Port 443 recommend TCP flag settings?

JonathanLee · Dec 9, 2021, 4:29 AM

Hello fellow Netgate community,

Can you help? What is the recommended setting for the TCP flags now with use of UDP 443 and TCP 443 for QUIC Protocol use?

(Image: Firewall access control rule advanced options)

(Image: Firewall log showing blocked 443 for specific TCP flag)

johnpoz · Dec 9, 2021, 7:50 AM

@jonathanlee you don't need to adjust those.. Those are out of state..

https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html

edit: btw not mentioned in that article - but can also cause those is something like a cell phone switching between its wifi and cell and trying same connection.

Or a device that has been in standby, and coming out and trying to use or close its old sessions while the firewall has already timed out the session.

Those are closing flags, RA and FA.. Could just be the states were reset on the firewall (say internet loss and pfsense set to reset states).. When you see lots of say SA, those scream of asymmetrical traffic flow.

If your states have been reset, and the client determines that hey this session is no longer working - it will try and close the state sending Fin and even Reset.. Before it sends a new syn to open another session.