Logging WAN outbound question

[user2]

Is there a way to log only the traffic originating from the WAN outbound, without logging the LAN to WAN NAT traffic?

All the LAN to WAN NAT traffic is getting logged as "let out anything from firewall host itself" -- I am trying to avoid logging that.

Thanks for the help.

[johnpoz]

@user2 said in Logging WAN outbound question:

"let out anything from firewall host itself"

That is not nat traffic.. That is traffic from the firewall.

How are you logging? Where did you put a log rule?

[user2]

Thank you for the quick reply. I am trying to troubleshoot and distinguish what seems to be way too many events originating from my firewall outbound over the WAN.

In Status / System Logs / Settings, I have these checked on:
"Log packets matched from the default block rules in the ruleset";
"Log packets matched from the default pass rules put in the ruleset";

The result in logs shows lots of lines such as:
pass Sep 30 21:10:20 ► WAN let out anything from firewall host itself (1000004861) [ (many different IPs for TCP:SYN/443) ]

If I place a floating quick rule to log incoming LAN traffic (e.g. TCP:S/443), I see the same events logged by the default "let out anything from the firewall host itself", thus confirming it is logging the NAT LAN to WAN traffic.

So, here is where I am stuck -- how can I log only the traffic originating from the pfsense firewall outbound (and not the LAN to WAN passthru traffic)?

Thanks for your help.

[johnpoz]

you could put a log on the floating tab, with outbound logging pass.. From your wan IP..

Keep in mind your going to see say unbound trying to resolve stuff for clients, you would see the firewall checking to see if updates, ntp - ntp could be lots of different ips if you have pool set, etc.

[user2]

That's exactly the issue - the floating quick rule logging WAN outbound traffic also captures all the LAN-to-WAN NAT traffic because that traffic appears in the logs as source address = my WAN ip. For example:

Sep 30 22:13:10 LAN LAN-all-TCP-SYN-logged (1536009505) 192.168.1.48:62455 45.57.40.1:443
anycast.ftl.netflix.com TCP:S
Sep 30 22:13:10 ► WAN let out anything from firewall host itself (1000004861) (my-wan-ip):35919 45.57.40.1:443
anycast.ftl.netflix.com TCP:S
Sep 30 22:13:10 ► WAN WAN-out-all-TCP-SYN-443-logged (1569895919) (my-wan-ip):62455 45.57.40.1:443
anycast.ftl.netflix.com TCP:S

Yes, I see outbound DNS forwarding and NTP too, which I expect.

It appears the pfsense UI doesn't allow any way to distinguish and log only the WAN traffic originating from the firewall (skipping the NAT's traffic)? [ My guess is there would have to be a specific pfctl rule ... any ideas? ]

Another potential workaround is if the default logging labeled the NAT'd traffic; then at least I could tell the two apart.

Thanks all for any ideas.

[johnpoz]

What exactly are you looking for? Can you not just disconnect any lan created traffic?

To distinguish between, you could turn off the default logging, and then log your lan rules with a description.. Now sure how you could log just stuff that didn't have a tag?

Wouldn't it be easier to just look in your state table for stuff that was created by the firewall? Vs passed through?

[user2]

I would like to add rules that:

allow from WAN out to specific IPs for NTP
allow from WAN out to specific IPs for DNS
allow LAN-to-WAN NAT pass through traffic
block (and log) everything else originating from the WAN out

Even if its not possible through the UI, I would appreciate any guidance for editing system config files. Detecting connections from the WAN out helps security ... to confirm our own firewall isn't initiating unknown connections outbound.

Thanks again.

[akuma1x]

Those first two you want to turn into rules I’m pretty sure are core features of pfsense already and are taken care of in the setup process of a fresh install.

If you want to monitor so badly, why don’t you setup a managed switch between your pfsense WAN port and your ISP modem? A managed switch will allow you to setup a mirror port that you can monitor all your WAN traffic with a 3rd party app like Solar Winds, Zabbix, or Cacti. I don’t use any of those, so I quick google-searched the names, sorry.

Jeff

[user2]

@akuma1x
Thanks Jeff, I really appreciate the response. The managed switch would definitely allow monitoring the WAN port, however it cannot distinguish the NAT'd traffic coming from the LAN versus that originating from the firewall. The firewall is in the unique position to be able to tell the two types of traffic apart.

[johnpoz]

@user2 said in Logging WAN outbound question:

our own firewall isn't initiating unknown connections outbound

And why and the F would it do that? Out of the box there is a rule to allow pfsense unfettered outbound access. You control what stuff can do behind it via rules on the interfaces they connect to pfsense from.

[Gertjan]

@user2 said in Logging WAN outbound question:

block (and log) everything else originating from the WAN out

What about, for example, the traffic originating from pfSense itself, like package and 'pfSense' upgrade checks ?

[akuma1x]

@user2 said in Logging WAN outbound question:

@akuma1x
however it cannot distinguish the NAT'd traffic coming from the LAN versus that originating from the firewall.

Do you know that for sure, especially while monitoring from a mirrored port? You sound as if you've tried this already.

Jeff

[Derelict]

Again, the solution lies in marking traffic as it enters the firewall and matching that mark on its way out WAN.