Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    firewall default deny all with allow all statement

    Scheduled Pinned Locked Moved Firewalling
    7 Posts 3 Posters 615 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      lightingman117
      last edited by

      Why do I see default denies for an allow-all network?
      e880b6bd-7b29-4a39-96d6-3dc104dc05b0-image.png

      68c9045c-f87d-44c0-a76a-1270b46f0f2d-image.png

      Feels like this again [same client]
      https://forum.netgate.com/topic/174989/snort2c-host-block?_=1682465358279

      All my other pfSense installs which are much more complicated [even running virtualized] are rock solid. But this client [with two different hardware platforms] seems to always trigger something. Gah.

      Literally nothing on this install except wireguard.

      johnpozJ S 2 Replies Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @lightingman117
        last edited by

        @lightingman117 those are just all out of state blocks...

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • S
          SteveITS Galactic Empire @lightingman117
          last edited by

          @lightingman117 ^that, but
          https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html

          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
          Upvote ๐Ÿ‘ helpful posts!

          1 Reply Last reply Reply Quote 0
          • L
            lightingman117
            last edited by lightingman117

            How did y'all tell from the images alone?

            I looked at the TCP flags and didn't think anything of them.


            In other news - I found out the real problem.

            Mikrotik CRS354-48G-4S+2Q+RM needed to be restarted (after a lightning strike).

            [certain ports] Network was super slow/unresponsive.
            PING worked
            DHCP worked

            But HTTP(S) traffic did not.
            SMB did not.

            WiFi worked fine.
            Other computers worked fine.

            Very weird issue (IMO).

            johnpozJ S 3 Replies Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @lightingman117
              last edited by johnpoz

              @lightingman117 said in firewall default deny all with allow all statement:

              TCP flags and didn't think anything of them.

              Well you need to ;)

              Anything other than S (syn) that is blocked would mean that pfsense does not have a state to why its blocked. If it was a SYN block - that points to pfsense not having a rule to allow whatever the traffic is.

              Seeing out of state blocks like FA, or R with some other flags possible like E in there or P etc.. Its normal to see these now an then.. If your seeing SA (syn,ack) this would point to asymmetrical traffic flow.. But now and then seeing some out of state F or FA, etc. is common to see now and then.. Devices trying to reuse a old session, phones are horrible about this - or maybe they are retrans and pfsense already closed the state, etc.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 0
              • S
                SteveITS Galactic Empire @lightingman117
                last edited by

                @lightingman117 FWIW we disable logging of packets blocked by the default rules. It eliminates a lot of log noise, and we can always turn it on if necessary while debugging.

                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                Upvote ๐Ÿ‘ helpful posts!

                1 Reply Last reply Reply Quote 1
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @lightingman117
                  last edited by

                  @lightingman117 same here.. default deny logging disabled on mine. I have no desire to see out of state blocks. Or any sort of nonsense noise on my wan either.

                  I log blocks that might interest me, on the wan this is only SYN traffic, and some common and interesting UDP ports. And some other things that interest me that might be trying to talk to my IP. But if some random packet hits my IP that is not a syn, and would never be allowed anyway - I don't really have a desire to see it in my logs, it just fills them up making it harder to see the interesting stuff.

                  On my lan side interfaces I have blocks that log for stuff that would be of interest to me if devices on those networks tried to go there or on specific ports, that sort of thing.

                  And as mentioned by @SteveITS you can always trigger the default log back on if your actually trying to troubleshoot something that is not working, or whenever else you might want to take a peek.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.