Firewall log showing Lan ipv6 traffic getting blocked

mer

Well port 53 is DNS so it looks like you have a system on your LAN side that is trying to do DNS lookups over IPV6. Is that a valid configuration for your network? If so, you'll probably want to allow IPV6 through the pfSense box.

Not sure what the second one is.

If you are running (or think you are running) an IPV4 only network, track down the offending machines and disable IPV6 or simply ignore the IPV6 blocked traffic. Lots of smartphones and Windows boxes will try IPV6.

aGeekhere

I have ipv6 enabled

System: Advanced: Networking Allow IPv6 selected.

And a firewall rule

IPv6 *	LAN net	*	*	*	*	none

So I do not know why it is getting blocked.

mer

Order of rules matters.

Very difficult to try and help when you post a single rule. Is it the first user rule or the last? Is it below a specific block ipv6 rule that is getting triggered?

If you can ssh to the box, the output of "pfctl -sr" shows exactly the rules that are enabled and their order of evaluation.

Or take screenshots of the various pages of firewall rules and post them.

aGeekhere

I disabled all rules in Firewall: Rules except the defaults

IPv4 *	LAN net	*	*	*	*	none	 	Default allow LAN to any rule
IPv6 *	LAN net	*	*	*	*	none	 	Default allow LAN IPv6 to any rule

still get the blocked traffic

mer

Then something is still blocking them. Do you have any other packages running, something like Snort?
If you can, the output of pfctl -sr would really really help trying to figure it out. Why? You say you have all other rules disabled, but the output of the command will help ensure that they are. What if you have hit a bug in the interface that prevented the rules from being loaded? We have no way of knowing that.

Simple things like this help verify the exact state of the pfSense box.

Or we can sit here and guess all day long.

doktornotor

There's this red X to show what rule blocked what…

aGeekhere

I have squid3 with squidGuard non transparent proxy wpad.
I have not installed snort.

The error is


The rule that triggered this action is:
@7(1000000105) block drop in log inet6 all lable "Default deny rule IPv6"

The log of blocks


scrub on pppoe0 all fragment reassemble
scrub on re2 all fragment reassemble
anchor "relayd/*" all
anchor "openvpn/*" all
anchor "ipsec/*" all
block drop in log quick inet from 169.254.0.0/16 to any label "Block IPv4 link-local"
block drop in log quick inet from any to 169.254.0.0/16 label "Block IPv4 link-local"
block drop in log inet all label "Default deny rule IPv4"
block drop out log inet all label "Default deny rule IPv4"
block drop in log inet6 all label "Default deny rule IPv6"
block drop out log inet6 all label "Default deny rule IPv6"
block drop log quick inet proto tcp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet proto udp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet proto tcp from any to any port = 0 label "Block traffic to port 0"
block drop log quick inet proto udp from any to any port = 0 label "Block traffic to port 0"
block drop log quick inet6 proto tcp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet6 proto udp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet6 proto tcp from any to any port = 0 label "Block traffic to port 0"
block drop log quick inet6 proto udp from any to any port = 0 label "Block traffic to port 0"
block drop log quick from <snort2c>to any label "Block snort2c hosts"
block drop log quick from any to <snort2c>label "Block snort2c hosts"
block drop in log quick proto tcp from <sshlockout>to (self) port = ssh label "sshlockout"
block drop in log quick proto tcp from <webconfiguratorlockout>to (self) port = http label "webConfiguratorlockout"
block drop in log quick from <virusprot>to any label "virusprot overload table"
block drop in log quick on pppoe0 from <bogons>to any label "block bogon IPv4 networks from WAN"
block drop in log quick on pppoe0 from <bogonsv6>to any label "block bogon IPv6 networks from WAN"
block drop in log on ! pppoe0 inet from "my isp ip " to any
block drop in log inet from "my isp ip" to any
block drop in log on pppoe0 inet6 from fe80::20d:b9ff:fe3a:3db4 to any
block drop in log quick on pppoe0 inet from 10.0.0.0/8 to any label "Block private networks from WAN block 10/8"
block drop in log quick on pppoe0 inet from 127.0.0.0/8 to any label "Block private networks from WAN block 127/8"
block drop in log quick on pppoe0 inet from 172.16.0.0/12 to any label "Block private networks from WAN block 172.16/12"
block drop in log quick on pppoe0 inet from 192.168.0.0/16 to any label "Block private networks from WAN block 192.168/16"
block drop in log quick on pppoe0 inet6 from fc00::/7 to any label "Block ULA networks from WAN block fc00::/7"
block drop in log on ! re2 inet from 192.168.1.0/24 to any
block drop in log inet from 192.168.1.1 to any
block drop in log on re2 inet6 from fe80::1:1 to any
anchor "userrules/*" all</bogonsv6></bogons></virusprot></webconfiguratorlockout></sshlockout></snort2c></snort2c>

