Firewall Blocking Unknown LAN Address

mifronte · Jun 7, 2016, 6:40 AM

I am running pfSense 2.3.1 sp1 with default firewall. I noticed the firewall log is showing a block on the LAN interface from a source address that is not part of my network. My LAN is configured as 10.168.x.x, but a source address of 169.254.255.1 port 138 is shown as being blocked by the firewall on the LAN interface. This entry is occurring frequently in the firewall log.

Googling shows that port 138 is usually Netbios, but where is the source address 169.254.255.1 coming from? The arp table does not show this address.

Can someone help me understand what is going on and if I should be concerned? How do I track down the culprit?
![pfsense Firewall Log.png](/public/imported_attachments/1/pfsense Firewall Log.png)
![pfsense Firewall Log.png_thumb](/public/imported_attachments/1/pfsense Firewall Log.png_thumb)

mer · Jun 7, 2016, 7:01 AM

Most likely culprit for the 169 address is a Windows machine, set up to do DHCP that did not get an address. The port of 138 is as you say is most likely NetBIOS (again Windows machine). Unless you have thousands of machines on your LAN side, I'd go to each Windows machine, open cmd window enter ipconfig /all to see what addresses are assigned.

kpa · Jun 7, 2016, 9:07 AM

169.254.0.0/16 is the IPv4 link-local address subnet although it's supported rather sketchily. MS-Windows seems to be one of the system that actually uses them and you can get system to system connectivity using those addresses on the same network.

https://en.wikipedia.org/wiki/Link-local_address#IPv4

mifronte · Jun 7, 2016, 8:00 PM

I have 3 Windows machine of which one is a VM. All three has valid IP addresses. I also have an HP printer with a valid IP and is sharing out a USB flash drive using Samba in DD-WRT on the NETGEAR R7000 access point. Could the Samba server in DD-WRT be the culprit?

viragomann · Jun 7, 2016, 8:45 PM

The packets could also come from anonther not connected network adapter. So have you checked the Windows machines yet?
I'd something similar in my LAN from a not connected TAP adapter on a Windows PC.

kpa · Jun 7, 2016, 8:55 PM

@viragomann:

The packets could also come from anonther not connected network adapter. So have you checked the Windows machines yet?
I'd something similar in my LAN from a not connected TAP adapter on a Windows PC.

Link-local addresses are not routable so they must be originating from the same network segment, LAN in this case.

johnpoz · Jun 7, 2016, 9:29 PM

it could be some other device as well, I have a wireless bridge for directv that uses that 169 range as link local, but there is no way to turn it off or disable that functionality. Its pretty freaking lame if you ask me.

Yeah it can cause some noise in your logs, best to just not log it if you don't like the noise.

You can hit it via http on its actual IP it gets from dhcp.. And get lots of info and show the 169.x address

Vendor:LINKSYS
ModelName:WVBR0-25-US

br0 Link encap:Ethernet HWaddr BC:30:7D:B0:48:0C
inet addr:169.254.96.229 Bcast:0.0.0.0 Mask:255.255.0.0
inet6 addr: fe80::be30:7dff:feb0:480c/64 Scope:Link

viragomann · Jun 7, 2016, 9:36 PM

@kpa:

Link-local addresses are not routable so they must be originating from the same network segment, LAN in this case.

I know, I know, but Windows (and as I know also other systems) sends it out to the connected LAN interface, while the link-local address is assigned to another interface.

kpa · Jun 7, 2016, 9:42 PM

@viragomann:

@kpa:

Link-local addresses are not routable so they must be originating from the same network segment, LAN in this case.

I know, I know, but Windows (and as I know also other systems) sends it out to the connected LAN interface, while the link-local address is assigned to another interface.

Are you sure about that? That would be violation of the specification that states that the link-local addresses must be local to the broadcast domain and can not cross routers. The only scenario where such TAP adapter and its link-local address would be visible if it's bridged with the LAN adapter.

viragomann · Jun 7, 2016, 9:50 PM

No, it didn't come across a router, just across Windows. ;)
Same thing, if I assign 2 IPs in different ranges to 2 different network card on on PC, lets say one is in LAN1 and the other in LAN2, I can access the PC (Windows firewall disabled) by the LAN2 address over LAN1 interface.

mifronte · Jun 8, 2016, 4:17 AM

So I tried accessing the IP address using http and sure enough I get my dd-wrt wireless access point where I am sharing the connected USB drive using SAMBA.

Any thoughts on what could be happening before I take this issue over to the dd-wrt forum? I don't really understand what is happening, but I would really appreciate it if someone can help me phrase the issue so that I can convey the problem on the dd-wrt forum if this is considered a problem.

kpa · Jun 8, 2016, 10:19 AM

@mifronte:

So I tried accessing the IP address using http and sure enough I get my dd-wrt wireless access point where I am sharing the connected USB drive using SAMBA.

Any thoughts on what could be happening before I take this issue over to the dd-wrt forum? I don't really understand what is happening, but I would really appreciate it if someone can help me phrase the issue so that I can convey the problem on the dd-wrt forum if this is considered a problem.

Does the dd-wrt device have a proper IP address either from DHCP or a static address? The intention of the link-local address is to provide means to access a host even if it does not have a DHCP/static configured address, that's how it works on IPv6. On IPv4 it's not well defined when a host should use a link-local address, it could be that the dd-wrt is using one even if the interfaces have proper IPv4 addresses configured.

johnpoz · Jun 8, 2016, 12:40 PM

so your sure its the dd-wrt machine? you have tracked the 169 by mac?

mifronte · Jun 8, 2016, 5:51 PM

The 169 does not show up in the arp table. When I use http on the 169.254.255.1 address, it pulls up my dd-wrt admin page. The dd-wrt access point also has a valid LAN address where I normally access the admin page.

I did a tracert on the 169.254.255.1 and it comes back with my dd-wrt access point name.

johnpoz · Jun 8, 2016, 6:28 PM

well trace on that will just follow your default route out. So if that is your dd-wrt box then that is where it would end up sure..

To find it by mac, you say your logging firewall hits on it - so just sniff for (packet capture) on pfsense on the interface your seeing the logs and then you will know what mac is sending out the traffic.

mifronte · Jun 9, 2016, 3:57 AM

Is there a software to view the packet download file? I tried opening it in notepad++, but it does not look like it is a text file. some information can be read, but I see anything resembling a MAC.

johnpoz · Jun 9, 2016, 10:01 AM

Wireshark would be the software I would suggest. Its free, but if all your looking for is the mac, just turn the details to full and you will see the mac in the details presented when you stop the capture you don't have to download it and open it.

But sure wireshark will show you all the details, mac and everything..

mifronte · Jun 11, 2016, 7:59 AM

The 169 UDP broadcast is definitely coming from my dd-wrt access point that has Samba running to share a connected USB drive.

Don't know if this is normal, but I posted a question in the dd-wrt forum.