Unable to stop IGMP traffic logging
-
Hmm, OK. And just to confirm you are still seeing new entries being logged in the firewall log for that?
Just for completeness check:
pfctl -vsr | grep 100000101Make sure that actual running rule also shows that.
Also check the IGMP block rule you added is present there. That should prevent anything hitting the pass rule anyway.
-
Also to confirm can I assume you did not see these logged before you enabled logging n the rule during testing?
And that you have rebooted the firewall since this started and it makes no difference?
-
-
Right, it was after using the logging options in the rules that the logs appeared.
I haven't performed a reroot or reboot since the production deployment, but i can't do it now, i have to wait until tonight, i'll let you knowMany thanks for your help !
-
The floating rule is not set as quick so it would still hit the pass rule on LAN after that. Though it shouldn't because the block rule on LAN should catch it.
Try setting that floating rule to 'quick' though.
-
@jch have you tried removing the destination in the rule, it is a broadcast address? Your rules shows that the the the IGMP rule is never triggered, states = 0/0. I found an old and disabled IGMP reject rule among my rules and I remember that one working. It is defined without destination address.
-
I added the 'Quick' option but the problem remains :
-
Same result :
-
Hmm, try enabling 'IP Options' in the advanced settings on that floating block rule.
Normally you would need to enable IP Options to pass multicast traffic like that.
-
Thanks for this advice, i checked this option but IGMP flows continue to be logged as 'Pass' traffic.
I'm going to do a reboot later, i'll let you know, Thanks ! -
Problem solved, IGMP logs flooding disappeared after reboot, it's some kind of bug ..
Thanks again for your help :) -
Hmm, bizarre! Glad it was solved.
