Hide TCP Blocks in logs
-
I know this is mostly down to timing issues from Google and other CDNs delaying the TCP:FA/FPA/PA/RA etc but I was wondering if there was a way to just hide this return traffic from my firewall logs. I tried adding a default block to the end of my rules however it stops snort logs as well so I'm wondering if I'm missing an option to block default traffic but still have snort logs show up and other blocks but just hide the TCP traffic blocks in the logs.
-
@lurick how does a block rule at the end that doesn't log on you wan stop snort from doing what exactly?
What exactly does it stop snort from showing/doing?
-
@johnpoz In the firewall logs under Status > System Logs > Firewall logs is what I'm looking at, sorry for not being clear.
-
You can disable logging anything blocked by the default block rule, which is usually what block that:
https://docs.netgate.com/pfsense/en/latest/monitoring/logs/settings.html#global-log-settingsIf you still want to log other traffic being blocked by the default rule you would need to add you own block rule that matches only that out-of-state TCP traffic and doesn't have logging enabled so you can leave default rule logging enabled.
Steve
-
@lurick how does that have anything to do with snort?
Yeah if you tell the firewall not to log X, X wouldn't be in the logs - but what does that have to do with snort?
-
@johnpoz The reason I mentioned snort is it wouldn't show blocked due to snort in the logs with a default block any any at the end of the rules with logging disabled. I didn't think about just blocking and not logging TCP states like FPA/PA/etc. and not logging those since I completely blanked that it would still allow legit traffic, just block out of state traffic by putting that deny at the bottom of the list for WAN stuff.
-
Yup, that would work.
Traffic blocked by Snort shouldn't appear under the default block rule though. Snort has it's own rule it blocks with in Legacy mode. Or in in-line mode it blocks before the firewall rules are parsed anyway.
Steve
