TCP:FA & TCP:RA Blocks from VPN Provider address

4o4rh

My log is full of blocks from the internal address of my VPN provider (expressvpn) per the two samples below.

10.118.x.x:8090 10.118.x.x:10735 TCP:FA
10.118.x.x:8090 10.118.x.x:25582 TCP:RA
10.118.x.x:8090 10.118.0.238:11544 TCP:A

Do these need to pass? if so, how do i get them to pass?

4o4rh

no one knows what this is?

MoonKnight

@gwaitsi said in TCP:FA & TCP:RA Blocks from VPN Provider address:

no one knows what this is?

They represent the TCP flags, indeed. RFC 793, 3.1:

Control Bits: 6 bits (from left to right):

    URG: Urgent Pointer field significant
    ACK: Acknowledgment field significant
    PSH: Push Function
    RST: Reset the connection
    SYN: Synchronize sequence numbers
    FIN: No more data from sender

And additions:

NS: ECN-nonce - concealment protection. RFC 3540
CWR: Congestion window reduced. RFC 3168
ECE: ECN-Echo. RFC 3168

From this we can deduce:

TCP:RA = RST, ACK
TCP:FA = FIN, ACK
TCP:PA = PSH, ACK
TCP:S = SYN
TCP:SEC = SYN, ECE, CWR

kiokoman

If reply traffic such as TCP:A, TCP:SA, or TCP:RA is shown as blocked in the logs, the problem could be asymmetric routing or they are packets arriving after firewall has removed the connection state
https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html#troubleshooting-blocked-log-entries-for-legitimate-connection-packets

bingo600

@kiokoman said in TCP:FA & TCP:RA Blocks from VPN Provider address:

If reply traffic such as TCP:A, TCP:SA, or TCP:RA is shown as blocked in the logs, the problem could be asymmetric routing or they are packets arriving after firewall has removed the connection state
https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html#troubleshooting-blocked-log-entries-for-legitimate-connection-packets

+1 for "removed connection states"

I see lots of ie. TCP-443 RA or FA (to misc. Web addresses) on my pfSense, They happens when i open the lid on my laptop , and wake it up.
All the Amazon-AWS & Google ~~sh..~~ stuff tries to resume , but the states has timed out on the pfSense a loooong time ago.

/Bingo