Block unwanted IPsec connection attempt
-
Hello everyone
I have deployed a pfSense firewall and managed to set up two IPsec connections with little trouble :-)
However, when I look in the IPsec system log I can see that a third unknown IP adr is continuously attempting to establish an IPsec tunnel.
It obviously fails with a "no IKE config found", but is there a good way to block this connection attempt from even trying to establish a tunnel. Needless to say the IPsec system log is almost exclusively full of connection attempts from the unknown IP adr.
Thanks
Jacob -
@jacobthastrup If you have a IP filling your log with spam, just block that IP in your wan rules before your allow rule for whatever service your running.
Now it will not be able to talk to your service, and the traffic will just be dropped. So no entries in your service log. As long as you don't log this rule, then you will never see anything logged for it in your firewall log or your service log, it just dropped, ie ignored.
example:
Say 1.2.3.4 is your problem IP, such a rule would just drop traffic from this IP before it could talk to any of your services you have open on the wan. If you want to be specific and just not let it talk to a specific service, than be more specific in your block rule.
Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.
-
@johnpoz
Thanks for the reply.
I think I've done that, i've also added it to the LAN and IPsec section for good measure.
And still I get the following in the IPsec log:
I've blacked out my IP.Thanks
Jacob
