Excessive TCP: PA FA RA

kpa

Ehm, no. Directly connected networks are known to the system by their routing table entries that do not need a gateway entry in the table. Gateways are only needed for "foreign" destinations, i.e. networks that are not directly connected to the system. The best example is of course the default gateway which is the 0.0.0.0/0 entry (often marked as "default" as it is in pfSense also) in the routing table, it's not a directly connected network so in order to reach it a gateway has to be configured. Like so in my pfSense system (public IPs censored):


$ netstat -nr -f inet
Routing tables

Internet:
Destination        Gateway            Flags      Netif Expire
default            88.195.aaa.1       UGS         em1
10.0.0.0/8         127.0.0.1          UGS         lo0
10.71.14.0/24      link#2             U           em0
10.71.14.1         link#2             UHS         lo0
88.195.aaa.0/19    link#3             U           em1
88.195.bbb.ccc     link#3             UHS         lo0
127.0.0.1          link#7             UH          lo0
172.16.0.0/12      127.0.0.1          UGS         lo0
192.168.0.0/16     127.0.0.1          UGS         lo0
192.168.1.0/24     link#3             U           em1
192.168.1.200      link#3             UHS         lo0

Here the 88.195.aaa.0/19 is a directly connected network (the WAN network), so is my LAN network of 10.71.14.0/24. The system knows how to reach hosts on those networks without a need to send the traffic to a gateway by issuing an ARP query on the connected network to figure out which MAC address the traffic should be sent to on the ethernet level.

The default gateway, the one that is needed to reach the "world out there, the internet" is the first line that says "default 88.195.aaa.1 UGS em1". This says that in order to connect to any IP address/network that does not match an entry in the routing table of this system forward the traffic to address 88.195.aaa.1 and not very surprisingly the routing table also has instructions on how to reach that address, the "88.195.aaa.0/19 link#3 U em1" line.

dcol

I did change the LAN tcp/udp to any right after I posted the rules.

See attached the xinetd file. Why are those 19001-19008 ports in there? Is this normal?

Here is my routing table. The first 2 entries are DNS. Does this look ok?

Routing tables

Internet:
Destination Gateway Flags Netif Expire
default xx.xx.129.113 UGS igb2
68.105.28.16 xx.xx.129.113 UGHS igb2
68.105.29.16 xx.xx.129.113 UGHS igb2
xx.xx.129.112/28 link#3 U igb2
xx.xx.129.114 link#3 UHS lo0
xx.xx.129.117 link#3 UHS lo0
xx.xx.129.117/32 link#3 U igb2
xx.xx.129.124 link#3 UHS lo0
xx.xx.129.124/32 link#3 U igb2
127.0.0.1 link#7 UH lo0
192.168.1.0/24 link#4 U igb3
192.168.1.1 link#4 UHS lo0
192.168.3.0/24 link#5 U igb4
192.168.3.1 link#5 UHS lo0
192.168.10.0/24 link#2 U igb1
192.168.10.1 link#2 UHS lo0
192.168.20.0/24 link#1 U igb0
192.168.20.1 link#1 UHS lo0

xx.xx.129.113 is the default gateway assigned by ISP
xx.xx.129.114-125 is my assigned IP block. Currently only using 114,117,124
192.168.3.0/24 is the subnet used for the wireless router - OPT3
114-WAN/igb2, 117-OPT1/igb0, 124-OPT2/igb1, LAN/igb0, OPT3/igb4

xinetd.txt

dcol

The reason I said "I do know that you also have to use the rules to direct traffic" is because there was a time in the past where the LAN any-any rule would not work for some devices on the same LAN subnet unless I gave it a specific rule. That does not seem to be the case now, so any-any is working for all devices on the LAN subnet as it should.

Also, that statement does seem to be true for the WAN where there is no any-any rule. Or any interface which does not have an any-any rule.
So, does my posted new WAN rules look ok?

Dan

dcol

Here we go again with the port 19006, see below.

192.168.1.2 is my main desktop that I use. I had a TCP monitor running and it did not capture this.

LOG2.jpg_thumb

Derelict

Then you weren't capturing correctly or something else on your network is sending those packets from that IP address.

dcol

Maybe I missed it. can't predict when it happens, but will leave the capture tool running on 192.168.1.2. I have it filtered for incoming and outgoing port 19006.
Is the xinetd.conf I posted earlier correct? It shows 192.168.20.2 tied to port 19006. Why does it do this?

Derelict

Probably a package. What have you installed and why?

there was a time in the past where the LAN any-any rule would not work for some devices on the same LAN subnet unless I gave it a specific rule.

