Strange blocking not matching a rule

t0m77

Hi

Could you help me to understand or investigate on this strange behavior?

Its on a home network and so a quite simple config.
My LAN is 192.168.1.0/24
My DMZ is 192.168.2.0/24

I have the following rules for LAN

Note that last line with 3306 port (MySQL), was added after the problem happened, when I was inspecting the logs. So consider that this entry doesn't exist.

All traffic on any port from LAN to anything (and thus including DMZ) is supposed to be allowed. I have nothing in the DMZ rules that would block inbound traffic from LAN. Only everything from DMZ to LAN is blocked. I've got 6 servers in the DMZ running a lot of things on a lot of ports, and I have zero issue reaching them from my LAN.

But this morning I have noticed all those blockings that happen mostly everyday for a short period of time:

192.168.1.3 is a linux VM in the LAN dedicated to monitoring with Zabbix. It stores data in my dedicated MySQL server which is another Linux VM in the DMZ (192.168.2.2).

How could this traffic be blocked ?? How can I investigate this ?
Note that I have PfblockerNG and Snort. But although Snort is watching all interfaces (WAN/LAN/DMZ), it only block on WAN. SO its most probably not coming from there

Cheers

SteveITS

@t0m77 see if this helps
https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html

Edit: also, DMZ rules are unable to affect traffic from LAN. Rules apply to traffic inbound on the interface.

t0m77

@steveits it answers my question, thanks!