Firewall blocks, Pfblocker, multicast

NogBadTheBad

Sorry was mid edit and the phone went :)

JKnott

@occamsrazor said in Firewall blocks, Pfblocker, multicast:

Thanks. But still a little confused. So is the multicast traffic currently being blocked only multicast traffic that's trying to exit the WAN?

Mulitcast has to specifically be configured for it to get through a router. This can be either manually or automatically, with multicast snooping/discovery. If you don't have either of those then those multicasts are notleaving your LAN.

JKnott

@nogbadthebad said in Firewall blocks, Pfblocker, multicast:

Sorry was mid edit and the phone went :)

That's OK, we didn't mind waiting.

BBcan177

Better to view blocked events in the Alerts tab.

Do you use Firehol level 1 feed? That feed contains bogons and should not be used for outbound blocking.

occamsrazor

@jknott said in Firewall blocks, Pfblocker, multicast:

Mulitcast has to specifically be configured for it to get through a router. This can be either manually or automatically, with multicast snooping/discovery. If you don't have either of those then those multicasts are notleaving your LAN.

So basically there is no need for lists in pfBlocker to be blocking it anyway? There's no need for me to be blocking it for security purposes, and it's not being blocked from reaching my LAN devices... its merely a logging issue.

@bbcan177 said in Firewall blocks, Pfblocker, multicast:

Better to view blocked events in the Alerts tab.

Indeed, thanks. I've identified one list that was problematic, have now deleted that. But some of the blocks are showing "no match" as to where the block is coming from...

Do you use Firehol level 1 feed? That feed contains bogons and should not be used for outbound blocking.

No... I made that mistake once already :-) Never again...

I guess all this will be easier once I move over to the new version of your excellent blocker, but for now I think I have to wait until 2.4.4 stable is released as that's required for pfBlockerNG-devel right? Or can it safely be run on 2.4.3-RELEASE-p1?

JKnott

@occamsrazor said in Firewall blocks, Pfblocker, multicast:

So basically there is no need for lists in pfBlocker to be blocking it anyway? There's no need for me to be blocking it for security purposes, and it's not being blocked from reaching my LAN devices... its merely a logging issue.

Correct. However, if you want to be sure, run Wireshark or Packet Capture on the WAN port. I doubt you'll see those multicasts.

BBcan177

@occamsrazor said in Firewall blocks, Pfblocker, multicast:

No... I made that mistake once already :-) Never again...
I guess all this will be easier once I move over to the new version of your excellent blocker, but for now I think I have to wait until 2.4.4 stable is released as that's required for pfBlockerNG-devel right? Or can it safely be run on 2.4.3-RELEASE-p1?

If you stay on 2.4.3, then you can goto pfBlockerNG-devel.

The issue people were having was when they were on 2.4.3, and the switched to the 2.4.4 devel branch and then went to pfBlockerNG-devel. This causes the PHPv7 to be installed in 2.4.3 which caused issues...

So for those who want to goto 2.4.4, they need to update pfSense first before installing pfBlockerNG-devel.

There is one of your feeds that contains a block on 224/3 which is not a good idea. The new devel has a Feeds management page with a list of Feeds from the original sources which should be better.

occamsrazor

@bbcan177 said in Firewall blocks, Pfblocker, multicast:

If you stay on 2.4.3, then you can goto pfBlockerNG-devel.

The issue people were having was when they were on 2.4.3, and the switched to the 2.4.4 devel branch and then went to pfBlockerNG-devel. This causes the PHPv7 to be installed in 2.4.3 which caused issues...

So for those who want to goto 2.4.4, they need to update pfSense first before installing pfBlockerNG-devel.

Thanks, I was kind of following that issue but then lost track. So on 2.4.3-RELEASE-p1 I can just disable pfblockerNG in its settings (but keep it around in case of any issues) and install pfBlockerNG-devel? Or does pfblockerNG need to be uninstalled as a package first before installing the pfBlockerNG-devel package?

BBcan177

@occamsrazor said in Firewall blocks, Pfblocker, multicast:

Thanks, I was kind of following that issue but then lost track. So on 2.4.3-RELEASE-p1 I can just disable pfblockerNG in its settings (but keep it around in case of any issues) and install pfBlockerNG-devel? Or does pfblockerNG need to be uninstalled as a package first before installing the pfBlockerNG-devel package?

First make sure that "Keep Settings" is enabled.
Disable pfBlockerNG and Save
Then Uninstall pfBlockerNG
Then install pfBlockerNG-devel
Re-enable pfBlockerNG-devel and run a: Force Reload - All

occamsrazor

@bbcan177 said in Firewall blocks, Pfblocker, multicast:

First make sure that "Keep Settings" is enabled.
Disable pfBlockerNG and Save
Then Uninstall pfBlockerNG
Then install pfBlockerNG-devel
Re-enable pfBlockerNG-devel and run a: Force Reload - All

Awesome, thanks a lot, will give it a try.....