Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    how to stop logging blocked LAN IGMP?

    Scheduled Pinned Locked Moved General pfSense Questions
    18 Posts 4 Posters 2.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • dennypageD
      dennypage @JeremyJ 0
      last edited by

      @JeremyJ-0 said in how to stop logging blocked LAN IGMP?:

      I tried checking the 'allow IP options' box in the advanced settings on the rule, saved and reloaded, and the behavior did not change. Apparently, the new code does not consider IGMP an IP option.

      IGMP is a protocol above IP. The 'options' refer to options at the IP layer. IGMP packets require the use of IP options. By default, the firewall blocks packets that have options are the IP layer.

      To allow IGMP, you will need to have a pass rule that specifies Protocol IGMP, and has "Allow IP options" checked in the Advanced section.

      J 1 Reply Last reply Reply Quote 0
      • J
        JeremyJ 0 @dennypage
        last edited by

        @dennypage

        Thanks, that explains it. I added 'allow IP options' to the new 'silent block IGMP' rule, and it works now.

        Bob.DigB 1 Reply Last reply Reply Quote 0
        • Bob.DigB
          Bob.Dig LAYER 8 @JeremyJ 0
          last edited by Bob.Dig

          @JeremyJ-0 said in how to stop logging blocked LAN IGMP?:

          I added 'allow IP options' to the new 'silent block IGMP' rule, and it works now.

          For me the IGMP-block-rule worked without the IP-options.

          johnpozJ dennypageD 2 Replies Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @Bob.Dig
            last edited by

            @Bob-Dig if you put in a rule to block igmp or destination before it hit your allow rule that would match on the traffic, like an any any where it would see the igmp, and say hey wait this has ip options set vs allowing this I am going to block it then yes your block rule without logging would work.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • dennypageD
              dennypage @Bob.Dig
              last edited by

              IGMP isn't a bad thing. On LAN interfaces, it is something you should pass rather than block.

              If you really don't want to use IGMP, you should turn it off in your switch or router rather than blocking it on the firewall.

              J 1 Reply Last reply Reply Quote 0
              • J
                JeremyJ 0 @dennypage
                last edited by

                @dennypage good point.

                I changed the 'silent block' to a 'silent pass', but it behaved the same as the default pass rule: it blocks IGMP (even though the rule is explicitly a pass) and logs each instance (even though the rule is set to not log).

                It appears that the new release has some kind of special code path for this that defies normal handling.

                So, back to blocking it. I don't have the skills or energy to turn off the IGMP sources on my LAN and I don't want those log entries.

                dennypageD 1 Reply Last reply Reply Quote 0
                • dennypageD
                  dennypage @JeremyJ 0
                  last edited by dennypage

                  @JeremyJ-0 You have to have IP options enabled in the pass rule.

                  Edit: Mine is a floating rule, but here's what it looks like:


                  Screenshot 2024-05-02 at 08.17.21.png
                  Screenshot 2024-05-02 at 08.17.36.png
                  Screenshot 2024-05-02 at 08.17.49.png

                  J 1 Reply Last reply Reply Quote 0
                  • J
                    JeremyJ 0 @dennypage
                    last edited by

                    @dennypage actually tried it both ways. same result. it's silent as a block rule, and noisy as a pass rule.

                    Screenshot 2024-05-02 at 11.19.27 AM.png

                    Screenshot 2024-05-02 at 11.16.22 AM.png

                    dennypageD 1 Reply Last reply Reply Quote 0
                    • dennypageD
                      dennypage @JeremyJ 0
                      last edited by

                      @JeremyJ-0 Source should be any rather than LAN subnets.

                      I edited my post above and put in my floating rule which handles IGMP.

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        JeremyJ 0 @dennypage
                        last edited by

                        @dennypage did my level best to match your rule: made mine floating, checked 'quick', changed direction to 'in'. It's not exact because I need it to apply to multiple sources where yours is specific to one so left source as 'all'.

                        Still getting deny entries in the log.

                        dennypageD 2 Replies Last reply Reply Quote 0
                        • dennypageD
                          dennypage @JeremyJ 0
                          last edited by

                          @JeremyJ-0 You do not need to restrict it. You can, and should, use "any" unless you have a good reason not to.

                          Do exactly this:

                          Screenshot 2024-05-02 at 08.49.56.png

                          Screenshot 2024-05-02 at 08.50.08.png

                          Make sure the rule is above your default allow.

                          1 Reply Last reply Reply Quote 0
                          • dennypageD
                            dennypage @JeremyJ 0
                            last edited by

                            @JeremyJ-0 Just to be sure, you are doing Apply Changes after modifying the rules, yes?

                            Btw, in Redmine 15415 there is a small patch that you can use to enhance the hover tooltip in the firewall log. It will show "block/ip-option" in the tooltip if the packet was blocked due to the presence of IP options.

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @dennypage
                              last edited by

                              @dennypage said in how to stop logging blocked LAN IGMP?:

                              It will show "block/ip-option" in the tooltip if the packet was blocked due to the presence of IP options.

                              Isn't that kind of obvious when the rule name is pass, but its a block and the protocol is IGMP ;)

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              J 1 Reply Last reply Reply Quote 1
                              • J
                                JeremyJ 0 @johnpoz
                                last edited by

                                Yes, I 'apply changes' and wait for the filter to reload.

                                Update: after the last round of changes (moving rule to floating etc.) things were worse: the silent block rule was logging the blocked packets too.

                                I rebooted. The excess logging stopped.

                                Is there some part of the firewall that reads the rules on startup and does not re-read on a filter reload?

                                dennypageD 1 Reply Last reply Reply Quote 0
                                • dennypageD
                                  dennypage @JeremyJ 0
                                  last edited by

                                  @JeremyJ-0 said in how to stop logging blocked LAN IGMP?:

                                  Is there some part of the firewall that reads the rules on startup and does not re-read on a filter reload?

                                  Not that I am aware of.

                                  The reload of rules failing would explain your results however.

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ johnpoz referenced this topic on
                                  • keyserK keyser referenced this topic on
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.