Suspicious Traffic?
-
Please feel free to move if this is in the wrong place!
So, I'm not rocket scientist but something strange is definitely going on! I have pfSense WAN behind a upstream gateway which is a Huawei B535 wireless 4G router on the 192.168.8.0/24 network.
pfSense then sits on the LAN side with a 172.16.1.0/27 network.
When scanning hosts on the WAN interface using ntopng, I often see my upstream gateway, 192.168.8.1 change its IP address to a public WAN IP. It displays with a ghost icon next to it, then everything flips back to normal, 192.168.8.2 and 192.168.8.1 are the only hosts shown on the WAN interface with no ghosts, then back again to 1 or 2 ghosts shown on WAN, and a PUBLIC IP shown instead of a private LAN IP of 192.168.8.1. Also, the Ipad seems to flip back and forth between ipv4 and ipv6.
There are also some clients currently connected directly to the upstream gateway on the WAN side of pfSense while I troubleshoot this .
Also, I am getting DNS warning, and a lot of DNS traffic to strange GeoIP locations, Korea, China etc. Im not sure if this is normal or not but it does seem like a lot of DNS traffic considering I have shrunk this network down to only 2 hosts max for the purposes of troubleshooting.
All my LAN hosts also show as on GHOST networks, with the little ghost man showing. This is not a network configuration as all clients have been given a 255.255.255.224 mask for a /27 network.
I have also seen SSH traffic appearing in my flows. It appears to have no real payload but it shows up as SSH. Ill attach a screenshot of that too.
Thanks for reading. I can supply captures if required on whatever you need.
Much appreaciated!
-
@deanfourie not exactly sure what your concerned with but 0 ttl is quite common if you have serve 0 set in unbound.
-
@johnpoz Yea im not too concerned about the DNS TTL. I think that might be something to do with my pfBlocker I havent looked into it yet,
more concerned with the WAN router changing its IP address to a WAN ip.
-
@deanfourie where are you seeing that?
-
@johnpoz Second image, small one on the WAN interface network scan.
-
@deanfourie please point out the exact thing your talking about.
-
@johnpoz
First host is my upstream gateway
-
@deanfourie the 162.159 address? That you see the mac of?
I don't show that mac as valid registered mac address. 82:49:99
-
@johnpoz said in Suspicious Traffic?:
@deanfourie the 162.159 address? That you see the mac of?
Correct, the MAC is the correct MAC address of the 4G router.
-
@deanfourie said in Suspicious Traffic?:
the MAC is the correct MAC address of the 4G router.
Its not a registered mac - I can find no listing for 82:49:99?
If if that is mac of your device - I am not clear to what the issue is? You shouldn't be seeing it on the L2 if its actually the upstream, but I see mac address of my cable modem, for the public IP of the gateway, etc.
-
Ok, let me map it out for you too. Also, this public IP is NOT my public IP.
ISP >>>> 4G Wireless (through the air) >>>>>> 4G Router (Huawei 192.168.8.1 incoming internet) >>>>> pfSense WAN Interface (192.168.8.2) >>>>>>>> pfSense LAN (172.16.101.0/27) >>>>>>> LAN
Upon a scan on the WAN interafce I would expect to see 2 hosts, 192.168.8.1 and 192.168.8.2.
Instead of seeing a private IP on my upstream gateway, I am seeing a public IP that shows as being a datacenter in California somehwere.
Cheers
-
The router is not in bridge mode, so I would not expect to be seeing a public IP, and if I were, I would expect to be seeing my own public IP
-
Its just gone ahead and changed again.
-
@deanfourie I wouldn't trust locations of IPs like that.
Many IP can be just registered to the owning company HQ, etc.
Its quite possible for you to learn the mac address of not connected device when using stuff like 4G or cable modems, etc..
There could be lots of ways on how that mac was learned.. I see arps from all over my ISP network on my wan.. With even different L3 address space, etc.
Maybe your device switches mode from nating to bridge when it looses a connection or when it boots up, etc. If it was actually isolated L2, then no you should see the mac for an address outside that L2.. But with such devices do you really know what its doing and how its doing it?
My cable modem bridges - but I still can access it via 192.168.100.1 address, etc.
If that is IP of your gateway on the wan side of your own device, still not understanding your concern?
-
@deanfourie said in Suspicious Traffic?:
Its just gone ahead and changed again.
Yeah 4G stuff prob going to change all the time... Connection moved to a new tower, different actual connection, etc. etc..
-
@johnpoz nah im really not comfortable with this.
When its at 192.168.8.1, I still have internet. I never see a public IP on its as its double NATting.
Im Natting at pfsense then again at the upstream gateway.What bout these shinnanigans? Some strange SSH and HTTP traffic to a very strange and foreign country?
-
@deanfourie pfsense itself should not be sshing to random IPs.. Or even 80..
What does pfsense show for its state table for those IPs.. If pfsense or a client generated traffic then it would be in the state table.
You sure that is just not traffic inbound from that source port as a SA? That is method of scanning..
Sniff on your wan for those IPs - lets see the pcap file.
-
-
@deanfourie sure you can..
BTW those IPs are owned by Alibaba.com - well known website..
Again did you look in your state table?
-
@johnpoz could it be getting the port mappings all messed up because im double natting?
will check state table now.
