0.0.0.0 IGMP spam in WAN log & LAN traffic being blocked
-
Yes, my WAN has a public IP (PPPoE via DSL).
All but OpenVPN are local VLAN interfaces as can be seen in the screenshot below.
"Laden" is German for "store".
 -
Hi!
I had to change my 'DSL-modem (now: Draytek Vigor 130 in modem mode) and since then (2 days) I have spam from 0.0.0.0 to 255.255.255.255 port 4944 on the WAN interface of my pfSense (2.2.1 nano 386).
I have a block rule without logging on top of the WAN rules, but the log spamming continues…
 -
there is nothing you can do with that because the block is happening before your rule not to log.. 0.0.0.0/8 is is in bogon.. Turn off bogon logging if you don't want to see the noise it blocks or don't block it and then your rule would block it without log before it hits the default rule that blocks
as to traffic to 4944?? Have no idea what that is.. I would guess p2p.. but broadcast? I would sniff the traffic and look to what it is, might give you some clue how to turn it off if coming from your modem itself, etc.. Or atleast info to ask your isp about, etc.
-
2chemlud, your logs clearly show UDP traffic to a broadcast address. This thread is about IGMP to a multicast address. Please don't hijack.
-
same problem traffic blocked by bogon because of the source IP being 0.0.0.0 - just don't log bogon.. Problem solved.
-
Not logging bogons doesn't help with me. It even says "The rule that blocked this traffic is: " with no bogons or whatsoever logging.
Basically I wonder why my pfSense install sends out IGMP requests on 0.0.0.0 or in one case from its IF address. That's regardless of activating the IGMP proxy or not. Even the switches do not have IGMP snooping or even querier turned on.
I see this in the office (2.2.1) and at home (2.2) with slightly different behavior, both Nano-installs on PCengines APU boards. The amount of logged "noise" renders the log completely useless. There's hardly anything else in there. -
Stop wasting your time. This IGMP log flood does NOT come from anything user configured and CANNOT be stopped by anything user configured. https://redmine.pfsense.org/issues/4383
The only way to hide the spam from the GUI is reverting the patch that made the log entries visible. However, the firewall logs will STILL be flooded with the junk, it won't make the actual logging go away.
-
So, the IGMP 0.0.0.0 WAN to LAN issue is a bug in PFSense that we cant work around? According to that bug report the target release for the patch is 2.2.3, which I assume is some time away.
I have attached what it looks like in my log.
Also, LAN traffic being blocked is also flooding the log in a similar fashion to the 0.0.0.0 IGMP traffic. The default firewall rule set is in place. Akamai, Microsoft, and Google are the most common destinations that end up being spammed in the log.
I did set the firewall optimization to Conservative to try to get legit idle sessions to stay open, but that did not seem to make much of a difference.
-
Yes, IGMP is a known bug as linked above.
The other thing is out of state trafic non-issue and and completely offtopic here.
-
This IGMP log flood does NOT come from anything user configured and CANNOT be stopped by anything user configured.
Does that mean that every installation since 2.2. is affected? I somehow doubt that, not seeing it with other installs at clients.
-
Whether or not you see it depends on whether or not you are being hit by IGMP traffic.
https://forum.pfsense.org/index.php?topic=88029.0
-
Starts to make sense, thanks.
I know which install I surely will not update until this is solved… -
Hi!
I had to change my 'DSL-modem (now: Draytek Vigor 130 in modem mode) and since then (2 days) I have spam from 0.0.0.0 to 255.255.255.255 port 4944 on the WAN interface of my pfSense (2.2.1 nano 386).
I have a block rule without logging on top of the WAN rules, but the log spamming continues…
Solved the issue with my Draytek Vigor 130 by UNmarking "Broadcast DSL status to LAN" under ->System Maintenance->Management
-
Cool! Any way to access the Draytek through the pfSense or do I need to remove it before I can reach the Draytek's weg GUI?
-
Cool! Any way to access the Draytek through the pfSense or do I need to remove it before I can reach the Draytek's weg GUI?
Yes: https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall ;)
-
The root cause here is fixed in 2.2.3.
-
Ok, thanks for your 2.2.3 note, but the thread was hijacked ;)
2chemlud, your logs clearly show UDP traffic to a broadcast address. This thread is about IGMP to a multicast address. Please don't hijack.
-
Ok, thanks for your 2.2.3 note, but the thread was hijacked ;)
My comment there was re: the original issue, multicast firewall log spam.
-
The problem is still present on my pfsense setup in VM with 2.2.3 installed.
Unchecked both log bogon networks block rule and private networks block rule.
Also created a custom rule to block igmp on lan interface.
No joy.EDIT: I fixed it by patching /etc/inc/filter_log.inc
In function conv_log_filter added the following lines in the foreach ($logarr as $logent) loop:if (strpos($logent,"igmp") !== false)
continue;Crude, but does the job.
-
Thank you Bronko, Solved the problem for me too !
After pulling my hair out wondering why my firewall logs where filled with 0.0.0.0 to 255.255.255.255 port 4944 I stumbled on this post.
I am on pfsense 2.3.4-RELEASE with pfblockerng installed, its been working pretty good for me but a few days ago I changed over from ADSL to VDSL and swapped the modem to a vigor 130, unticking the 'Broadcast DSL status to LAN' in the vigor settings fixed it.
This broadcast to LAN is I believe used to keep a connection in a vigor router alive so the modem logs can be accessed inside the router.
I access my modem by using the https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall guide, its worked with every modem i have used but the vigor 130 is the first one thats filled the logs ! I still have the occasional IGMP showing up:
MODEMACCESS 192.168.x.x 224.0.0.1 IGMP
Not a problem yet as seems to be only when i have the modem Admin page open.
–
