Question about device discovery across subnets
-
I have a Netgate 4200 and have been noticing blocked traffic in my firewall logs for two Windows computers on different subnets. The traffic seems to be tied to the windows update sharing service. The subnets are on different switches + wireless APs connected to different ports on my network interfaces. I don't have Avahi installed or configured and have a firewall rule set to block all traffic between the two interfaces.
I'm wondering how they're seeing each other as when I use network scanning tools like fing or WiFiman they're not leaping across my vlans and spotting other devices.
-
are you using and/or also blocking IPv6 traffic between the subnets?
-
@luckman212 said in Question about device discovery across subnets:
are you using and/or also blocking IPv6 traffic between the subnets?
The toggle "Allow IPv6" is not enabled on my 4200. And I have a generic firewall rule to block all IPv4/IPv6 traffic between those subnets.
-
I don't know all the technical details of how the Windows Update sharing or bandwidth-saving feature works. But, I could easily imagine it having a discovery method that works something like this:
- PC1 on VLAN1 "phones home" to a coordination server at Microsoft, reporting some basic details about its network: LAN IP, WAN IP, MAC address of gateway etc
- PC2 on VLAN2 phones home to same coordination server
- Coordination server sees that PC1 and PC2 are likely behind the same NAT (since they share the same public IP, gateway MAC etc). It then instructs the 2 PCs to attempt to directly communicate via their LAN IPs
Some careful wireshark/tcpdumping would probably reveal more, and possibly how to block this if you really want to. Seems like your block rule is already doing the right thing though.
-
@ghar36k Are your accesspoints using one SSID with authentication to assign which VLAN the clients land in?
If thats the case, then remember you have to block multicast specifically in the Accesspoint, otherwise multicast to/from the clients will be distributed to both VLANs. -
@ghar36k you prob want to look over this
https://learn.microsoft.com/en-us/windows/deployment/do/delivery-optimization-configure
Local area network (LAN)
To define a peer group limited to your LAN, choose DODownloadMode (1), LAN-mode. This download mode setting includes any devices that share the same public IP address when they connect to the Internet (behind the same NAT) in a single peer group.
Pretty sure @luckman212 got very close to how its trying to talk to devices on other networks behind your router.
I would either just turn this off on the clients or your AD if running that these machines are a member of - or if you want allow the specific ports need between your subnets to allow for it.
-
@johnpoz said in Question about device discovery across subnets:
@ghar36k you prob want to look over this
https://learn.microsoft.com/en-us/windows/deployment/do/delivery-optimization-configure
And this: Microsoft: How Delivery Optimization works.
-
Just adding to the already-sound list of suggestions to check managed switches and AP's for: VLAN isolation via ACLs, and IGMP/MLD snooping/proxying.
-
@tinfoilmatt said in Question about device discovery across subnets:
Just adding to the already-sound list of suggestions to check managed switches and AP's for: VLAN isolation via ACLs, and IGMP/MLD snooping/proxying.
I have a managed UnFi switch and AP. Gateway mDNS Proxy is turned off which shouldn't forward multicast traffic across my VLANS. I have multicast filtering set to auto, which the documentation indicates will only forward multicast traffic within the VLAN and not across them. To troubleshoot a similar issue with an Apple device I has previously turned on Client Device Isolation for all of the WiFi networks/VLANs managed by the Ubiquiti switch/AP. I don't have IGMP snooping/proxying on from what I can see.
The only subnet that operates outside of my Unifi hardware is an old EERO device I have set to bridge mode. I can't set VLANs on that device so I'm wondering if there's some kind of segregation issue there. The EERO is the one that's connected to the separate port and is not connected to the managed switch on my Unifi hardware.
@keyser said in Question about device discovery across subnets:
@ghar36k Are your accesspoints using one SSID with authentication to assign which VLAN the clients land in?
If thats the case, then remember you have to block multicast specifically in the Accesspoint, otherwise multicast to/from the clients will be distributed to both VLANs.I was thinking about doing this. It's not really a permanent issue as one of the Windows PCs is owned by a house guest. I'm more wondering if I've messed my configuration up somewhere that would let them see/speak to each other without the above mentioned methods. I did notice something similar happening with MDNS traffic between an iPhone and an Apple TV which is why I made this thread.
@luckman212 said in Question about device discovery across subnets:
I don't know all the technical details of how the Windows Update sharing or bandwidth-saving feature works. But, I could easily imagine it having a discovery method that works something like this:
- PC1 on VLAN1 "phones home" to a coordination server at Microsoft, reporting some basic details about its network: LAN IP, WAN IP, MAC address of gateway etc
- PC2 on VLAN2 phones home to same coordination server
- Coordination server sees that PC1 and PC2 are likely behind the same NAT (since they share the same public IP, gateway MAC etc). It then instructs the 2 PCs to attempt to directly communicate via their LAN IPs
Some careful wireshark/tcpdumping would probably reveal more, and possibly how to block this if you really want to. Seems like your block rule is already doing the right thing though.
This makes a lot of sense. The same sort of thing happened between two Apple devices too a few months ago (owned by different Apple accounts). If Apple has the same sort of system it explains how they're seeing each other.
-
@keyser said in Question about device discovery across subnets:
@ghar36k Are your accesspoints using one SSID with authentication to assign which VLAN the clients land in?
If thats the case, then remember you have to block multicast specifically in the Accesspoint, otherwise multicast to/from the clients will be distributed to both VLANs.They're all using separate SSIDs.
-
Whoops! I quoted keyser in that big block of text above when I meant to quote part of the comment about wireshark/tcpdumping. It won't let me edit it anymore to fix it. Sorry for the misquote and excessive pings.
Privacy Policy · Cookie Policy