Why is this happening?

the.it.dude

Hi all,

I've been seeing packets with public IP address source packets being blocked on our LAN interface in the logs. So I switched to see the raw logs and this is what I see:

pf: 00:00:00.782727 rul 2/0(match): block out on bge0: (tos 0x0, ttl 246, id 65259, offset 0, flags [none], proto TCP (6), length 40)
pf: 67.237.14.12.11366 > 172.16.1.40.80: Flags [R], cksum 0x82e7 (correct), seq 2811491693, win 11610, length 0

So I noticed the block is happening as the packet is exiting the LAN interface (and not entering as I had feared). I also see that they are Reset packets. But, can someone explain why this is being blocked? (And why it is not being blocked inbound on the WAN interface?)

Thanks,

Jeff

jimp

Most often it's this:

http://doc.pfsense.org/index.php/Logs_show_%22blocked%22_for_traffic_from_a_legitimate_connection,_why%3F

the.it.dude

Jimp,

I figured it wasn't anything major to worry about. It's probably been going on forever. But, I just restored my RC3 config to release on a new box and I was looking at the logs carefully.

I'm aware of the condition that you linked to. And it makes sense to me when it is blocked at the wan interface. I'm just curious as to why, in my case, I'm seeing it on the LAN interface?

Jeff