I should try disabling the proxy to see if that is causing it.

mer

"blocked by default deny rule ipv6"
That's your big clue right there. Default deny means the traffic is not matching any pass rules.

see what happens when you disable the proxy.

doktornotor

^^^ That.

Plus, you know, you'd get a relevant advise if you posted a screenshot of the entire ruleset instead of posting what you think you have configured in ASCII art… :-(

aGeekhere

Ok, see attachments, I have disabled all rules but the default.

I have also tried disabling the proxy, with the same errors.

Any other information you need?

firewall.jpg_thumb

error.jpg_thumb

mer

After making the rule changes to include the pass any to any did you flush/reset states? I think it's up under Diags. You need to do this typically if you are trying to block traffic that already has pass states.

Just to double check, the couple of firewall rules you show, they are on the LAN interface, not WAN? Hard to tell since we can't see the whole window. Goes to dok saying "…screenshot of the entire ruleset..".

I'd love to help more, but I don't pull teeth for a living.

johnpoz

How would you expect a link local address to talk to a teredo address anyway teredo ipv6 would be 2001::/32? You have listed lan net in your allow rule. Is link local address listed in your lan net? Looks like to me you have a borked ipv6 setup if your seeing link-local trying to talk to teredo?. fe80 is only valid on the local segment.

From that address I get this
Teredo server's IPv4 94.245.121.253
Public IPv4 201.7.55.118

2nd one IPv4 is 68.149.111.125 same server which is owned by MS.. So have to assume one of their teredo servers.

Here is what I would suggest, if your not going to setup ipv6 correctly.. Then just disable it on your machines.. Can be disabled, ie removes the teredo, isatap and 6to4 windows thinks everyone should have enabled out of the box.. with a simple reg key.

reg add hklm\system\currentcontrolset\services\tcpip6\parameters /v DisabledComponents /t REG_DWORD /d 255

You have maybe a p2p client running and its trying to talk to ipv6 address that are in the swarm the best it can?

As to this eca:e4ea::1 I have no idea what that address is.. That looks to be reserved space to me.. Where that would come from have no idea.

aGeekhere

After making the rule changes to include the pass any to any did you flush/reset states? I think it's up under Diags. You need to do this typically if you are trying to block traffic that already has pass states.

I did not know about this option, found it under Diagnostics: state: Reset state, have reset now.

Just to double check, the couple of firewall rules you show, they are on the LAN interface, not WAN? Hard to tell since we can't see the whole window. Goes to dok saying "…screenshot of the entire ruleset.."

Yes it is the LAN interface,

I'd love to help more, but I don't pull teeth for a living.

No need to pull teeth, will try to be more thorough.

It looks like that changing the default from LAN net to * and flush/reset states has fix that issue, I am no longer getting ipv6 errors.

Firewall: Rules : LAN


IPv4 *	*	*	*	*	*	none	 	Default allow LAN to any rule 
IPv6 *	*	*	*	*	*	none	 	Default allow LAN IPv6 to any rule

On a another issue I am getting blocked lan traffic going to the squid proxy see attachments.

Errors

@6(1000000104) Blocked drop out log inet all label "default deny rule IPv4"

Not sure why that traffic is getting blocked?

error.jpg_thumb

firewallRules.jpg_thumb

johnpoz

So vs stopping the traffic that wouldn't work anyway and you don't even know what it was? Your solution is to just allow it? And not log it..

Your new issue is just out of state traffic.. This happens in a stateful firewall..

aGeekhere

So vs stopping the traffic that wouldn't work anyway and you don't even know what it was? Your solution is to just allow it? And not log it..

The traffic was ipv6 of my lan pc

johnpoz

Yes your lan pc was sending out stuff that would never work to some teredo address from its link local address.. So you want this traffic? Do you know what that traffic was? Disable ipv6 on your machine if you don't understand ipv6.