(Solved) Unable to stop multicast traffic from being logged

[cmb]

That's hitting the block private networks rule I suspect, in such cases you have to either use a floating rule, or disable block private networks on that interface, block that without logging, then add your own block private rule with logging.

[mr_bobo]

@cmb:

That's hitting the block private networks rule I suspect, in such cases you have to either use a floating rule, or disable block private networks on that interface, block that without logging, then add your own block private rule with logging.

Disabling the Block Private Networks option on the WAN interface did the trick. Thanks a lot, I appreciate it. :)

I cleaned up my rules and made a pfBlocker rule to block 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 255.255.255.255/32 on WAN and all is well.

[Mr. Jingles]

Good afternoon  ;D

I have to apologize, but I don't understand what is written above  :-[

My log is also flooded with these messages, as screenshot 1 shows. On googling that I first found this:

http://knowledge.zomers.eu/pfsense/Pages/Prevent-IPv6-multicasts-from-flooding-the-pfSense-logs.aspx

Which however was for IPv6, so I guessed what I had to enter as address given that my messages are IPv4, and created the floating rule (screenshot 2).

Still, the messages keep on showing up.

Now I did find the 'block private networks' on WAN, which currently is enabled. I understand from cmb that I could disable that, but I don't quite understand this:

[quote]block that without logging, then add your own block private rule with logging.

Sorry, but my brain is too small  :'(

Because:
1. "block that without logging": -> block what without logging?
2. "then add your own block private rule with logging": -> Where to add this? What should it block? Why the logging, I thought we did not want the logging?

I apologize for being such a noob, and please do believe me: I suffer more from that than you ( ;D)

Thank you in advance for any answer :P,

Bye,

[Mr. Jingles]

I can seem to add only one screenshot at a time  :P

[doktornotor]

@Hollander:

Sorry, but my brain is too small  :'(
Because:
1. "block that without logging": -> block what without logging?
2. "then add your own block private rule with logging": -> Where to add this? What should it block? Why the logging, I thought we did not want the logging?

0/ Disable the private networks logging checkbox.

1/ Firewall - Aliases - IP:
Add an alias for 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8

2/ Add your own rule without logging as first one for multicast.

3/ After that, add back private networks blocking with logging enabled, using the above alias. Multicast will not get logged any more, anything else will.

P.S. Nag someone to stop hardcoding the logging and making these rules unmovable here: https://redmine.pfsense.org/issues/371

[Mr. Jingles]

@doktornotor:

@Hollander:

Sorry, but my brain is too small  :'(
Because:
1. "block that without logging": -> block what without logging?
2. "then add your own block private rule with logging": -> Where to add this? What should it block? Why the logging, I thought we did not want the logging?

0/ Disable the private networks logging checkbox.

1/ Firewall - Aliases - IP:
Add an alias for 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8

2/ Add your own rule without logging as first one for multicast.

3/ After that, add back private networks blocking with logging enabled, using the above alias. Multicast will not get logged any more, anything else will.

P.S. Nag someone to stop hardcoding the logging and making these rules unmovable here: https://redmine.pfsense.org/issues/371

Thank you very much for your efforts to help me out  ;D

I feel me becoming more stupid by the minute, because I still don't understand it  :'(

0/ I understand: Interfaces/WAN/at the bottom, disable 'block private networks'.
1/ I hope I did right; I added a screenshot.
2/ But where (what interface) and what will it precisely contain concerning multicast? (could I most impolite perhaps ask for a screenshot?)
3/ This will be the same: Interfaces/WAN/at the bottom, enable 'block private networks'? No, I don't think, because there I can not enable logging, nor can I add an alias.

Sorry (peep)  :-[

But: nag someone at that url I think I can do  :P

;D

Thank you very much for your reply,

Bye,

[doktornotor]

Well, leave it alone until you have figured it out. The above instructions are more than sufficient, provided some basic understanding of the firewall.

[Mr. Jingles]

@doktornotor:

Well, leave it alone until you have figured it out. The above instructions are more than sufficient, provided some basic understanding of the firewall.

???

Well, thank you.

Perhaps somebody else would be willing to give an explanation that will actually help me get further.

The above instructions are more than sufficient

Classic communication theory has a lot to say about that.

Actually, I don't understand your response; why bother?

[Mr. Jingles]

I am still struggling with this  :P.

In the shower I was thinking this: suppose I add these multicast IPs to an alias, and then create a floating rule (without logging) to allow connections from LAN to that alias, would that be safe - and wise? It seems to work, but I don't know if by doing so I am breaching security ( ???)

Thank you in advance for any replies  ;D

[doktornotor]

@Hollander:

It seems to work, but I don't know if by doing so I am breaching security ( ???)

No, you are breaching functionality in the first place… by blocking (potentially) legit traffic on your LAN interface(s).

[mr_bobo]

The IGMP messages I was receiving were due to my Netgear router/modem.

It's been so long ago I don't remember exactly what the setting was, but it was an option in the Netgear management console you could check or uncheck. Once I turned it off the broadcast messages stopped. I was able to recheck the Block Private Networks box on the WAN interface and haven't had any trouble out of it since.

In fact, I never have any trouble out of my pfSense box.

[Mr. Jingles]

Ok, it appears I didn't watch too good. This thread is about WAN, but my logs are filled with this kind of traffic on LAN. It originates from my desktops, that appear to be doing some SSDP-discoveries. This seems legitimate, so I thought: I will create a rule allowing this, and move it to the top of the LAN-rules.

So: UDP, source: LAN net, destination 224.0.0.0/4, pass.

This works for about an hour or so (no more messages in my logs), and then suddenly the rule has moved to the bottom of the list  ???

Why doesn't the rule stay in place? Is this a bug, or a feature?

[Mr. Jingles]

Now I am starting to get ex-tre-me-ly frustrated ( :'( :'( :'().

I also disabled 'block bogon' on LAN, and again, the rule stays in place for one hour, then drops to the bottom of the list and my logs are spammed with the useless lines again.

[Mr. Jingles]

Literally hundreds and hundreds of lines of only this pic.

[doktornotor]

@Hollander:

I also disabled 'block bogon' on LAN, and again, the rule stays in place for one hour, then drops to the bottom of the list and my logs are spammed with the useless lines again.

Make all of those pfBlocker rules "alias only" in list action, you can order those as you wish.

[Mr. Jingles]

@doktornotor:

@Hollander:

I also disabled 'block bogon' on LAN, and again, the rule stays in place for one hour, then drops to the bottom of the list and my logs are spammed with the useless lines again.

Make all of those pfBlocker rules "alias only" in list action, you can order those as you wish.

Thank you very, very, much, dok; I have had that running for 12 hours now, and it appears all these stupid log messages are now, finally, gone. Again: thank you  :P

[doktornotor]

You are welcome ;)