new pfSense install - immediate and numerous DoD (department of defense) "queries"? 255.255.255.255:68
-
@xanadu said in new pfSense install - immediate and numerous DoD (department of defense) "queries"? 255.255.255.255:68:
-added rule for block all WAN traffic, ip4 and ip6, all protocols, all sources
Pointless - where did you add this.. Since out of the box all inbound traffic to the wan is blocked.
-added rule to allow all LAN traffic, ip4 and ip6, all protocols, all sources
Again pointless since out of the box lan rules are any any..
To your 11.x.x.x source for dhcp.. What is the wan of your pfsense actually connected too? Who is your ISP? Also what is this??
-IP PASSTHROUGH from ISP router and separate public IP from the rest of the network
As asked please post your rules... Out of the box you install pfsense and it will work.. There is no need for these rules you have added.
-
Firewall -> Rules -> Add
Block all sourcesWatched countless videos for initial setup that suggested to manually add a "block all" rule to WAN as a general rule of thumb.
Same process but for LAN traffic and "Pass" all traffic for the rule.
WAN of pfSence is connected to my cable modem-router. You don't need my ISP.
Ip Passthrough is how the modem-router bypassess the internal networking and provides a 2nd public ip to whatever device is connected to whatever ethernet port (eth port 2 as it is). So my pfSence box has an unmanaged external IP from my ISPS modem.
Rules were posted in my previous post.
-
@nogbadthebad I know its DHCP but why from the DoD?
-
Talk to your ISP and ask them, the destination is a broadcast address.
-
Not necessarily "is from DoD"
maybe your "ISP" is (mistakenly) using that network segment in "his" network
-
You would be surprised how often that happens to be honest... Company says oh we never need to go to xyz network.. We will just use it internally.
Also could just be some idiot user of the isp on the same layer 2 as you causing it.. Clearly its not a valid IP unless your ISP is the dod ;)
Do a packet capture on your wan, and load it into wireshark and you can see some more details and what the MAC address is of who is sending it.. Can tell from that what brand of device.
-
This post is deleted! -
ok ive captured some packets and opened them in wireshark
anything i should be looking for ? -
In the packet capture i notice Mac addresses with Arris and Cadant. Arris aquiried Cadant in like 2001 and they make cable modems and cable set top boxes.
-
http://www.dslreports.com/forum/r25679029-Why-is-my-first-hop-to-a-DoD-assigned-IP-address
http://www.dslreports.com/forum/r31748514-Connectivity-Why-is-comcast-xfinity-hosting-VoIP-servers-on-DOD-network
-
You have a cable modem I would take it... Yes arris and Cadant same and cable modem maker.
-
@johnpoz I dont have an Arris or a Cadant but yes I have a cable modem.
So take off my tinfoil hat then ?
My ISP basically said GTFO and won't even look into the DoD requests.
-
And what is your cable modem brand.. The nic is made arris/cadant ;)
Your tinfoil hat should never had been on - there is a shit ton of noise on the net.. Figuring out what it is the interesting fun stuff..
-
You cannot control what arrives on your WAN. That's why we run firewalls. All you can do is pass what you want and block the rest.
If you want to know why DHCP traffic from that address is out there you'll have to talk to your ISP.
pfSense is deny all traffic by default. If you put default deny rules in manually, expect to have to do things like manually pass IPsec too.
-
Ok I feel better. Thanks for putting my head on straight.
A question though. With all wan traffic blocked... why do services like teamviewer still work ?
-
because teamview creates a tunnel to their servers..
-
https://en.wikipedia.org/wiki/UDP_hole_punching
-
That is not the only way.. That will not work in the case of a proxy for example. I my home box all the time from work using it, and behind a proxy.. So it tunnels over tcp in that case.
It uses multiple methods none of which require the user to configure inbound port forwarding.
