What is NRDM

user2

At random intervals, my pfSense installation tries to connect to tcp/443 to nrdm.netgate.com (208.123.73.93) ... does anybody know why? Is there a configuration setting to turn it off? Thanks.

DaddyGo

@user2 said in What is NRDM:

tries to connect to tcp/443 to nrdm.netgate.com (208.123.73.93) ... does anybody know why?

Hi,

Is it likely that you are on version 2.5 DEV ....?!
In this case, you can read a few words about it here (this is an integrated management platform)
https://www.netgate.com/blog/pfsense-2-5-and-aes-ni.html

it certainly can't be disabled, but why would you do that with a Netgate domain
it can have some function for sure

kiokoman

nrdm.netgate.com does not resolv to that ip, at least not for me or for google dns
;ANSWER
nrdm.netgate.com. 1799 IN A 172.27.10.126

i don't know what that ip is for, maybe it check for update or it come from some additional package, you can use packet capture to see what's going on.
there is no reason to ask 4 times the same question on different place
in the meantime i will put my tinfoil hat just to be safe

Gertjan

pfSense telemetry ?

@kiokoman : pas me your hat, please.

stephenw10

It's ews.netgate.com. See: https://forum.netgate.com/post/941202

johnpoz

If nrdm is now ews, someone should prob update the PTR ;)

;; ANSWER SECTION:
93.73.123.208.in-addr.arpa. 3600 IN     CNAME   93.0-255.73.123.208.in-addr.arpa.
93.0-255.73.123.208.in-addr.arpa. 10800 IN PTR  nrdm.netgate.com.

kiokoman

nice, so i was right about check for update plus the content of the "services and support" plus copyright stuff
@Gertjan I think we can safely remove the tinfoil hat this time, no rush but send me back what I lent you

stephenw10

Should be fixed, thanks.

johnpoz

yup fixed

;; QUESTION SECTION:
;93.73.123.208.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:
93.73.123.208.in-addr.arpa. 3584 IN     CNAME   93.0-255.73.123.208.in-addr.arpa.
93.0-255.73.123.208.in-addr.arpa. 10784 IN PTR  ews.netgate.com.

user2

Thank you to all that responded. Much appreciated!

AKEGEC

@user2 , I think you are overly worried, but then again that's your right. Anyway the IP address that you mentioned is related to these IP addresses:

IPV4
24.227.211.0/24 	
64.17.0.0/20 	
64.20.224.0/19 	
64.20.224.0/20 	
66.219.32.0/19 	
96.47.208.0/20 	
96.47.209.0/24 	
192.188.253.0/24 	
198.252.182.0/24 	
208.67.240.0/21 	
208.123.64.0/19 	
208.123.73.0/24
216.1.112.0/22 	 

IPV6
2610:160::/32