Strange blocking not matching a rule
-
Hi
Could you help me to understand or investigate on this strange behavior?
Its on a home network and so a quite simple config.
My LAN is 192.168.1.0/24
My DMZ is 192.168.2.0/24I have the following rules for LAN
Note that last line with 3306 port (MySQL), was added after the problem happened, when I was inspecting the logs. So consider that this entry doesn't exist.
All traffic on any port from LAN to anything (and thus including DMZ) is supposed to be allowed. I have nothing in the DMZ rules that would block inbound traffic from LAN. Only everything from DMZ to LAN is blocked. I've got 6 servers in the DMZ running a lot of things on a lot of ports, and I have zero issue reaching them from my LAN.
But this morning I have noticed all those blockings that happen mostly everyday for a short period of time:
192.168.1.3 is a linux VM in the LAN dedicated to monitoring with Zabbix. It stores data in my dedicated MySQL server which is another Linux VM in the DMZ (192.168.2.2).
How could this traffic be blocked ?? How can I investigate this ?
Note that I have PfblockerNG and Snort. But although Snort is watching all interfaces (WAN/LAN/DMZ), it only block on WAN. SO its most probably not coming from thereCheers
-
@t0m77 see if this helps
https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.htmlEdit: also, DMZ rules are unable to affect traffic from LAN. Rules apply to traffic inbound on the interface.
-
@steveits it answers my question, thanks!