Cloudflare:443 in fw log...
-
Hi,
Trying to understand and remedy some unnecessary blocks in my firewall, and found that UDP/443 outbound to Cloudflare-ip's are being blocked. I do use their DNS, but that uses another port. How can I know what/why this is used for?
Thinking it can be Firefox, but DNS over HTTPS is not turned on there, so probably something else, right?
Thanks
-
@furom I think it may be QUIC (A Google developed thing)
-
@furom udp on 443 would not be doh.. Would be quic most likely
https://blog.cloudflare.com/the-road-to-quic/
edit: now is going to actual 1.1.1.1 IP - then it could be DoQ (DNS over Quic) or DoH3
-
Thanks guys. It sounds reasonable, and from what I read so far, it should be something one normally would want, right?
-
@furom I personally would not want DoQ or DoH3 being used no..
You need to determine if actually its dns or to just some website.. What specific IP is it going to? Is it 1.1.1.1 or one of their other DNS IPs, or just some other IP that is owned by cloudflare - cloudflare proxies/caches like all of the internet ;) heheheh Or a huge chunk of it..
I just personally block all traffic to 1.1.1.1 and also have rules for blocking doh, which can run on other ports as well.. There are many lists you can find for blocking doh in all its nasty forms.. Lists of IPs of doh servers..
-
@johnpoz said in Cloudflare:443 in fw log...:
some other IP that is owned by cloudflare
Yes, it is a seemingly "random" Cloudflare IP... So could be just about anything. Just now reading about Firefox''s implementation of it. If I can turn it off to test, I'd know, else I guess it's a bit tricky?
-
@furom yeah it could just be going to www.somethingyouwantgoto.com just using quic, you should be able to turn it off in firefox.
that first link I posted should tell you if your using quic to get there.. Mine says its not.. Just http3
Are you using firefox nightly or beta, I didn't think quic was part of normal firefox as of yet..
-
@johnpoz No, just getting plain ol' http/2, no fancy stuff here... :) And no, running FF stable. But then again, it may fail to negotiate http/3 because of my blocking UDP/443... Http/3 is enabled in about:config atleast
-
@furom then you really shouldn't be seeing UDP to 443..
So when you go to the test what does it say only http/2 ?
If you call up the dev tools in firefox and reload on the network tab what does it show you for protocol?
-
@furom said in Cloudflare:443 in fw log...:
because of my blocking UDP/443
Oh your blocking it at pfsense.. Ah ok.. Your blocking it to any IP.. I just block it to known doh servers which could be doing DoQ as well.
-
@johnpoz said in Cloudflare:443 in fw log...:
Your blocking it to any IP
Well, kind of, I haven't explicitly allowed UDP/443 either, so gets blocked. :) I could try another browser and see what happens
-
@furom said in Cloudflare:443 in fw log...:
I haven't explicitly allowed UDP/443 either, so gets blocked
Ah your not using default any any rule on lan, you just allow specific ports and protocols.
-
@johnpoz said in Cloudflare:443 in fw log...:
Ah your not using default any any rule on lan, you just allow specific ports and protocols.
Yes, I thought I'd try that. But is a really bumpy road... :) Turning off http3 in FF did seem to get rid of the UDP/443 blocks I had before, only to see a whole bunch of blocked TCP with all sorts of flags. Googling a bit, I found this post https://forum.netgate.com/topic/36362/log-shows-tcp-fa-tcp-fpa-blocked-from-lan, so guess I should not dig too deep in those.
-
@furom well those sorts of things can point to asymmetrical.. But a few now and then could just be because of loss of state on pfsense, and client still trying to use the same session..
If you just did a switch and of something, and you see a few of those I wouldn't worry to much. But if you continue to see them, and a lot of them then yeah I would look into why..
-
@johnpoz said in Cloudflare:443 in fw log...:
But if you continue to see them, and a lot of them then yeah I would look into why..
They are already a lot less frequent, so think you are right. I learn a lot here, thanks!
-
@johnpoz said in Cloudflare:443 in fw log...:
just personally block all traffic to 1.1.1.1
Floating rule, out WAN, quick, source any/any destination 1.1.1.1/any?
Thanks
