ssh wan block bug
-
it is a ton of entries all similar to this.
May 13 14:00:00 pfSense newsyslog[45275]: logfile turned over due to size>500K
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,48031,0,none,17,udp,32,192.168.1.3,255.255.255.255,3000,2000,12
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,10479,0,none,17,udp,49,192.168.1.27,192.168.1.255,60686,32412,29
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,10478,0,none,17,udp,49,192.168.1.27,192.168.1.255,60688,32414,29
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,9469,0,none,17,udp,49,192.168.1.24,192.168.1.255,60687,32412,29
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,9468,0,none,17,udp,49,192.168.1.24,192.168.1.255,60689,32414,29
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,27614,0,none,17,udp,121,192.168.1.3,239.255.255.251,37810,37810,101
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,48715,0,DF,17,udp,863,192.168.1.4,239.255.255.251,37810,37810,843
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,34515,0,DF,17,udp,691,192.168.1.14,239.255.255.251,37810,37810,671
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,64642,0,DF,17,udp,691,192.168.1.16,239.255.255.251,37810,37810,671
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,9381,0,DF,17,udp,690,192.168.1.12,239.255.255.251,37810,37810,670
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,49402,0,DF,17,udp,691,192.168.1.18,239.255.255.251,37810,37810,671
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,20481,0,DF,17,udp,818,192.168.1.6,239.255.255.251,37810,37810,798
May 13 14:00:00 pfSense filterlog[7432]: 2,,,1000000101,ix0,match,block,in,4,0x0,,128,46560,0,none,17,udp,256,169.254.14.211,192.168.1.27,1900,60690,236
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,ix0,match,block,in,4,0x0,,64,25164,0,DF,6,tcp,52,192.168.1.45,44.239.252.140,60362,443,0,FA,1650631059,2175163242,727,,nop;nop;TS
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,41262,0,DF,17,udp,805,192.168.1.5,239.255.255.251,37810,37810,785
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,ix0,match,block,in,4,0x0,,64,25165,0,DF,6,tcp,52,192.168.1.45,44.239.252.140,60362,443,0,FA,1650631059,2175163242,727,,nop;nop;TS
May 13 14:00:01 pfSense filterlog[7432]: 4,,,1000000103,ix0,match,block,in,4,0x0,,64,25166,0,DF,6,tcp,52,192.168.1.45,44.239.252.140,60362,443,0,FA,1650631059,2175163242,727,,nop;nop;TS
May 13 14:00:01 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,50938,0,DF,17,udp,759,192.168.1.8,239.255.255.251,37810,37810,739
May 13 14:00:01 pfSense filterlog[7432]: 2,,,1000000101,ix0,match,block,in,4,0x0,,128,43430,0,none,17,udp,256,169.254.14.211,192.168.1.24,1900,60691,236
May 13 14:00:01 pfSense filterlog[7432]: 4,,,1000000103,ix0,match,block,in,4,0x0,,64,25167,0,DF,6,tcp,52,192.168.1.45,44.239.252.140,60362,443,0,FA,1650631059,2175163242,727,,nop;nop;TS
May 13 14:00:02 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,64,3621,0,DF,17,udp,235,192.168.1.127,255.255.255.255,48461,10001,215
May 13 14:00:02 pfSense filterlog[7432]: 6,,,1000000105,bridge0,match,block,in,6,0x00,0x58ab3,1,UDP,17,215,fe80::f6e2:c6ff:feac:ad00,ff02::1,39544,10001,215
May 13 14:00:02 pfSense filterlog[7432]: 4,,,1000000103,ix0,match,block,in,4,0x0,,64,25168,0,DF,6,tcp,52,192.168.1.45,44.239.252.140,60362,443,0,FA,1650631059,2175163242,727,,nop;nop;TS
May 13 14:00:03 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,64,10936,0,DF,17,udp,235,192.168.1.121,255.255.255.255,39840,10001,215
May 13 14:00:03 pfSense filterlog[7432]: 6,,,1000000105,bridge0,match,block,in,6,0x00,0x0d024,1,UDP,17,215,fe80::f6e2:c6ff:feac:cb23,ff02::1,43124,10001,215
May 13 14:00:05 pfSense filterlog[7432]: 4,,,1000000103,ix0,match,block,in,4,0x0,,64,25169,0,DF,6,tcp,52,192.168.1.45,44.239.252.140,60362,443,0,FA,1650631059,2175163242,727,,nop;nop;TS
May 13 14:00:05 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,7954,0,none,17,udp,165,192.168.1.19,239.255.255.250,61222,1900,145
May 13 14:00:05 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,10481,0,none,17,udp,49,192.168.1.27,192.168.1.255,60686,32412,29
May 13 14:00:05 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,10480,0,none,17,udp,49,192.168.1.27,192.168.1.255,60688,32414,29
May 13 14:00:05 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,9470,0,none,17,udp,49,192.168.1.24,192.168.1.255,60687,32412,29
May 13 14:00:05 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,9471,0,none,17,udp,49,192.168.1.24,192.168.1.255,60689,32414,29
May 13 14:00:05 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,64,32145,0,DF,17,udp,361,192.168.1.31,255.255.255.255,48029,10001,341
