Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Logging WAN outbound question

    Scheduled Pinned Locked Moved NAT
    13 Posts 5 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • U
      user2
      last edited by

      Is there a way to log only the traffic originating from the WAN outbound, without logging the LAN to WAN NAT traffic?

      All the LAN to WAN NAT traffic is getting logged as "let out anything from firewall host itself" -- I am trying to avoid logging that.

      Thanks for the help.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        @user2 said in Logging WAN outbound question:

        "let out anything from firewall host itself"

        That is not nat traffic.. That is traffic from the firewall.

        How are you logging? Where did you put a log rule?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • U
          user2
          last edited by

          Thank you for the quick reply. I am trying to troubleshoot and distinguish what seems to be way too many events originating from my firewall outbound over the WAN.

          In Status / System Logs / Settings, I have these checked on:
          "Log packets matched from the default block rules in the ruleset";
          "Log packets matched from the default pass rules put in the ruleset";

          The result in logs shows lots of lines such as:
          pass Sep 30 21:10:20 ► WAN let out anything from firewall host itself (1000004861) [ (many different IPs for TCP:SYN/443) ]

          If I place a floating quick rule to log incoming LAN traffic (e.g. TCP:S/443), I see the same events logged by the default "let out anything from the firewall host itself", thus confirming it is logging the NAT LAN to WAN traffic.

          So, here is where I am stuck -- how can I log only the traffic originating from the pfsense firewall outbound (and not the LAN to WAN passthru traffic)?

          Thanks for your help.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            you could put a log on the floating tab, with outbound logging pass.. From your wan IP..

            Keep in mind your going to see say unbound trying to resolve stuff for clients, you would see the firewall checking to see if updates, ntp - ntp could be lots of different ips if you have pool set, etc.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • U
              user2
              last edited by

              That's exactly the issue - the floating quick rule logging WAN outbound traffic also captures all the LAN-to-WAN NAT traffic because that traffic appears in the logs as source address = my WAN ip. For example:

              Sep 30 22:13:10 LAN LAN-all-TCP-SYN-logged (1536009505) 192.168.1.48:62455 45.57.40.1:443
              anycast.ftl.netflix.com TCP:S
              Sep 30 22:13:10 ► WAN let out anything from firewall host itself (1000004861) (my-wan-ip):35919 45.57.40.1:443
              anycast.ftl.netflix.com TCP:S
              Sep 30 22:13:10 ► WAN WAN-out-all-TCP-SYN-443-logged (1569895919) (my-wan-ip):62455 45.57.40.1:443
              anycast.ftl.netflix.com TCP:S

              Yes, I see outbound DNS forwarding and NTP too, which I expect.

              It appears the pfsense UI doesn't allow any way to distinguish and log only the WAN traffic originating from the firewall (skipping the NAT's traffic)? [ My guess is there would have to be a specific pfctl rule ... any ideas? ]

              Another potential workaround is if the default logging labeled the NAT'd traffic; then at least I could tell the two apart.

              Thanks all for any ideas.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                What exactly are you looking for? Can you not just disconnect any lan created traffic?

                To distinguish between, you could turn off the default logging, and then log your lan rules with a description.. Now sure how you could log just stuff that didn't have a tag?

                Wouldn't it be easier to just look in your state table for stuff that was created by the firewall? Vs passed through?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • U
                  user2
                  last edited by

                  I would like to add rules that:

                  allow from WAN out to specific IPs for NTP
                  allow from WAN out to specific IPs for DNS
                  allow LAN-to-WAN NAT pass through traffic
                  block (and log) everything else originating from the WAN out

                  Even if its not possible through the UI, I would appreciate any guidance for editing system config files. Detecting connections from the WAN out helps security ... to confirm our own firewall isn't initiating unknown connections outbound.

                  Thanks again.

                  johnpozJ GertjanG 2 Replies Last reply Reply Quote 0
                  • A
                    akuma1x
                    last edited by

                    Those first two you want to turn into rules I’m pretty sure are core features of pfsense already and are taken care of in the setup process of a fresh install.

                    If you want to monitor so badly, why don’t you setup a managed switch between your pfsense WAN port and your ISP modem? A managed switch will allow you to setup a mirror port that you can monitor all your WAN traffic with a 3rd party app like Solar Winds, Zabbix, or Cacti. I don’t use any of those, so I quick google-searched the names, sorry.

                    Jeff

                    U 1 Reply Last reply Reply Quote 0
                    • U
                      user2 @akuma1x
                      last edited by

                      @akuma1x
                      Thanks Jeff, I really appreciate the response. The managed switch would definitely allow monitoring the WAN port, however it cannot distinguish the NAT'd traffic coming from the LAN versus that originating from the firewall. The firewall is in the unique position to be able to tell the two types of traffic apart.

                      A 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @user2
                        last edited by

                        @user2 said in Logging WAN outbound question:

                        our own firewall isn't initiating unknown connections outbound

                        And why and the F would it do that? Out of the box there is a rule to allow pfsense unfettered outbound access. You control what stuff can do behind it via rules on the interfaces they connect to pfsense from.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @user2
                          last edited by

                          @user2 said in Logging WAN outbound question:

                          block (and log) everything else originating from the WAN out

                          What about, for example, the traffic originating from pfSense itself, like package and 'pfSense' upgrade checks ?

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • A
                            akuma1x @user2
                            last edited by

                            @user2 said in Logging WAN outbound question:

                            @akuma1x
                            however it cannot distinguish the NAT'd traffic coming from the LAN versus that originating from the firewall.

                            Do you know that for sure, especially while monitoring from a mirrored port? You sound as if you've tried this already.

                            Jeff

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              Again, the solution lies in marking traffic as it enters the firewall and matching that mark on its way out WAN.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.