Some traffic bocked with explicit port forward

dillbilly

I'm trying to determine the source of some unexpected behaviour regarding port forwarding and traffic being logged as blocked by the firewall. I had set up an alias combining several ports to forward to my internal server, but I continued to see those ports show up in my firewall as being blocked by the default rule, though some connections are still being made to the internal server. I took the following steps to try to resolve the isuue:

I turned off logging of traffic blocked by the default rule after reading that some traffic listed as blocked by that rule are redundant packets
I created a new rule to reject all traffic and placed it last in the rules list
I deleted the rules which used the alias and explicitly forwarded each port

I'm still seeing traffic logged with my custom rule

@114 block return in log quick on em0 reply-to (em0 x.x.x.x) inet all label "USER_RULE: Default Reject Rule"

however, not all traffic is being blocked, as my server still seems to be accepting connections.

Any ideas?

johnpoz

Post the rules and then maybe we might..

dillbilly

Port forward:
If Proto Src. addr Src. ports Dest. addr Dest. ports NAT IP NAT Ports Description
WAN TCP * * WAN address 8321 x.x.x.x 8321

Rules
WAN
Proto Source Port Destination Port Gateway Queue Schedule Description
IPv4 TCP * * x.x.x.x 8321 * none NAT
IPv4 * * * * * * none Default Reject Rule

Server's VLAN
Proto Source Port Destination Port Gateway Queue Schedule
IPv4* VLAN248 net * ! Private_Networks * * none

No other block rules are in place, the server and my server has connections established on 8321. I'm just confused as to why some packets are getting blocked and are apparently not being forwarded. It also seems like several in a row from the same source IP will be blocked, as opposed to a random selection of packets, but I have nothing in place to block any specific addresses.

edited for formatting

johnpoz

I thought there were more rules than this – so its possible other rule are doing something, without your full rule list its hard to say. That looks normal for a forward yes.

And what traffic is being blocked - are they SYN packets for new connections to that port? Its quite normal to see blocked packets in a stateful firewall even to ports your forwarding.. Depending on the STATE of the session.