Unable to stop IGMP traffic logging

[jch]

@stephenw10

Yes, I had activated it at the beginning for debugging purposes, then i disabled it.

Filter reload do not produce any error as you can see :

And there is nothing relevant in the system logs either

[stephenw10]

Ok, and no alerts showing after running that?

Check the ruleset file dircetly:

grep 100000101 /tmp/rules.debug

Does it show logging on that rule?

[jch]

@stephenw10

yes, i confirm there is no alert after running 'Reload filter' and no logging option on this rule :

[stephenw10]

Hmm, OK. And just to confirm you are still seeing new entries being logged in the firewall log for that?

Just for completeness check:

pfctl -vsr | grep 100000101

Make sure that actual running rule also shows that.

Also check the IGMP block rule you added is present there. That should prevent anything hitting the pass rule anyway.

[stephenw10]

Also to confirm can I assume you did not see these logged before you enabled logging n the rule during testing?

And that you have rebooted the firewall since this started and it makes no difference?

[jch]

@stephenw10

Yes, i confirm :

In addition :

Block rules :

The filter block rules has no effect

[jch]

@stephenw10

Right, it was after using the logging options in the rules that the logs appeared.
I haven't performed a reroot or reboot since the production deployment, but i can't do it now, i have to wait until tonight, i'll let you know

Many thanks for your help !

[stephenw10]

The floating rule is not set as quick so it would still hit the pass rule on LAN after that. Though it shouldn't because the block rule on LAN should catch it.

Try setting that floating rule to 'quick' though.

[pst]

@jch have you tried removing the destination in the rule, it is a broadcast address? Your rules shows that the the the IGMP rule is never triggered, states = 0/0. I found an old and disabled IGMP reject rule among my rules and I remember that one working. It is defined without destination address.

[jch]

@stephenw10

I added the 'Quick' option but the problem remains :

[jch]

@pst

Same result :

[stephenw10]

Hmm, try enabling 'IP Options' in the advanced settings on that floating block rule.

Normally you would need to enable IP Options to pass multicast traffic like that.

[jch]

@stephenw10

Thanks for this advice, i checked this option but IGMP flows continue to be logged as 'Pass' traffic.
I'm going to do a reboot later, i'll let you know, Thanks !

[jch]

@stephenw10

Problem solved, IGMP logs flooding disappeared after reboot, it's some kind of bug ..
Thanks again for your help :)

[stephenw10]

Hmm, bizarre! Glad it was solved.