Mysterious traffic to 224.0.0.2 which is blocked, but it shouldn't be

Pizzamaka

Hi from a pfsense/firewalling newbie.

So I have been troubleshooting issues with Android apps not working. The only thing I see being blocked is this traffic

android device -> 224.0.0.2 IGMP

As soon as I create a rule to allow that, my apps work again. (interestingly it only works when explicitly setting the device IP as source - allow any LAN source does not work...)

My questions now are

google told me that this is a non-routable address reserved for router advertisments. Why is my android phone looking for routers?
According to the logs the rule that blocks it is my "allow LAN to everything" rule. This is a rule that allows all protocols from the LAN subnets to anywhere. Why is this blocking anything?

Any help is highly appreciated.

johnpoz

@Pizzamaka there has been many a thread about this already.. Here is what is going on.

https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html#packets-with-ip-options

SteveITS

@Pizzamaka we make a rule to not-log IGMP, to avoid the log noise.

Pizzamaka

@johnpoz thank you. I did search, but could not find anything in regard. I also read the document you posted but could not see that it refers to my issue. Can you explain how I could have seen that the packets are blocked due to IP Options or share a thread where it is explained?

johnpoz

@Pizzamaka if ip options are set, like with igmp - then your rule that allows them be that any any or specific needs to be set to allow ip options. Thought that was pretty clearly explained in the link I provided.

Here is one

https://forum.netgate.com/topic/187896/how-to-stop-logging-blocked-lan-igmp

Pretty sure it was always blocked, just not logged until they fixed a bug.

Pizzamaka

@johnpoz I get the explanation in the docs- thank you for that. What I meant is, that I found the document you shared before posting here, but was not aware that is related to my issue.

Or better: How can I see in the logs that the traffic is blocked due to the IP option as you explained. When looking at the logs it only says "blocked", source/target IPs protocal and the rule. It does not say "blocked because traffic has IP option set" - sorry if the question sounds stupid and is due to my lack of knowledge.

SteveITS

@Pizzamaka Because it is an "allow" rule that is logging the block. Not a "block" rule. And it is for IGMP, not TCP or UDP or other.

johnpoz

@Pizzamaka yeah it might be a bit confusing, especially on an any any rule where you don't call out say tcp or tcp/udp and its just IPv4 any any rule..

I think that was their goal with listing the rule that triggers but mentions the igmp protocol even when its an allow rule, for example your lan any any rule.