Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Confused by firewall - Appears to be on LAN?

    Firewalling
    3
    3
    234
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jordanb last edited by

      I'm seeing a bunch of traffic that I'm trying to block.  I've set up pfBlockerNG, but that doesn't seem to be triggering with my config.

      In the Firewall log, I'm confused by what I'm seeing (screenshot also attached):

      Action Time Interface Rule Source Destination Protocol
      Apr 5 14:35:09 ► LAN let out anything IPv4 from firewall host itself (1000002665)   222.186.138.65:27186   192.168.0.3:1433 TCP:S

      Why is the Interface LAN if the source is an external IP and the destination is an internal IP?  Isn't it a rule on the WAN Interface that would allow/block this traffic?  I'm not sure why the rule "let out anything IPv4 from the firewall host itself" would apply in this situation.

      It feels like a horror movie where the operator says "THE CALL IS ORIGINATING FROM WITHIN THE HOUSE!"    :P

      Am I just really misunderstanding what I'm seeing?  Thanks!

      1 Reply Last reply Reply Quote 0
      • ?
        A Former User last edited by

        ??? Yep. Looks like China telecom is sending the start of a three way handshake. That is the starting SYN packet going through
        your defences.  If you see a SYN/ACK (SA) going out and a ACK (A) coming in, in that order, they ARE in the HOUSE.
        Totally backwards. SYN out, SYN/ACK in, ACK out is how it should be.
        There is some rule fuc*ery afoot.

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by

          Post up your wan rules and your lan rules and your port forwards..

          1 Reply Last reply Reply Quote 0
          • First post
            Last post

          Products

          • Platform Overview
          • TNSR
          • pfSense Plus
          • Appliances

          Services

          • Training
          • Professional Services

          Support

          • Subscription Plans
          • Contact Support
          • Product Lifecycle
          • Documentation

          News

          • Media Coverage
          • Press
          • Events

          Resources

          • Blog
          • FAQ
          • Find a Partner
          • Resource Library
          • Security Information

          Company

          • About Us
          • Careers
          • Partners
          • Contact Us
          • Legal
          Our Mission

          We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

          Subscribe to our Newsletter

          Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

          © 2021 Rubicon Communications, LLC | Privacy Policy