May 13 14:00:05 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,64,57897,0,DF,17,udp,361,192.168.1.30,255.255.255.255,36700,10001,341
May 13 14:00:07 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,27897,0,none,17,udp,129,192.168.1.27,239.255.255.250,60690,1900,109
May 13 14:00:07 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,10343,0,none,17,udp,129,192.168.1.24,239.255.255.250,60691,1900,109
May 13 14:00:07 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,48032,0,none,17,udp,32,192.168.1.3,255.255.255.255,58993,8602,12
May 13 14:00:08 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,2154,0,none,17,udp,68,192.168.1.27,224.0.0.251,5353,5353,48
May 13 14:00:08 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,34754,0,none,17,udp,68,192.168.1.24,224.0.0.251,5353,5353,48
May 13 14:00:08 pfSense filterlog[7432]: 2,,,1000000101,ix0,match,block,in,4,0x0,,128,43431,0,none,17,udp,256,169.254.14.211,192.168.1.24,1900,60691,236
May 13 14:00:09 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,128,48033,0,none,17,udp,32,192.168.1.3,255.255.255.255,58994,8600,12 -
the only bridge I have connects my wireguard interface to my lan
edit: I have no users currently connected to wireguard.
-
@techpro2004 I see a bunch of noise in there, you got multicast.. that stuff to 239.255.255.251, I see some directed broadcast traffic to 192.168.1.255, I see something with a APIPA address 169.254.x.x sending to sending to SSDP/UPnP (port 1900)..
Why do you have a bridge setup at all.. I don't use wireguard, but have tailscale setup and it doesn't have any bridge.. Not sure why you would bridge that - pretty sure WG is L3, bridging is at L2.. Not understanding why you would think you need a bridge?
-
I saw some instructions online a while ago that said to do it. Plus, i use wireguard to access my lan from my cellphone on the go
-
@techpro2004 Ultimately, logged blocks would be that pfSense is set to log the default block rule (the default setting), or log blocked bogons/RFC1918 (also default), or a rule is set to log the block. If you don't want the blocks logged you can turn those off. Or you can raise the max log file size so logs rotate less often. Or just ignore the sshguard notification.
(or in 24.03 it logs IGMP blocks)
-
@techpro2004 said in ssh wan block bug:
i use wireguard to access my lan from my cellphone on the go
Yeah that has nothing to do with a "bridge"
Not sure what "guide" you followed but you wouldn't setup a bridge in any scenario that I can think of.. I use my tailscale to access stuff on multiple networks locally while I am out and about - no bridge setup..
https://docs.netgate.com/pfsense/en/latest/recipes/wireguard-ra.html
-
bogons/rfc is disabled. the only rules that log is pfblocker auto rules.
-
@techpro2004 OK, so, don't do that? You have options of "log less," or "let the log files grow so they rotate less frequently." Or ignore the notification.
-
-
on the subject of logging less, How do I figure out where the filter logs are from.
-
I removed the bridge and wireguard still works and I am getting a lot less entries in the filter log.
-
deleting the bridge seemed to help the sshguard messages also. thanks.
-
@techpro2004 said in ssh wan block bug:
How do I figure out where the filter logs are from.
What do you mean its right there in the log who is sending the traffic.. For starters I would remove the bridge.. then you can filter on your interfaces where noise is coming in easier to not log it.
May 13 14:00:00 pfSense filterlog[7432]: 2,,,1000000101,ix0,match,block,in,4,0x0,,128,46560,0,none,17,udp,256,169.254.14.211,192.168.1.27,1900,60690,236
This is just pure noise.. You got something with APIPA address, ie didn't get a dhcp address? Sending SSDP to 192.168.1.27..
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,48715,0,DF,17,udp,863,192.168.1.4,239.255.255.251,37810,37810,843
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,34515,0,DF,17,udp,691,192.168.1.14,239.255.255.251,37810,37810,671
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,64642,0,DF,17,udp,691,192.168.1.16,239.255.255.251,37810,37810,671
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,9381,0,DF,17,udp,690,192.168.1.12,239.255.255.251,37810,37810,670
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,49402,0,DF,17,udp,691,192.168.1.18,239.255.255.251,37810,37810,671
May 13 14:00:00 pfSense filterlog[7432]: 4,,,1000000103,bridge0,match,block,in,4,0x0,,1,20481,0,DF,17,udp,818,192.168.1.6,239.255.255.251,37810,37810,798Also pure noise.. Multicast Discovery of DNS Services is that multicast address - why would you need that noise logged or going over you wireguard connection?
