Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ["solved"] IGMP w options blocked on lo0 interface, filling the log, can't be silenced

    Scheduled Pinned Locked Moved Plus 25.07 Develoment Snapshots
    38 Posts 5 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Yup the change in behaviour there is confusion I agree. It logs on whatever matched the traffic, even if that was pass rule, if IP options are no allowed. This is the correct behaviour now, it was broken for years!

      See: https://redmine.pfsense.org/issues/15400

      L 1 Reply Last reply Reply Quote 1
      • L
        louis2 @stephenw10
        last edited by louis2

        @stephenw10

        IMHO the behavoir is fully incorrect! But apart from that I have options set.

        0a1fdc4f-d979-49d2-8918-923b7cbd027b-image.png

        Also see part of my rule stack higher up.

        Note I am running pfSense+ latest beta

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          But what's in your MulticastMediaServer alias? Since it's matching the default LAN rule below that.

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @stephenw10
            last edited by

            @stephenw10 exactly - asked the same question, just because you clicked off ip options, and want this media server(s) to see this traffic doesn't mean that rule actually matched if you put in the servers actual IP address, vs the multicast addresses..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            L 1 Reply Last reply Reply Quote 0
            • L
              louis2 @johnpoz
              last edited by

              @johnpoz

              cea17369-128e-4118-8882-f8ccec325f8d-image.png

              johnpozJ 1 Reply Last reply Reply Quote 0
              • dennypageD
                dennypage
                last edited by dennypage

                IGMP should be allowed to all.

                Try this rule on the “Local” interface:

                4ffeb9b5-1733-472f-938f-e9f84d340e49-image.png

                db9fc9c3-34c0-44f5-a8e7-c490c02eefe2-image.png

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @louis2
                  last edited by johnpoz

                  @louis2 well that last one is wrong.. its 239.255.255.250

                  so yeah its still going to log that traffic as blocked.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  L 1 Reply Last reply Reply Quote 0
                  • L
                    louis2 @johnpoz
                    last edited by louis2

                    @johnpoz said in ["solved"] IGMP w options blocked on lo0 interface, filling the log, can't be silenced:

                    239.255.255.250

                    John you are right, I should have added that address. The problem is that '239.255.255.0' is a range not an address. I do not know the exact usage of 239.255.255.250 however it is a used control address.

                    However, adding that address does not solve the problem. Below a small part of my actual log

                    At this particular moment the log shows 244.0.0.1 Note that the shown rule set was already in place when created the picture of the log somewhat higher (showing addresses being filtered)

                    181bbf34-d0d7-4489-a710-55ace636f94a-image.png

                    PIMD not yet working properly, could be due to the fact that I did not recompile it yet for FreeBSD15 current, but I am not sure about that.

                    Next to that I really and fully stick to my vision that rules should do what they say what they do !!!

                    Not logging pass rules turning in block rules and start logging ....... terrible ...

                    Rules affecting traffic not selected by that rule .... terrible

                    I really really can not accepted that as being OK !!

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      You have that rule duplicated on both those interfaces?

                      L 1 Reply Last reply Reply Quote 0
                      • L
                        louis2 @stephenw10
                        last edited by

                        @stephenw10

                        No, I had it only enable on the PCLAN, since it is still in an experimental stage. However I see the behavoir on multiple vlans including the PCLAN.

                        I did add the rule now to the guest vlan and my privileged vlan as well. To keep them equal, not that I expect it to change something.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Are you adding it as a floating rule? It doesn't look like that but...

                          1 Reply Last reply Reply Quote 0
                          • dennypageD
                            dennypage
                            last edited by

                            The rule to allow IGMP must come before the default rule you have at the end of the interface. The log entries you posted show that this is not the case.

                            You can either use a floating rule with quick, or you can use Local. Try what I showed above. You can tighten it up later if you feel the need, but get it working first.

                            L 1 Reply Last reply Reply Quote 0
                            • L
                              louis2 @dennypage
                              last edited by

                              @dennypage @stephenw10

                              To answer your questions

                              Floating
                              No it am not using floating rules here. In short I only use floating for reasons of security or high performance.

                              Rule position
                              There are a couple of things which determs the order I place rules. In short

                              • security
                              • performance
                              • logic

                              Below the first part of my rule set as related to my PCLAN

                              3fca7c78-0a26-4ae9-865c-5a6add82f1ce-image.png

                              dennypageD 1 Reply Last reply Reply Quote 0
                              • dennypageD
                                dennypage @louis2
                                last edited by

                                @louis2 have you tried the simple Local rule that I posted?

                                L 1 Reply Last reply Reply Quote 0
                                • L
                                  louis2 @dennypage
                                  last edited by

                                  @dennypage

                                  Do you refer to
                                  ^suggest an “Allow” from all rule for IPv4/IPv6 and protocol IGMP on the “Local” interface.^

                                  No I did not yet but that rule is much wider than I like, and why should that make a difference !!???

                                  Never the less I will add the rule for now for the PC-lan. However what ever the result is, I will remove it later on !! 🙄

                                  a4ec691f-c694-45b3-bde6-7099bd31496d-image.png

                                  1 Reply Last reply Reply Quote 0
                                  • dennypageD
                                    dennypage
                                    last edited by

                                    Yea, there really is no need/reason to restrict IGMP in the local network. Especially if you are actually using IGMPv3.

                                    Btw, your comments indicate IGMPv3, but are you actually using v3? And joining toward a specific source? IGMPv2 is much more common as a default, and many devices and software do not implement v3 correctly. FWIW, unless you really know what you are doing with multicast, and really need v3 due to the number of available/conflicting sources, you should stick with v2.

                                    YMMV.

                                    L 1 Reply Last reply Reply Quote 0
                                    • L
                                      louis2 @dennypage
                                      last edited by

                                      @dennypage

                                      NOP ! 😖 😖

                                      2b6655ad-0579-4a77-a70a-fbd1811df842-image.png

                                      1 Reply Last reply Reply Quote 0
                                      • dennypageD
                                        dennypage
                                        last edited by dennypage

                                        Please show the entire page on the Floating tab, and the entire page on the Local tab which includes the rule above.

                                        L 1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Mmm, for some reason that's not matching.

                                          Make sure that rule is actually loaded: pfctl -vsr | grep IGMP

                                          Then grab a packet in a pcap and compare that with the running rule.

                                          L 1 Reply Last reply Reply Quote 0
                                          • L
                                            louis2 @dennypage
                                            last edited by

                                            @dennypage

                                            Denny, I really see no reason to do so. I all ready published the relevant part of the PCLAN and I do have not any floating rule related to IGMP.

                                            If a reason to publish more, OK but I do not see any at the moment

                                            dennypageD 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.