Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IGMP logs make pf logs mess

    Scheduled Pinned Locked Moved General pfSense Questions
    11 Posts 3 Posters 4.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      localhostx
      last edited by

      Hi guys, I have been using pfSense 2.1 for a while and spending time to learn it, however I couldn't find a solution for the spoofing IGMP logs.

      In system logs-> firewall the output is as follows.

      Although, I set a firewall rule to top of the rules list to block any to any IGMP packets without loging, pfSense generates these IGMP logs.

      I also have the same problem in netbios TCP 138 port.

      do you have any idea?

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        the source is private, did you put the rule on the correct interface?  em0 doesn't tell me if that is wan or lan.  But since private I would guess lan?

        On wan the default block private should be blocking that anyway you would think.  Unless you unchecked that?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • L
          localhostx
          last edited by

          em0 -> WAN
          em1 -> LAN

          In firewall logs, pfSense indicates the WAN port sometimes as "WAN" and other times as "em0" I don't know why it is like that.

          Here is my WAN Rules

          so it should be blocked but not generate any log

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Try changing the source to that 192.168.0.1 IP for your IGMP rule.  For some reason its not matching that rule?

            Also what if you put in 224.0.0.1 as dest?

            I don't see any igmp traffic in my logs so kind of hard to test, nor anything to 137-139 either.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • L
              localhostx
              last edited by

              I've already tried setting source and destination ports but didn't work also.

              1 Reply Last reply Reply Quote 0
              • L
                localhostx
                last edited by

                when I disabled the "Block private networks" option on WAN IGMP logs stoped. This is strange.

                Even if there is a bad config on my ISP side, It was able to disable logging.

                1 Reply Last reply Reply Quote 0
                • L
                  localhostx
                  last edited by

                  @HakanTT:

                  when I disabled the "Block private networks" option on WAN IGMP logs stoped. This is strange.

                  Even if there is a bad config on my ISP side, It was able to disable logging.

                  Sorry, I've just realize that disabling the  "Block private networks" option on WAN solves the problem

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    Yeah doesn't look like you can turn logging on or off for that block private rule - so it must log by default, like the normal default rule does. If you look at the block private rules using pfctl -sa

                    http://doc.pfsense.org/index.php/How_can_I_see_the_full_PF_ruleset

                    block drop in log quick on em1 inet from 192.168.0.0/16 to any label "Block private networks from WAN block 192.168/16"

                    btw what change did you make to show rule in the firewall log, I have to click on the block X to see what rule number(s)  Maybe your not seeing all the rules that got triggered?

                    I am running
                    2.1-BETA0 (i386)
                    built on Fri Nov 2 10:50:45 EDT 2012
                    FreeBSD 8.3-RELEASE-p4

                    And my firewall log doesn't show the rules, is it in a newer snap?  I normally update every couple of weeks and run git sync every few days.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • P
                      phil.davis
                      last edited by

                      btw what change did you make to show rule in the firewall log, I have to click on the block X to see what rule number(s)  Maybe your not seeing all the rules that got triggered?

                      System Logs, Settings, Filter Descriptions - pick "Display as column" or "Display as second row"
                      That's a nice little enhancement that was added a month or 2 ago.

                      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                      1 Reply Last reply Reply Quote 0
                      • L
                        localhostx
                        last edited by

                        @johnpoz:

                        Yeah doesn't look like you can turn logging on or off for that block private rule - so it must log by default, like the normal default rule does. If you look at the block private rules using pfctl -sa

                        http://doc.pfsense.org/index.php/How_can_I_see_the_full_PF_ruleset

                        block drop in log quick on em1 inet from 192.168.0.0/16 to any label "Block private networks from WAN block 192.168/16"

                        And my firewall log doesn't show the rules, is it in a newer snap?  I normally update every couple of weeks and run git sync every few days.

                        Thanks Johnpoz.

                        Seems that there is miss configuration on the ISP side and they are broadcasting IGMP packets on the end networks which end users are connected.
                        Is there any way to change full PF rullset. Is it written on a file?

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          http://doc.pfsense.org/index.php/How_can_I_edit_the_PF_ruleset

                          I would assume you could edit them with pfctl if you wanted - but wouldn't survive reboot, etc.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.