Firewall all kinds of weird and spontaneous blocks on LAN
-
Dude there is nothing but NOISE on the public NET.. if your pfsense is directly connected to it your wan blocks will be very busy.. Is pfsense behind a NAT? Then yeah your wan blocks will be very quiet.. See here is example of wan noise..
If your not seeing wan blocks I have to assume you are behind a nat already hiding the noise??
Why don't you change your rules back to default, and then show us some examples of what your seeing both wan and lan and we can go over what your seeing and if you want it to be logged or why its logged or how to not log it, etc. etc..
It might be noise, John (it probably is), but my point is: if I don't see anything being blocked, how can I be sure something is blocked in the first place. Trust is good, but verification is better ;D
pfSense is doing the NAT as far as I know, it connects directly to my ISP using PPPoE dial up.
-
To the question of why he used 192.168.2.0/24 instead of 192.168.1.0/24… I say if it was a mistake, then it was a GOOD mistake.
Too many people use that address space and in general it is a good idea to stay away from it.
-
Why don't you change your rules back to default, and then show us some examples of what your seeing both wan and lan and we can go over what your seeing and if you want it to be logged or why its logged or how to not log it, etc. etc..
Well, it was relatively quite for a while, but I am getting depressed once again :'(
I've taken your recommendation some time ago and disabled all rules so I had only the defaults. From there on, once I got all these 'noise-messages' you don't want to see I added them one by one to the firewall, so we can see what is happening. I consolidated some of them into an alias to keep the overview. Currently, also, since a couple of days, my logs are literally flooded with Ipv6-messages, no clue why; it just suddenly started. Also, when you click on the red 'x' in the firewall log to see which rule it was, I think there are some bugs, as LAN-traffic according to the information from the red cross is blocked by a rule for VLAN40( :o).
I will post screenshots, and I will be in your debt once again if you could help me get rid of this, because not only is my log looking like a mess, so is my firewall rules screen.
Also, in the screen of the firewall, to my more than strange surprise, if I try to allow any * any * you will still see I had to add a any [port] any [port] rule to try to silence it. And then still sometimes it doesn't work :'(
I am going to add screenshots now.
-
IPv6 blocks on LAN (I edit part of the IPv6 address out since I suspect it to my my network MAC or something? (since googling within "" didn't return any hits).
These started a couple of days ago (I have no clue what triggered that) and are literally flooding my logs).
 -
Rule for VLAN40 is doing its thing on VLAN50 (?)
 -
Attached also the firewall rules for that VLAN50; I don't see any 'VLAN40' in here, so no clue why the previous weird picture.
 -
WAN2 (cable) blocked a private IP, but the destination is weird?
 -
Bootpc is bogon?
 -
NTP goes DNS.
 -
And the VLAN40 rules for the previous picture.
 -
Interfaces/WAN (VDSL).
 -
Interfaces/WAN2 (cable)
 -
Interfaces/LAN.
 -
Interfaces/VLAN40.
 -
Advanced/networking.
 -
System log settings.
 -
And, finally, the LAN rules in two parts (note the number of 'easy rules passed from firewall log view'. And even then they still aren't working, as the log is still flooded with IPv6 as shown in the first picture):
 -
LAN rules part 2:
 -
And finally, the multicast-alias in the LAN rules:
 -
So I will be feeling hugely indebted to everybody who can help me solve this, that goes without saying :P
(because it is driving me crazy, this flooding of logs which I am trying to fight with the firewall rules every day :-[).
Thank you in advance very much (really :-*),
Bye ;D