TCP:S vs TCP:FA
-
@erbalo said in TCP:S vs TCP:FA:
This happened after i have reset the states on pfsense
As @kiokoman has correctly stated, if your resetting the states on pfsense.. Then yeah for a bit you will see a flood of these sorts of out of state blocks..
It's odd that your just seeing FA, maybe you didn't post section with just the A that are blocked. If you reset states you should see a bunch of A, and then sure some FA, and then maybe even a RA.. As the client says WTF why isn't this guy answer me.. And sends retrans, and says ok lets close this connection and start over..
-
I thing the logs settings which you have done should be ok for me if i can only see the S flags if that is the legit and working logs are.
See my screenshots;
-
Do i just need to set a rule on any interface and also on the WAN interface?
-
Soruce:any and Destination:any and then block?
-
And then at the bottom of the rules and tick Logs?
-
Which flags do i need to tick here? Set /out of and SYN?
-
And lastly here do i need to untick log packets?
-
-
@johnpoz Thats right i have checked my logs and there are lot of logs with FA / A etc.. and i see very low S flags.
-
Before you turn off logging of this noise.. You shouldn't be seeing them - it points to a problem that should be fixed vs just ignored..
Do these comes in spurts or it just constant flood of them?
-
@johnpoz i will check it 2 days and let you know. 2/3 days before i did changed some settings on pfsense related pfblocker as dnsbl settings and it happened directly after i reset the states on pfsense. So it happens now every minute 10/20 times.
I would like to solve this problem and what can i check more?
Also by last changing of my settings no more ads blocks by browser but i did checked dns resolver with nslookup but this works well.Maybe that can help to find the problem or from where to startup.
-
@erbalo said in TCP:S vs TCP:FA:
it happened directly after i reset the states on pfsense
Yeah after you do that - sure you could see a flood of out of state traffic. But that flood should of contained Acks, just A not only just FA... But if you were seeing both A and FA.. it could of just been the flood you would see after a reset of all states on the firewall.
-
@johnpoz I am just seeing A , FA, FPA, RA, PA
I have checked if there a S was but on the last 1000 entries o don't see any S flags.. What will be next and is it dangerous i mean is it a DDOS attack or something like that? I hope you can help me to solve this problem.
-
@erbalo said in TCP:S vs TCP:FA:
I have checked if there a S was but on the last 1000 entries o don't see any S flags
Currently your seeing them? You reset the states again? If not then you have asymmetrical traffic flow most likely...
-
Yes, currenty i am seeing them except S flags also after resetting states again.
I checked also NTOP,
IOT Interface:
Lan Interface:
Wan Interface:
Zero dropped packets -
@erbalo said in TCP:S vs TCP:FA:
after resetting states again.
Why are you resetting states.. There is almost never reason to do that.. If your creating a rule and need, just reset the state for the IPs in question of that new rule. And only time you have to reset state on a new rules, is in the case where traffic already there that would match your rule.. Say you want to block port X.. And device A was talking to something already on port X.. You might want to kill that specific state, vs waiting for that session to end or time out so the rule would block new traffic to that port.
IPS dropping shit is not in your firewall log. You would need to look into IPS to why its dropping stuff. If the firewall dropped the packet, it would of never made it to the ips to even look at.
-
@erbalo Can you please advice me to where tick or untick on these settings as your advice. It is now clear by me that these logs what i am seeing there are out of states logs and i don't really to see that, it filling my logs only with full of entries.
-
Oh my gawd... You need to see them because there is something wrong! Why are you resetting states?
We already went over how not to see them..
-
If it is something wrong i have no idea how i can solve this problem. I have followed your advice and NOT already reset the states.
-
So your not resetting states... And your still seeing a constant flood of this traffic?
If so then you have something MAJOR wrong with your network setup... Please draw out how you have this network connected together and were your clients are pointing to for their gateways.
If you are seeing constant traffic like this - this points to asymmetrical routing problem.. Not logging it doesn't fix the problem.
-
@johnpoz
Yes, i am seeing constant flood.Pfsense is installed on hyper vm.
Internal Realtek netwerk adapter used for Wan and connectesnmodem on this port and on pfsense used as Gateway.
External realtek netwerk adapter used for Lan and connected to netgear switch and created vlans and also the trunk port 1. Vlans are working. Also on hyperv via powershell created vlans to accept all of the vlans.
Clients are points to that Gateway, i have one gateway.
-
That sure doesn't look like a drawing to me..
That looks like words that don't really help... Since there is no details at all..
So you have 1 nic that is connect to your modem but then
this port and on pfsense used as Gateway.
How is pfsense your wan gateway??? That makes ZERO sense!!
External realtek netwerk adapter used for Lan and connected to netgear switch and created vlans and also the trunk port 1.
So now you have another adapter.. But you allow all vlans on this?? How many vlans? What netgear switch?
What gateway are you clients pointing to - they should be pointing to the IP of pfsense for their specific vlans - since you have stated you them?
Lets see the output of your hyper-v setup... Got to love how no mention of any VM or anything until now...
What networks are these vlans using - for all we know, since you hid the rfc1918 space.. The firewall is blocking IPs that are not even suppose to be in the iot vlan, etc..
Love to help be we have zero idea what sort of mess you have configured..
-
This post is deleted! -
Why do you have all your vlans on both interfaces in hyperv? Only network that should be on wan is the wan network..
-
@johnpoz said in TCP:S vs TCP:FA:
Why do you have all your vlans on both interfaces in hyperv? Only network that should be on wan is the wan network..
Corrected the Interfaces:
