TCP:FA & TCP:RA Blocks from VPN Provider address
-
My log is full of blocks from the internal address of my VPN provider (expressvpn) per the two samples below.
10.118.x.x:8090 10.118.x.x:10735 TCP:FA
10.118.x.x:8090 10.118.x.x:25582 TCP:RA
10.118.x.x:8090 10.118.0.238:11544 TCP:ADo these need to pass? if so, how do i get them to pass?
-
no one knows what this is?
-
@gwaitsi said in TCP:FA & TCP:RA Blocks from VPN Provider address:
no one knows what this is?
They represent the TCP flags, indeed. RFC 793, 3.1:
Control Bits: 6 bits (from left to right): URG: Urgent Pointer field significant ACK: Acknowledgment field significant PSH: Push Function RST: Reset the connection SYN: Synchronize sequence numbers FIN: No more data from sender
And additions:
NS: ECN-nonce - concealment protection. RFC 3540 CWR: Congestion window reduced. RFC 3168 ECE: ECN-Echo. RFC 3168
From this we can deduce:
TCP:RA = RST, ACK TCP:FA = FIN, ACK TCP:PA = PSH, ACK TCP:S = SYN TCP:SEC = SYN, ECE, CWR
-
If reply traffic such as TCP:A, TCP:SA, or TCP:RA is shown as blocked in the logs, the problem could be asymmetric routing or they are packets arriving after firewall has removed the connection state
https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html#troubleshooting-blocked-log-entries-for-legitimate-connection-packets -
@kiokoman said in TCP:FA & TCP:RA Blocks from VPN Provider address:
If reply traffic such as TCP:A, TCP:SA, or TCP:RA is shown as blocked in the logs, the problem could be asymmetric routing or they are packets arriving after firewall has removed the connection state
https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html#troubleshooting-blocked-log-entries-for-legitimate-connection-packets+1 for "removed connection states"
I see lots of ie. TCP-443 RA or FA (to misc. Web addresses) on my pfSense, They happens when i open the lid on my laptop , and wake it up.
All the Amazon-AWS & Googlesh..stuff tries to resume , but the states has timed out on the pfSense a loooong time ago./Bingo