Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Need help with Design

    Scheduled Pinned Locked Moved General pfSense Questions
    24 Posts 3 Posters 2.0k Views 3 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D Offline
      deanfourie @stephenw10
      last edited by

      @stephenw10 but it's possible if the huwawei is compromised, then everything is going through it is vaulnarable to being intercepted?

      Thus, why I don't like it being an upstream gateway rather then being in bridged mode, it's another node sitting on my WAN interface which I cannot intensively monitor.

      B 1 Reply Last reply Reply Quote 0
      • B Offline
        bPsdTZpW @deanfourie
        last edited by

        @deanfourie said in Need help with Design:

        @stephenw10 but it's possible if the huwawei is compromised, then everything is going through it is vaulnarable to being intercepted?

        Sure. And modified if it's plaintext (e.g., DNS responses). This is why I suggest using some form of secure DNS (e.g., DNS over TLS) and a VPN.

        Thus, why I don't like it being an upstream gateway rather then being in bridged mode, it's another node sitting on my WAN interface which I cannot intensively monitor.

        Agree. Alas many ISPs won't let you use bridged mode and/or require you to use their equipment.

        1 Reply Last reply Reply Quote 0
        • D Offline
          deanfourie
          last edited by deanfourie

          This was pulled from my logs today.

          Mar 3 09:17:33 arpwatch 94050 bogon 0.0.0.0 b4:ae:2b:2d:f0:a9
          Mar 3 09:17:34 arpwatch 94050 bogon 0.0.0.0 b4:ae:2b:2d:f0:a9
          Mar 3 09:17:35 arpwatch 94050 bogon 0.0.0.0 b4:ae:2b:2d:f0:a9

          They are everywhere

          Mar 3 14:17:34 arpwatch 94050 bogon 0.0.0.0 b4:ae:2b:2d:f0:a9
          Mar 3 14:17:35 arpwatch 94050 bogon 0.0.0.0 b4:ae:2b:2d:f0:a9
          Mar 3 14:18:00 sshguard 69810 Exiting on signal.

          Mar 3 15:11:05 arpwatch 94050 bogon 0.0.0.0 78:24:af:36:1a:08
          Mar 3 15:11:06 arpwatch 94050 bogon 0.0.0.0 78:24:af:36:1a:08
          Mar 3 15:11:07 arpwatch 94050 bogon 0.0.0.0 78:24:af:36:1a:08
          Mar 3 15:11:08 arpwatch 94050 bogon 0.0.0.0 78:24:af:36:1a:08

          and the list goes on

          Also, I cannot change the LAN subnet mask? What is up with this router? I've never seen that before.

          1 Reply Last reply Reply Quote 0
          • D Offline
            deanfourie
            last edited by

            This post is deleted!
            1 Reply Last reply Reply Quote 0
            • D Offline
              deanfourie
              last edited by

              Ok, so this is starting to look a little bit strange. In ntopng I have devices that are appearing as ghost hosts, and this moves around between devices. This is not a simple network misconfiguration on a basic /24 network.

              Now I'm seeing every time a host connects to the network, there is a ARP entry for that hosts MAC address to ip 0.0.0.0. These constantly change between hosts.

              This looks very suspect to me.

              1 Reply Last reply Reply Quote 0
              • stephenw10S Offline
                stephenw10 Netgate Administrator
                last edited by

                Those are known MAC addresses though? Looks like hosts connecting and broadcasting for DHCP servers to me. Which would be totally normal.

                D 1 Reply Last reply Reply Quote 0
                • D Offline
                  deanfourie @stephenw10
                  last edited by

                  @stephenw10 really, do they create arp entries when broadcasting?

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S Offline
                    stephenw10 Netgate Administrator
                    last edited by

                    Not in the arp table but arpwatch does. There's an option to disable it if you don't want to see that:

                    Disables reporting 0.0.0.0 changes, helpful in busy DHCP networks.

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • D Offline
                      deanfourie
                      last edited by

                      I'm still getting this and I honestly don't like it.

                      Why am I getting any other hosts on my WAN interface. This interface consists of just pfsense @ 192.168.1.1 and my upstream gateway @ 192.168.1.2. Why am I seeing external IPs here? Also IPv6 addresses.

                      This seems off to me. Also, it keeps appearing and disappearing.

                      wan1.PNG

                      Any ideas?

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S Offline
                        stephenw10 Netgate Administrator
                        last edited by

                        That's a v6 link-local address. I assume that is not your WAN MAC?

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.