• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

[SOLVED] Do not log TCP packets with flags TCP:RA / TCP:PA etc.

Scheduled Pinned Locked Moved Firewalling
30 Posts 4 Posters 1.9k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    m0urs @mcury
    last edited by Jan 1, 2024, 3:46 PM

    @mcury said in Do not log TCP packets with flags TCP:RA / TCP:PA etc.:

    Did you disable this ?

    Yes.

    As I said: The logging comes from my own created rule and not from the pfSense default blocking rule.

    M 1 Reply Last reply Jan 1, 2024, 4:00 PM Reply Quote 0
    • M
      mcury @m0urs
      last edited by Jan 1, 2024, 4:00 PM

      @m0urs said in Do not log TCP packets with flags TCP:RA / TCP:PA etc.:

      The logging comes from my own created rule and not from the pfSense default blocking rule.

      I'm trying to replicate this here, but now filtering TCP:S only, in my LAN networks.

      dead on arrival, nowhere to be found.

      M 1 Reply Last reply Jan 1, 2024, 4:41 PM Reply Quote 0
      • M
        mcury @mcury
        last edited by Jan 1, 2024, 4:41 PM

        Are you using that "Invert match" option for source or destination in that rule ? So far, I'm unable to replicate this behavior here but I'm not using those options.

        dead on arrival, nowhere to be found.

        M 2 Replies Last reply Jan 1, 2024, 4:49 PM Reply Quote 0
        • M
          m0urs @mcury
          last edited by Jan 1, 2024, 4:49 PM

          @mcury No, I do not use "Invert Match". That is my definition, together with that TCP Flags option mentioned above:

          5e3f4c21-62e3-46e7-a1c4-963fee7d2124-image.png

          1 Reply Last reply Reply Quote 0
          • M
            m0urs @mcury
            last edited by Jan 1, 2024, 4:52 PM

            @mcury ah, maybe this does not work if protocol set to "Any"? I will try with Protocol set to "TCP" ...

            M 1 Reply Last reply Jan 1, 2024, 5:04 PM Reply Quote 0
            • M
              m0urs @m0urs
              last edited by Jan 1, 2024, 5:04 PM

              @mcury

              No, unfortunately that did not change anything. These kind of packets are still logged by that rule:

              70421b24-d1ae-41af-bf94-6343b09cd5ad-image.png

              You you explain me a bit more, what how this "TCP flag" setting is working? I still did not get it. What exactly is meant by "set" and "out of"?

              M 1 Reply Last reply Jan 1, 2024, 5:36 PM Reply Quote 0
              • M
                mcury @m0urs
                last edited by Jan 1, 2024, 5:36 PM

                @m0urs said in Do not log TCP packets with flags TCP:RA / TCP:PA etc.:

                What exactly is meant by "set" and "out of"?

                https://docs.netgate.com/pfsense/en/latest/firewall/configure.html#tcp-flags

                dead on arrival, nowhere to be found.

                M 1 Reply Last reply Jan 1, 2024, 5:56 PM Reply Quote 0
                • M
                  m0urs @mcury
                  last edited by m0urs Jan 1, 2024, 5:59 PM Jan 1, 2024, 5:56 PM

                  @mcury

                  "By default, new pass rules for TCP only check for the TCP SYN flag to be set, out of a possible set of SYN and ACK."

                  Hm, so I would say that I just need to create a normal rule without any options enabled in "TCP flag"? In this case I do get a logging entry if there is something blocked with SYNC flag and no more logging entries for all the other packtes?

                  That would be what I wanted?

                  Update: It says "new PASS rules", but I have a REJECT rule?

                  M 1 Reply Last reply Jan 1, 2024, 6:00 PM Reply Quote 0
                  • M
                    mcury @m0urs
                    last edited by Jan 1, 2024, 6:00 PM

                    @m0urs said in Do not log TCP packets with flags TCP:RA / TCP:PA etc.:

                    @mcury

                    "By default, new pass rules for TCP only check for the TCP SYN flag to be set, out of a possible set of SYN and ACK."

                    Hm, so I would say that I just need to create a normal rule without any options enabled in "TCP flag"? In this case I do get a logging entry if there is something blocked with SYNC flag and no more logging entries for all the other packtes?

                    That would be what I wanted?

                    Yes, try that and report back.
                    Other option would be to create a new rule below that one, and set flags to all but SYN, and set to no log.

                    dead on arrival, nowhere to be found.

                    M 1 Reply Last reply Jan 1, 2024, 6:26 PM Reply Quote 0
                    • M
                      m0urs @mcury
                      last edited by Jan 1, 2024, 6:26 PM

                      @mcury I had a look into the Packet Filter rules generated by pfSense.

                      Could it be that these options are only used for PASS rules but not for BLOCK rules?

                      Here is the output for that rule either with PASS:

                      [2.7.2-RELEASE][root@router02.urs.lan]/root: pfctl -vvsr | grep "33276"
                      
                      @177 pass in log quick on igb2.20 inet all flags S/SA keep state label "USER_RULE" label "id:1704133276" ridentifier 1704133276
                      

                      and with BLOCK:

                      [2.7.2-RELEASE][root@router02.urs.lan]/root: pfctl -vvsr | grep "33276"
                      
                      @177 block drop in log quick on igb2.20 inet all label "USER_RULE" label "id:1704133276" ridentifier 1704133276
                      
                      J 1 Reply Last reply Jan 1, 2024, 6:48 PM Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator @m0urs
                        last edited by Jan 1, 2024, 6:48 PM

                        @m0urs not sure what your looking at exactly - but those rules block and only syn..

                        block.jpg

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        M 2 Replies Last reply Jan 1, 2024, 6:54 PM Reply Quote 0
                        • M
                          m0urs @johnpoz
                          last edited by Jan 1, 2024, 6:54 PM

                          @johnpoz

                          Notice the "flag s/s" in your blocking rule?

                          Compare it with my blocking rule above, which is missing that ...

                          So I guess that is the reason, why it is not working for me.

                          If I change the rule to "PASS" then the "flag s/s" is added. If I change it back to "BLOCK", it is missing!?

                          1 Reply Last reply Reply Quote 0
                          • M
                            m0urs @johnpoz
                            last edited by Jan 1, 2024, 6:59 PM

                            @johnpoz Ok, I think I need to set that rule to protocol "TCP" and not "ANY". In this case the "flag s/s" is added. I will try again an recreate the rules.

                            J 1 Reply Last reply Jan 1, 2024, 7:16 PM Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator @m0urs
                              last edited by Jan 1, 2024, 7:16 PM

                              @m0urs yeah tcp is what has syn.. so that is prob a requirement

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              M 1 Reply Last reply Jan 1, 2024, 11:20 PM Reply Quote 0
                              • M
                                m0urs @johnpoz
                                last edited by Jan 1, 2024, 11:20 PM

                                @johnpoz @mcury

                                Thank you all.

                                For blocking rules you need to set protocol to "TCP" for the "TCP flags" options to work. I did that now and added a second rule for non-TCP traffic and now I get log entries for all packets but not for TCP packets with other flags than SYNC.

                                1 Reply Last reply Reply Quote 1
                                25 out of 30
                                • First post
                                  25/30
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                  This community forum collects and processes your personal information.
                                  consent.not_received