Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Cloudflare:443 in fw log...

    Scheduled Pinned Locked Moved General pfSense Questions
    16 Posts 3 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      furom
      last edited by furom

      Hi,

      Trying to understand and remedy some unnecessary blocks in my firewall, and found that UDP/443 outbound to Cloudflare-ip's are being blocked. I do use their DNS, but that uses another port. How can I know what/why this is used for?

      Thinking it can be Firefox, but DNS over HTTPS is not turned on there, so probably something else, right?

      Thanks

      M johnpozJ 2 Replies Last reply Reply Quote 0
      • M
        mer @furom
        last edited by

        @furom I think it may be QUIC (A Google developed thing)

        1 Reply Last reply Reply Quote 1
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @furom
          last edited by johnpoz

          @furom udp on 443 would not be doh.. Would be quic most likely

          https://cloudflare-quic.com/

          https://blog.cloudflare.com/the-road-to-quic/

          edit: now is going to actual 1.1.1.1 IP - then it could be DoQ (DNS over Quic) or DoH3

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 2
          • F
            furom
            last edited by

            Thanks guys. It sounds reasonable, and from what I read so far, it should be something one normally would want, right?

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @furom
              last edited by johnpoz

              @furom I personally would not want DoQ or DoH3 being used no..

              You need to determine if actually its dns or to just some website.. What specific IP is it going to? Is it 1.1.1.1 or one of their other DNS IPs, or just some other IP that is owned by cloudflare - cloudflare proxies/caches like all of the internet ;) heheheh Or a huge chunk of it..

              I just personally block all traffic to 1.1.1.1 and also have rules for blocking doh, which can run on other ports as well.. There are many lists you can find for blocking doh in all its nasty forms.. Lists of IPs of doh servers..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              F M 2 Replies Last reply Reply Quote 1
              • F
                furom @johnpoz
                last edited by

                @johnpoz said in Cloudflare:443 in fw log...:

                some other IP that is owned by cloudflare

                Yes, it is a seemingly "random" Cloudflare IP... So could be just about anything. Just now reading about Firefox''s implementation of it. If I can turn it off to test, I'd know, else I guess it's a bit tricky?

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @furom
                  last edited by johnpoz

                  @furom yeah it could just be going to www.somethingyouwantgoto.com just using quic, you should be able to turn it off in firefox.

                  that first link I posted should tell you if your using quic to get there.. Mine says its not.. Just http3

                  Are you using firefox nightly or beta, I didn't think quic was part of normal firefox as of yet..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  F 1 Reply Last reply Reply Quote 0
                  • F
                    furom @johnpoz
                    last edited by furom

                    @johnpoz No, just getting plain ol' http/2, no fancy stuff here... :) And no, running FF stable. But then again, it may fail to negotiate http/3 because of my blocking UDP/443... Http/3 is enabled in about:config atleast

                    johnpozJ 2 Replies Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @furom
                      last edited by

                      @furom then you really shouldn't be seeing UDP to 443..

                      So when you go to the test what does it say only http/2 ?

                      If you call up the dev tools in firefox and reload on the network tab what does it show you for protocol?

                      webtools.jpg

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @furom
                        last edited by

                        @furom said in Cloudflare:443 in fw log...:

                        because of my blocking UDP/443

                        Oh your blocking it at pfsense.. Ah ok.. Your blocking it to any IP.. I just block it to known doh servers which could be doing DoQ as well.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        F 1 Reply Last reply Reply Quote 0
                        • F
                          furom @johnpoz
                          last edited by

                          @johnpoz said in Cloudflare:443 in fw log...:

                          Your blocking it to any IP

                          Well, kind of, I haven't explicitly allowed UDP/443 either, so gets blocked. :) I could try another browser and see what happens

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @furom
                            last edited by

                            @furom said in Cloudflare:443 in fw log...:

                            I haven't explicitly allowed UDP/443 either, so gets blocked

                            Ah your not using default any any rule on lan, you just allow specific ports and protocols.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            F 1 Reply Last reply Reply Quote 0
                            • F
                              furom @johnpoz
                              last edited by

                              @johnpoz said in Cloudflare:443 in fw log...:

                              Ah your not using default any any rule on lan, you just allow specific ports and protocols.

                              Yes, I thought I'd try that. But is a really bumpy road... :) Turning off http3 in FF did seem to get rid of the UDP/443 blocks I had before, only to see a whole bunch of blocked TCP with all sorts of flags. Googling a bit, I found this post https://forum.netgate.com/topic/36362/log-shows-tcp-fa-tcp-fpa-blocked-from-lan, so guess I should not dig too deep in those.

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @furom
                                last edited by

                                @furom well those sorts of things can point to asymmetrical.. But a few now and then could just be because of loss of state on pfsense, and client still trying to use the same session..

                                If you just did a switch and of something, and you see a few of those I wouldn't worry to much. But if you continue to see them, and a lot of them then yeah I would look into why..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                F 1 Reply Last reply Reply Quote 1
                                • F
                                  furom @johnpoz
                                  last edited by

                                  @johnpoz said in Cloudflare:443 in fw log...:

                                  But if you continue to see them, and a lot of them then yeah I would look into why..

                                  They are already a lot less frequent, so think you are right. I learn a lot here, thanks!

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    mer @johnpoz
                                    last edited by

                                    @johnpoz said in Cloudflare:443 in fw log...:

                                    just personally block all traffic to 1.1.1.1

                                    Floating rule, out WAN, quick, source any/any destination 1.1.1.1/any?

                                    Thanks

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.