Traffic is blocked even with an any-any rule?
-
On one of my interfaces, I have some IoT things such as a Roku and Apple TV. The Roku (192.168.30.2) has an Allow Any rule on it, as seen here;
But in the logs, a lot of activity from 192.168.30.2 is being blocked by the Block Everything Else rule;
Why is this traffic not being allowed by the previous rule?
-
Notice the RA and PA, those are all out of state traffic.. So yeah would be blocked.
https://docs.netgate.com/pfsense/en/latest/firewall/troubleshooting-blocked-log-entries-for-legitimate-connection-packets.html
-
if firewall sees Fin and closes the state, then any other packets still being seen would be out of state and blocked. as johnpoz say
PA is Push ACK
RA is Reset ACK
you can ignore that block if you don't have other trouble -
There could be many reason for such blocks.. Anything that could cause no state would block anything other than Syn..
Asymmetrical is quite often an issue if stuff is not working and all you see is those. But those quite often would be lots of SA (syn,ack). Could be a loss of state do to some sort of rest in the firewall, change of IP on the wan, change of wan from primary to a backup. Loss of wan, when reset states are set to do that, etc.
If you are seeing a lot of it, then you might want to look deeper.. If you get floods of it now and everything is working as you want, then you could ignore it, not log if it bothers you.. Or look deeper.. Could be bad code on the devices where say if they loose their connection, they are not smart enough to create a new session, and try and use older ones that might have timed out, etc.
Those RA's are prob the device not being able to use the session anymore send a RESET.. Trying to tell the other side - hey I'm freaking done with this.. Hope you get this and close it as well.
