Clarification in blocks in the firewall logs.
-
@johnpoz I'm not reflecting internal traffic for the WAN IP so not NAT Reflection. These are external locations that are forwarded to an internal server.
-
@stewart well that is easier to explain then.. Its just out of state traffic.. And your server is just answering.. For whatever reason I read that sourceIP as being internal? doh...
You sure your states didn't just get reset, do these come in groups? But yeah as discussed out of state traffic is blocked on a stateful firewall. Why there is no state would be the question - maybe server answering really late? Maybe there was a fin/ack that closed the state and and A after the fact, etc..
If you see it a lot - do some packet captures of this traffic between external IP and your server so you can see if there is fin,acks that close the state and then acks after, that sort of thing.
-
@johnpoz Relatively sporadic it seems. The sites have equipment that check in every 5 minutes or so over port 80 so there are at least 12,000-15,000 checkins per hour. I see a few of these drops per day so nothing widespread.
-
What do you have set here?
https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html
if you only seeing a few here or there - it could be something as odd as retrans after a fin,ack that closed the state..
edit: you sure that source IP is one of the devices that should be checking in?? It could just be spurious noise from the internet as well.. I don't log that traffic on my wan, only syns - since there is lots of noise on the internet.
An ACK wouldn't open a state - so yeah pfsense blocks such noise even if you forward the port the traffic comes in on. I turn off logging of the default rule, and have my own rule that only logs tcp SYN.. and than another rule that logs common udp ports that would be of interest.
edit:
-
-
@stewart
Click the "Display Advanced"?Nope, just checked mine, I have it but it's not in advanced.
Odd that you don't.
Was that added in 2.7 maybe? -
@jarhead hmmm - wonder if that is + thing, I'm running 22.05 - maybe will show up in 2.7 of CE?
-
@johnpoz Yeah, it's not under advanced either. Might be a 2.7 thing. Either way I think they question is resolved. Thanks for the insight and have a great weekend!
-
@stewart you too.. But curious now if really out of state or just noise ;)
-
@johnpoz The world may never know...
-
@stewart hahaha <rofl>
