Network Analysis question - UDP
-
I am trying to better understand UDP on my network, and could use your help. I have a pfSense firewall that defaults to deny outbound traffic, and I routinely, sporadically, see denied traffic such as:
UDP default deny: src:<workstation>:64756 dst:<my_external_IP>:28100In my case, <workstation> is: MacOS, connected via bridged WiFi to a netgate pfSense firewall (provides DHCP, NAT, DNS, and default GW to the workstation 1.x/24 network). Outside of the firewall is a Verizon FIOS router (also NAT, 5.x/24 network). uPnP is disabled on both networks.
The IP destination is always my external IP address assigned by Verizon. UDP src ports and dst ports are random high port numbers. Why would my workstation be trying to connect to my external IP?
Thoughts (probably lack of understanding) ... If pfSense is statefully inspecting UDP, would not this be allowed if it is associated with an established connection?
Thanks for your help.
-
Odd UDP ports like that to me would scream P2P.. Especially if they change all the time.
Are you running P2P client anywhere on your network? Its always that same workstation?
Sniff the traffic, then open it up in wireshark - this should give you some idea of what the traffic actually is.
-
What rule is it blocked by? That would normally be passed by the default LAN rules.
You have any port forwards setup? Anything that resolves to your WAN IP via dyndyns maybe?
Steve
-
@stephenw10 I appreciate your response, and there was a dyndns service enabled, so I disabled it! I also changed so many other things that I cannot confirm this was it, but plausible and I haven't had the symptom recently. Thanks again!
