malware outgoing blocked - help to interpret firewall log entry
-
@e4ch said in malware outgoing blocked - help to interpret firewall log entry:
But if such a blacklist now contains private IPs, that might be a problem when internal traffic must go through the firewall
Put a rule that allows traffic to your other rfc1918 addresses on other networks if you want to allow that.
Rules are evaluated in order top down, first rule to trigger wins - no other rules are evaluated. So if you have rule that allows 192.168.1.0/24 above a rule that blocks 192.168.0.0/16 doesn't matter because your rule above allows to your other network say to 192.168.1.42 or whatever.
-
@e4ch said in malware outgoing blocked - help to interpret firewall log entry:
I might need a better blacklist or just use the remaining two lists.
Just use pfBlocker for all your blacklists, it will remove any private IPs for you but before learning pfBlocker you have to understand the fundamentals: Everything is always incoming/inbound to the firewall interface, not outbound.
That means, if you want to block some bad IP from the internet, you have to create the rule on WAN with source bad IPs.If you want to block hosts on your LAN to reach bad IPs, you have to do it on your LAN interface with destination bad IPs.
The reasons is that all traffic is only evaluated once by the firewall, when it first enters it. If it is not filtered there, the traffic can go everywhere.
I hope this helps.
-
@Bob-Dig Thanks and understood. I'll have a look at pfBlocker.
