Internet ICMP Pings from one.one.one.one ???

pete35

Today i catched a ping incoming from the Internet to my Firewall WAN port with source 1.1.1.1 ? (!) I don`t use 1.1.1.1 in my network. Does cloudflare ping random IP addresses ?

tinfoilmatt

Does cloudflare ping random IP addresses ?

short answer: no. something on your network is attempting to contact 1.1.1.1. would need to see full ruleset (and possibly some reconfigured logging) to definitively say what or why.

johnpoz

@pete35 seems unlikely that they would be sending out pings to IPs.. Now if you sent a traceroute they could be sending back an icmp message, etc.

But even if something behind pfsense was pinging or tracerouting to 1.1.1.1 the responses would be allowed via the states created when your client was allowed out from pfsense.

Are you seeing these on a regular bases? Did you have any sort of outage of internet just before this, where you have states reset in your settings?

What is in front of pfsense - devices use to leverage 1.1.1.1 for stuff, cisco use to use it on their wireless controllers, etc. if its a one I wouldn't worry too much about it.. If your seeing them regular I would look into it deeper for sure.

Look in your state table do you see any of your clients talking to 1.1.1.1 ?

But with @cyberconsultants I find it highly unlikely that 1.1.1.1 is sending out random pings to IPs..

edit: could be some sort of health check for some of their other services, they have tunnels - think they call it magic wan, etc.. Maybe something related to that. It is curious for sure - but without more details, it impossible to say really.. Now if they happen on a regular interval that would be more interesting.

So you have any sort of multwan setup?

tinfoilmatt

@johnpoz said in Internet ICMP Pings from one.one.one.one ???:

But even if something behind pfsense was pinging or tracerouting to 1.1.1.1 the responses would be allowed via the states created when your client was allowed out from pfsense.

not necessarily true. local routing environment could be asymmetric (intentionally or otherwise) and sloppy state not permitted on relevant pass rule/s.

So you have any sort of multwan setup?

i think you beat me by three or so seconds, lol.

johnpoz

@cyberconsultants yeah ;) in a normal setup it shouldn't be possible if the client only has a single connection, but if doing something weird with multiple wans yeah for sure might be possible to get a reply to the wrong IP, etc.

Without more details its really hard to say would would/could cause that - but I find it highly unlikely cloudflare is sending out random pings from their 1.1.1.1 address ;)

pete35

In front of the Pfense is the ISP cable modem. No MultiWAN. Nothing else. It was a one time ping. No states to 1.1.1.1 in the firewall table. No states resets or outages at this time. Maybe some sort of Smartphone guest on my WLAN, which was disconnected at this time.

Nevermind, i have a huge amount of incoming connections, which pfsense blocks away.

Thanks for the Explanations.