Poppycock. The firewall NEVER gets in the way there unless you are bridging interfaces or some other edge case.

Derelict

Diagnostics > Command Prompt

Execute: cat /var/etc/xinetd.conf

johnpoz

how exactly would the firewall even see that traffic to loopback.. Your pc if wanting to talk to a 127.0.0.1 address wouldn't even put it on the wire, that is localhost. That traffic doesn't go out on the wire.

So that has to be coming from your firewall, or some sort of port forward that you send to loopback?

service 19006-tcp
{
type = unlisted
bind = 127.0.0.1
port = 19006
socket_type = stream
protocol = tcp
wait = no
user = nobody
server = /usr/bin/nc
server_args = -w 2000 192.168.20.2 993
}

Your running something with NC… netcat, not sure of what package or config settings would create those.. I sure and the hell do not have them that is for sure.

hda

@johnpoz:

.. I sure and the hell do not have them that is for sure.

Hmmm, scary stuff for a firewall… 8)

Netcat is often referred to as a "Swiss Army knife" utility, and for a good reason. Just like the multi-function usefulness of the venerable Swiss Army pocket knife, netcat's functionality is as helpful. Some of its features include port scanning, transferring files, port listening and it can be used a backdoor.

[http://www.catonmat.net/blog/unix-utilities-netcat/]

imaps 993 udp imap4 protocol over TLS/SSL

johnpoz

yeah not sure what he is doing, or what would of done that..

Yeah NC is very powerful tool.. Why there would be stuff like that setup in his xinetd I have no idea.. The only thing that was in mine the tftp proxy, and I rem them out because not using it and was just causing log spam.

I am not a nc guru by any means, but looks like to me if sees traffic on loopback to port 19006 send it over to that 192.168.20.2 IP on port 993.

I do believe that if you setup nat reflection that pfsense starts with ports 19000, so you had prob setup some sort of nat reflection. Or if he has port forwards and has it using nat reflection these sorts of entries would be put in.

Maybe this is caused by having auto nat reflection enabled?? I personal see nat reflection as an abomination that should be killed with greek fire whenever possible.. Looking back at his firewall rules he does have some port forwards to that 20.2 IP.. But he has the ports all hidden in an alias. So he has some sort of nat reflection going on and then some weirdness is causing out of state..

Again going to state this for the record that nat reflection is an abomination… Turn it off and your problems will go away would be my guess..

hda

@johnpoz:

…I rem them out because...
... Turn it off and your problems will go away would be my guess..

To disable a service config, add "disable =yes", (then exec the usual 'killall HUP xinetd'), like in:


service 6969-udp
{
        disable = yes
        type = unlisted
        bind = 127.0.0.1
        port = 6969
        socket_type = dgram
        protocol = udp
        wait = yes
        user = root
        server = /usr/libexec/tftp-proxy
        server_args = -v
}

dcol

So I take it that these xinetd.conf entries are for NAT reflection?

I am using NAT reflection on all my port forwards NAT+Proxy. I did that so the LAN can communicate with other interfaces

So, if I should not be using NAT Reflection, should I setup rules instead?
I know for a fact if I turn off NR I cannot open my websites from 192.168.1.2 to the web server @ 192.168.20.2 or load my config page on the NAS @ 192.168.10.2. NR solved all the local communication.

I want the LAN subnet to be able to connect to OPT1/2/3. NAT Reflection does this for me.

Here are my Port Forward rules. NAT Reflection Enabled (NAT+Proxy) on first three, system default (Pure NAT) on the last rule

NAT_PF.jpg_thumb

hda

@dcol:

…So, if I should not be using NAT Reflection, should I setup rules instead?

No.
Split DNS. Tell your DNS server to point to your local servers, case a LAN-host requests that global server address of yours.

dcol

I use my ISP's DNS and DNS Resolver in PFsense. Do not have a local DNS Server setup.

Are you saying no to using NAT reflection altogether and find a different method. Or just to using rules.

So johnpoz, why the boo.. against NAT Reflection?

hda

Have a look see at Services / DNS Forwarder / Host Overrides

dcol

I do not use DNS Forwarder, I use Resolver, but I do see the host override in there.

So if I put / Host-www / Domain-mydomain.com / IP-192.168.20.2 / in there, 192.168.1.0/24 and 192.168.3.0/24 and 192.168.10.0/24 will be able to get to www.mydomain.com on 192.168.20.2

I host a lot of domains, so I guess I would have to have a list of all of them including all the sub domains. NAT reflection seems easier to me.

dcol

I'm going to start a new thread on the DNS Resolver host override issue and lock this one. This thread has too many issues that are just compounding.