TCP:S vs TCP:FA

erbalo · May 24, 2020, 3:22 PM

@johnpoz Thats right i have checked my logs and there are lot of logs with FA / A etc.. and i see very low S flags.

johnpoz · May 24, 2020, 4:54 PM

Before you turn off logging of this noise.. You shouldn't be seeing them - it points to a problem that should be fixed vs just ignored..

Do these comes in spurts or it just constant flood of them?

erbalo · May 24, 2020, 5:34 PM

@johnpoz i will check it 2 days and let you know. 2/3 days before i did changed some settings on pfsense related pfblocker as dnsbl settings and it happened directly after i reset the states on pfsense. So it happens now every minute 10/20 times.

I would like to solve this problem and what can i check more?
Also by last changing of my settings no more ads blocks by browser but i did checked dns resolver with nslookup but this works well.

Maybe that can help to find the problem or from where to startup.

johnpoz · May 24, 2020, 6:41 PM

@erbalo said in TCP:S vs TCP:FA:

it happened directly after i reset the states on pfsense

Yeah after you do that - sure you could see a flood of out of state traffic. But that flood should of contained Acks, just A not only just FA... But if you were seeing both A and FA.. it could of just been the flood you would see after a reset of all states on the firewall.

erbalo · May 24, 2020, 10:41 PM

@johnpoz I am just seeing A , FA, FPA, RA, PA

I have checked if there a S was but on the last 1000 entries o don't see any S flags.. What will be next and is it dangerous i mean is it a DDOS attack or something like that? I hope you can help me to solve this problem.

johnpoz · May 25, 2020, 1:08 AM

@erbalo said in TCP:S vs TCP:FA:

I have checked if there a S was but on the last 1000 entries o don't see any S flags

Currently your seeing them? You reset the states again? If not then you have asymmetrical traffic flow most likely...

erbalo · May 25, 2020, 7:14 AM

Yes, currenty i am seeing them except S flags also after resetting states again.

I checked also NTOP,

IOT Interface:

Lan Interface:

Wan Interface:
Zero dropped packets

johnpoz · May 25, 2020, 10:54 AM

@erbalo said in TCP:S vs TCP:FA:

after resetting states again.

Why are you resetting states.. There is almost never reason to do that.. If your creating a rule and need, just reset the state for the IPs in question of that new rule. And only time you have to reset state on a new rules, is in the case where traffic already there that would match your rule.. Say you want to block port X.. And device A was talking to something already on port X.. You might want to kill that specific state, vs waiting for that session to end or time out so the rule would block new traffic to that port.

IPS dropping shit is not in your firewall log. You would need to look into IPS to why its dropping stuff. If the firewall dropped the packet, it would of never made it to the ips to even look at.

erbalo · May 26, 2020, 7:47 AM

@erbalo Can you please advice me to where tick or untick on these settings as your advice. It is now clear by me that these logs what i am seeing there are out of states logs and i don't really to see that, it filling my logs only with full of entries.

johnpoz · May 26, 2020, 11:51 AM

Oh my gawd... You need to see them because there is something wrong! Why are you resetting states?

We already went over how not to see them..

erbalo · May 26, 2020, 3:09 PM

If it is something wrong i have no idea how i can solve this problem. I have followed your advice and NOT already reset the states.

johnpoz · May 26, 2020, 3:22 PM

So your not resetting states... And your still seeing a constant flood of this traffic?

If so then you have something MAJOR wrong with your network setup... Please draw out how you have this network connected together and were your clients are pointing to for their gateways.

If you are seeing constant traffic like this - this points to asymmetrical routing problem.. Not logging it doesn't fix the problem.

erbalo · May 26, 2020, 6:00 PM

@johnpoz
Yes, i am seeing constant flood.

Pfsense is installed on hyper vm.

Internal Realtek netwerk adapter used for Wan and connectesnmodem on this port and on pfsense used as Gateway.

External realtek netwerk adapter used for Lan and connected to netgear switch and created vlans and also the trunk port 1. Vlans are working. Also on hyperv via powershell created vlans to accept all of the vlans.

Clients are points to that Gateway, i have one gateway.

johnpoz · May 26, 2020, 6:37 PM

That sure doesn't look like a drawing to me..

That looks like words that don't really help... Since there is no details at all..

So you have 1 nic that is connect to your modem but then

this port and on pfsense used as Gateway.

How is pfsense your wan gateway??? That makes ZERO sense!!

External realtek netwerk adapter used for Lan and connected to netgear switch and created vlans and also the trunk port 1.

So now you have another adapter.. But you allow all vlans on this?? How many vlans? What netgear switch?

What gateway are you clients pointing to - they should be pointing to the IP of pfsense for their specific vlans - since you have stated you them?

Lets see the output of your hyper-v setup... Got to love how no mention of any VM or anything until now...

What networks are these vlans using - for all we know, since you hid the rfc1918 space.. The firewall is blocking IPs that are not even suppose to be in the iot vlan, etc..

Love to help be we have zero idea what sort of mess you have configured..

erbalo · May 27, 2020, 4:54 PM

This post is deleted!

johnpoz · May 27, 2020, 5:07 PM

Why do you have all your vlans on both interfaces in hyperv? Only network that should be on wan is the wan network..

erbalo · May 27, 2020, 9:22 PM

@johnpoz said in TCP:S vs TCP:FA:

Why do you have all your vlans on both interfaces in hyperv? Only network that should be on wan is the wan network..

Corrected the Interfaces: