bootp broadcast

[muaddiibh]

I've got a toilet paper roll length firewall log showing:

WAN 10.2.40.1:67 → 255.255.255.255:68

1. How can packets from a non-routable, private IP space (10.0.0.0/8) arrive at my firewall?
2. .. and worse, actually go through/into my network then broadcast (255.255.255.255) itself across my internal network?

Am I reading this correctly?

This does not look like legitimate traffic and makes me think my firewall has an inbound leak making me scramble to see how to plug that hole ...

Would appreciate your insights

[Tzvia]

Looks like there is a rule 'allow dhcp client out WAN (100000056)'. Is PFSense behind another router (double NAT) on the 10.2.40.0 WAN network?

[muaddiibh]

@tzvia thanks for writing.

Internet → Cable Modem → Firewall (pfsense)

The firewall is connected to the cable modem. There are no other routers.
pfsense does get its WAN IP via DHCP …

PS: To be honest, I haven't had the time yet to plug into the cable modem to check its configs. First thought was whether this inbound observation was something sophisticated and beyond my experience.