I getting any other hosts on my WAN interface. This interface consists of just pfsense @ 192.168.1.1 and my upstream gateway @ 192.168.1.2. Why am I seeing external IPs here? Also IPv6 addresses.

                        This seems off to me. Also, it keeps appearing and disappearing.

                        wan1.PNG

                        Any ideas?

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S Offline
                          stephenw10 Netgate Administrator
                          last edited by

                          That's a v6 link-local address. I assume that is not your WAN MAC?

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.