how to stop logging blocked LAN IGMP?

JeremyJ 0

@stephenw10 following the trail from the referenced issue we find a commit to the pfSense repo: commit link.

This includes code and configuration changes to allow the user to inhibit these log entries directly and explicitly.

I don't know what pfSense release this applies to or whether it can be applied as a patch to 25.07.1.

stephenw10

It's in the 25.11-beta images if you're able to test that. Let me check the patch....

dennypage

@JeremyJ-0 In the context of IGMP, that is obviated by this which automatically enables IP options when the rule is for IGMP.

stephenw10

You can apply that commit against 25.07.1 and you can just fetch it using the commit ID. If you want to test that.

stephenw10

With that new option unchecked you should not longer see the traffic logged as dropped by the pass policy routing rule. If it hits that.

johnpoz

@stephenw10 said in how to stop logging blocked LAN IGMP?:

If the traffic is blocked because ip options are not allowed it will always log that

if blocked because of options on an allow rule that doesn't have allow options.. I think the way you phrased that is not quite right - or maybe I am just being dense.

But see my post from above - I set a block rule for igmp above my allow (that was logging it because of the IP options) and no more logging of of the igmp becase ip option and allow doesn't allow that.

My block rule just blocks igmp completely, no matter what dest IP, or if options would be on it or not. The block rule just says hey you from this network, and you are igmp - your blocked, and its not logged.. So the allow rule would never see any igmp traffic.

I just do not see a reason to allow it - what would pfsense be doing with igmp traffic, I am not thinking of really any scenario.. Unless you were doing something with avahi, etc. which goes to 224.0.0.251, which you could just allow this block, or in a floating to that specific destination IP.

edit:
The ability to not log such blocks with a checkbox is nice, just like you can say don't log bogon/rfc1818, default, etc. To be honest such an option should of been included when they first started blocking ip options with an allow rule ;)

stephenw10

Mmm, if it's blocked before it hits the pass rule then it should never hit it and hence you shouldn't see it blocked because of IP Options. As I understand it at least!

I recall being blown away seeing a log entry for traffic blocked by a pass rule. And fully expected confusion from users.

dennypage

@johnpoz said in how to stop logging blocked LAN IGMP?:

I just do not see a reason to allow it - what would pfsense be doing with igmp traffic, I am not thinking of really any scenario.. Unless you were doing something with avahi, etc. which goes to 224.0.0.251, which you could just allow this block, or in a floating to that specific destination IP.

You might not use it, but others do. If you have a switch that does snooping, and block all IGMP traffic, you will loose everything in the Local Network Control Block with the exception of 224.0.0.1. This includes several routing protocols, HSRP & VRRP, mDNS & LLMNR. This may not be desirable for everyone.

JeremyJ 0

@stephenw10 I'm no longer a good test case due to the workaround I chose last year: replacing the APs which generated the IGMP packets!

Maybe someone involved in this new flare-up can do it.

Glad to see new options on the table so admins can configure to suit local needs.

Mission-Ghost

Mmmmkay...I made a new thread about the Multicast functions of the Netgear Access points and what to do about them, here.

johnpoz

@dennypage not saying it doesn't have uses - what are you doing specifically on pfsense with it? Sure you can do all kinds of stuff with at your switches - what does pfsense do with it?

What is pfsense going to do with traffic to 224.0.0.2?

Mission-Ghost

@johnpoz I did a pcap on igco.50 this evening after shutting off all the Multicast stuff on the WAX610s including mDNS Gateway function and did not see any subnets other than the .50 and the multicast destinations.

Is this indicative of the traffic no longer showing up on the other interfaces as prescribed, or am I missing something in the Wireshark analysis of the pcap file?

Mission-Ghost

@stephenw10 I've applied the patch to my 25.07.1 and disabled the logging from the logging config page.

However, logging had stopped anyway early this morning when the primary internet service, Starlink, rebooted, and had not resumed.

So, I can't tell if it works or not but it's enabled and if the logging never resumes then I could be working! Thank you!

dennypage

@johnpoz said in how to stop logging blocked LAN IGMP?:

what are you doing specifically on pfsense with it? Sure you can do all kinds of stuff with at your switches - what does pfsense do with it?

What is pfsense going to do with traffic to 224.0.0.2?

Wait one...