Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Backwards logging - Source and Destination the wrong way around.

    Firewalling
    3
    7
    787
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      craigbow777 last edited by

      Hey All,

      First Post EVER, so be gentle please.

      I researched and looked around on the interwebs, the pfsense forums as well as the firewalls themselves before deciding to post here.

      The Problem,

      When we look at our firewall logs the source and destination are the wrong way around but this only seems to apply to hosts that are sitting on the WAN portion of the network.

      Setup:

      3 Interfaces.

      WAN -> Public IP
      LAN -> Private IP
      OPT1 -> Private IP

      Using CARP for HA.

      We have a few hosts needing direct connection on the public internet and no 1 to 1 NAT mappings due to certain requirements by the software stack. So we put the hosts on the Public Subnet and set the servers gateways as the Firewall WAN VIP interface.

      We have noticed that the source logs in the firewall is the hosts themselves but when connections coming in from the internet are blocked, instead of the source showing the connections from the internet and the destination the hosts on the WAN interface, it appears as if logging is backwards.

      Is this due to the hosts being on the WAN Subnet?

      Anyone have any idea's as to why this is happening?

      1 Reply Last reply Reply Quote 0
      • H
        Harvy66 last edited by

        Your description of the problem is very difficult to follow. The one thing I got out of it is your hosts are on the WAN interface which is also the Internet side of things. My first guess would be that you could have asymmetric routing. Your WAN's VIP may be configured as the gateway for the hosts, but that's not to say that when traffic is coming from the Internet, that it does not go strait to the hosts instead of via the WAN interface.

        Of course this depends on what technology you're using and how you've configured it.

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by

          "So we put the hosts on the Public Subnet and set the servers gateways as the Firewall WAN VIP interface. "

          And that would be asymmetrical and a borked setup.

          1 Reply Last reply Reply Quote 0
          • C
            craigbow777 last edited by

            Thanks Harvy66 and johnpoz.

            Harvy, apologies about the description, as this is not normally something we do on the Firewalls and was a tad difficult for me to get across properly but yes your understanding is spot on. The hosts sit on the same Subnet and VLAN as the WAN interface and then use the WAN interface as the gateway instead of the SVI on the core routers.

            johnpoz, thats what I initially thought when see the way this was happening.

            To remedy this, I assume we would need to put the hosts on another public interface and off the WAN interface and Gateway.

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              To remedy it you would correct any asymmetrical routing yes..

              1 Reply Last reply Reply Quote 0
              • C
                craigbow777 last edited by

                Thanks so much for the advice johnpoz!!  ;)

                1 Reply Last reply Reply Quote 0
                • johnpoz
                  johnpoz LAYER 8 Global Moderator last edited by

                  Normally you would not put devices on the transit network to your isp.. If you were going to their gateway should be the isp.  When you were talking to them from behind pfsense it would be natted and look like its coming from the wan IP of pfsense in this transit.

                  If this is a routed network to your pfsense, then yes I would put it behind pfsense.

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post

                  Products

                  • Platform Overview
                  • TNSR
                  • pfSense
                  • Appliances

                  Services

                  • Training
                  • Professional Services

                  Support

                  • Subscription Plans
                  • Contact Support
                  • Product Lifecycle
                  • Documentation

                  News

                  • Media Coverage
                  • Press
                  • Events

                  Resources

                  • Blog
                  • FAQ
                  • Find a Partner
                  • Resource Library
                  • Security Information

                  Company

                  • About Us
                  • Careers
                  • Partners
                  • Contact Us
                  • Legal
                  Our Mission

                  We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                  Subscribe to our Newsletter

                  Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                  © 2021 Rubicon Communications, LLC | Privacy Policy