Backwards logging - Source and Destination the wrong way around.

[craigbow777]

Hey All,

First Post EVER, so be gentle please.

I researched and looked around on the interwebs, the pfsense forums as well as the firewalls themselves before deciding to post here.

The Problem,

When we look at our firewall logs the source and destination are the wrong way around but this only seems to apply to hosts that are sitting on the WAN portion of the network.

Setup:

3 Interfaces.

WAN -> Public IP
LAN -> Private IP
OPT1 -> Private IP

Using CARP for HA.

We have a few hosts needing direct connection on the public internet and no 1 to 1 NAT mappings due to certain requirements by the software stack. So we put the hosts on the Public Subnet and set the servers gateways as the Firewall WAN VIP interface.

We have noticed that the source logs in the firewall is the hosts themselves but when connections coming in from the internet are blocked, instead of the source showing the connections from the internet and the destination the hosts on the WAN interface, it appears as if logging is backwards.

Is this due to the hosts being on the WAN Subnet?

Anyone have any idea's as to why this is happening?

[Harvy66]

Your description of the problem is very difficult to follow. The one thing I got out of it is your hosts are on the WAN interface which is also the Internet side of things. My first guess would be that you could have asymmetric routing. Your WAN's VIP may be configured as the gateway for the hosts, but that's not to say that when traffic is coming from the Internet, that it does not go strait to the hosts instead of via the WAN interface.

Of course this depends on what technology you're using and how you've configured it.

[johnpoz]

"So we put the hosts on the Public Subnet and set the servers gateways as the Firewall WAN VIP interface. "

And that would be asymmetrical and a borked setup.

[craigbow777]

Thanks Harvy66 and johnpoz.

Harvy, apologies about the description, as this is not normally something we do on the Firewalls and was a tad difficult for me to get across properly but yes your understanding is spot on. The hosts sit on the same Subnet and VLAN as the WAN interface and then use the WAN interface as the gateway instead of the SVI on the core routers.

johnpoz, thats what I initially thought when see the way this was happening.

To remedy this, I assume we would need to put the hosts on another public interface and off the WAN interface and Gateway.

[johnpoz]

To remedy it you would correct any asymmetrical routing yes..

[craigbow777]

Thanks so much for the advice johnpoz!!  ;)

[johnpoz]

Normally you would not put devices on the transit network to your isp.. If you were going to their gateway should be the isp.  When you were talking to them from behind pfsense it would be natted and look like its coming from the wan IP of pfsense in this transit.

If this is a routed network to your pfsense, then yes I would put it behind pfsense.