Continuous data traffic to WAN
-
Thanks for your replies, but I fix the issue thanks to the solution of @stephenw10
This is the gateway page:
I temporarily disabled the monitoring and the traffic has been reduced to zero.
I didn't know the monitoring was going to 192.168.1.1, but I thought the traffic was outgoing to the internet. Now I re-enabled the monitoring, because I know where the traffic is directed.I solved the issue, but now I discovered another different issue, should I have to open another topic or I can continue here?
Thanks
-
Start a new topic if it isn't directly related to this problem.
-
Today I found another problem, this is the hardware configuration:
The tv box has a problem: sends continously data traffic (only when it is on).
With old router I saw all the led in switch blinking, and in the router only the port connected to the switch was blinking.
Now, with pfsense, I can see in the switch only tv box and pfsense led blinking, and in the modem also the led to the internet connection is blinking.
I think the tv box sends continuous broadcast (and/or multicast) frames.
Since I can't block this in the tv box, I want to block broadcast (and/or multicast) frames exiting the LAN in the pfsense machine.
I know I have to add a rule in the firewall, but I don't know what I have to set.What can I do?
Thanks
-
Your TV box is going to be noisy little SOB for sure..
Yup prob lots of multicast traffic, etc. One of the big reasons to segment your network into vlans, ie L2 broadcast domains is to keep such traffic away from other networks.
Put your TV Box on its own segment if you don't want your other devices to see this broadcast/multicast traffic.
If your switch or AP doesn't block this traffic such traffic can for sure kill a wifi network.. So for sure you would want to make sure that multicast traffic doesn't go out your wifi unless "needed" multicast traffic over wireless is almost always sent at the lowest datarate.. So even if not "lots" of traffic its going to slow down the wifi overall since its a shared medium.
-
I don't know if the traffic is multicast or broadcast, and if possible I'd like to see in the pfSense webGUI which type of traffic is. Have I to see the states?
I use the tv box to see on the TV some contents stored in the server, so all the devices have to stay in the same LAN, so no vlan.
About wifi, the AC point blocks all multicast and broadcast frames in both interfaces (ethernet and wifi).
So I want to prevent that these frames exit the LAN, to avoid congestion in WAN connection, because in LAN I have 1000mbps, in WAN only 30mbps.
Which rule have I to add to the firewall?
Thanks
-
@dam034 If your switch is smart (managed) and your "Wifi AC point" supports VLANs and multiple SSIDs, you can easily separate all this traffic. You have to read up on how VLANs work, obviously...
Jeff
-
Multicast and broadcast don't pass a router in the first place... So you don't have to worry about it flooding your wan..
As to your server and tvbox having to be in the same L2... Nonsense - you might not be able to use whatever broadcast/multicast discovery method your using now... But I stream stuff from my "server" to my TV every day all day and they are in different networks.
If you want to see what kind of traffic your tvbox is spewing - just do a sniff (packet capture) on pfsense lan interface under the diag menu.
-
I still don't understand why you consider any of this a "problem".
You will ALWAYS see traffic on the WAN, either from people probing your IP from the Internet, the PPPoE session to your ISP, or your IP address being refreshed over DHCP.
As for the LAN, my LEDs flash day and night, the amount of bandwidth its actually doing is microscopic. It will have zero impact on your Internet speed and be immeasurably small on your LAN speed.
Unless you have identified an actual issue with it causing problems on your LAN, blocking that traffic will only make using your devices more complicated as its there to make detecting devices on your LAN completely automatic.
Even my main smart managed switch and pfSense itself broadcasts its own traffic as I have uPNP enabled (for specific IP addresses only). Its how these devices are designed to work.
-
It's 2AM. Everyone's asleep but me. I am not chasing blinking LEDs.
-
@Derelict said in Continuous data traffic to WAN:
It's 2AM. Everyone's asleep but me. I am not chasing blinking LEDs.
It's morning here;,so I've been looking for an hour or so at your video : no red lights, all looks good to me ^^
-
@Gertjan said in Continuous data traffic to WAN:
@Derelict said in Continuous data traffic to WAN:
It's 2AM. Everyone's asleep but me. I am not chasing blinking LEDs.
It's morning here;,so I've been looking for an hour or so at your video : no red lights, all looks good to me ^^
Damn wanted to write the exact same thing :D
-
@JeGr I'm sat here trying to guess what each box is for. ;)
-
I'm sat here trying to guess what each box is for. ;)
Top down, left-to-right:
SG-4860 (Edge), Cable modem, MoCA bridge, VDSL modem
SG-5100 (tnsr), SG-4860 (Trex)
Brocade ICX6450-48 Layer 3 switch -
Hey @Derelict , can you please plug your OPT1 back in? I'm having trouble getting to your Plex server box...
Thanks!
*** just kidding ***
Jeff
-
Thanks for your replies.
Seeing the states I understood the problem, if we want to consider this.
With old router, the LAN had this addresses: 192.168.100.0/24, so the broadcast address was 192.168.100.255
Now with pfsense, I changed the LAN addresses to 10.78.32.0/26, so the broadcast address is 10.78.32.63
I went to see the states and I noticed this particular:
The tv box has ip 10.78.32.34
I'm thinking the tv box continues to believe that the broadcast address ends with 255, as in old router, and not 64.
This explains that with old router, all LEDs were blinking (broadcast), and now with pfsense it isn't so because 10.78.32.255 is out of LAN, and then routed to the modem, which in turn routes to the Internet.So I need to block the outgoing traffic to 10.78.32.255? Or I need more?
Thanks
-
No, you should set a consistent IP network, including netmask, on your network.
-
What? You don't run your router with a /26 mask, and clients on this network with a /24 mask?? Is that what you did?
-
I configured the new network with /26 mask, but the tv box continues to send broadcast frames to 10.78.32.255, and I don't know why. It is a bit old (android 4.4.2).
I thought to add a new firewall rule, and indeed it works.
This is the LAN firewall:
In less than one minute, the firewall blocked 160KiB of noisy traffic.Now the LEDs behaviour hasn't changed in the switch, but the noisy frames are no longer routed to the modem and to the Internet.
This is what I can do, and for now it works.
Thanks for the help!
-
If you are running /26 on pfSense everything on that segment should be in the same /26.
That is how you configure an IP network.
There is no second option.
-
You need to fix the mask on the device, or have it update its dhcp lease so it gets the new mask
