Stop broadcast on non-connected interface

[girkers]

I am "new" to pfsense and need some help.

pfsense is installed on ESXi v6.5 and I have three (3) NICs attached:

• VMX0 - WAN

• VMX1 - LAN

• VMX2 - vLANS

What is happening is a computer on the LAN is broadcastings to the LAN Broadcast address x.x.x.255 however it is going out to the vLAN adapter. It makes no difference if the VMX2 is allocated or not, it simple changes the name in the Firewall when you see the block.

Can I stop this from happening or do I have to suppress the log entry? I would prefer the former.

Thanks

[JKnott]

@girkers

What is it broadcasting? You can use Packet Capture to see what.

[johnpoz]

@girkers said in Stop broadcast on non-connected interface:

however it is going out to the vLAN adapter.

No it isn't - you don't have your L2 networks actually isolated if your seeing broadcast traffic on any other than the L2 the device that is broadcasted is connected to..

[girkers]

There are a number of devices on my network that are doing the broadcast, here is an example:

Jul 27 09:50:00 vmx2 (1000002620) 192.168.254.174:5353 224.0.0.251:5353 UDP
Jul 27 09:50:00 vmx2 (1000002620) 192.168.254.174:5353 224.0.0.251:5353 UDP
...
Jul 27 09:56:11 vmx2 (1000002620) 192.168.254.92:61519 192.168.254.255:1947 UDP

My Interface assignments are:

Interface Network port
WAN vmx0
LAN vmx1
Media VLAN xx on vmx2
Camera VLAN xx on vmx2
Guest VLAN xx on vmx2
Available network ports: vmx2

I am confused by this: "you don't have your L2 networks actually isolated if your seeing broadcast traffic on any other than the L2 the device is broadcasted is connected to"

I do have Avahi installed for mDNS reflexion across my vLANs, but all of the traffic is coming from my LAN onto the vmx2.

Yes I get the basic difference between a L3 and L2 networks, but that doesn't solve my confusion as to why a Broadcast on my LAN is trying to be "routed" to vmx2 an adapter that is not even connected to a network (in theory). Let alone how to stop if from happening.

Cheers

[johnpoz]

You have your L2 connected in your VM then... Broadcast traffic like you posted, will not be routed.. If your seeing broadcast on a different interface than the interface connected to that specific L2, then you have your L2 networks connected somewhere..

You have to find how your L2 are connected together..

edit: So this
Jul 27 09:56:11 vmx2 (1000002620) 192.168.254.92:61519 192.168.254.255:1947 UDP

Your saying that 192.168.254 is not the network on your vmx2 interface? Your saying that is your LAN network?? What is the networks on your vmx2?

If your saying that 192.168.254 is not a network on your vmx2 interface, ie if that is your LAN... Then you have them connected somewhere.. There is no possible way for broadcast on your vmx1 network to be seen on your vmx2 interface unless you have those 2 different L2 networks connected somewhere.. Be it a wire, be vswitch not handling tags correctly or something on both your vmx1 network and your vmx2 bridging the traffic..

[JKnott]

@girkers

Those aren't broadcasts, they're multicasts. That address and port is for mDNS.

[girkers]

@johnpoz

That now makes sense, I was looking in the wrong spot.

Looking at the way I have my vSwitch configured I have three (3) NICs that are shared across both my LAN and vLANs and that is where the traffic is getting through.

Thanks for taking the time to clarifying for me.