FW still blocks ALLOWED traffic from both WAN and LAN
-
Hi, I'm using PFSENSE 2.1.5 and having a strange problem with firewall rules. I added some rules in WAN and LAN to allow our public IP addresses:
Allow LOCAL_NET to access PUBLIC_REMOTE_IP
And vice versa
But Firewall logs still show it blocked many TCP:FA or TCP:SA
and
This is MS Exchange 2010 traffic over HTTPS by MS Outlook clients. I don't know why FW still blocks this traffic even when ALLOW rules was added. In additional, I rebooted PFSENSE after changes but it has no effect.
How do I do to correct this issue?
I appreciate your comments. Thanks. -
Relax, it's just out-of-state traffic. Nothing to worry about.
-
What KOM said. Unless you're actually having problems with your connections, it seems to be quite common for many network stacks to send additional TCP packets after a connection has been closed. TCP:FA is a FIN, telling the other side to close. My wife's cell phone is horrible with this. Spams up my logs. I may eventually stop logging LAN side, since it's all open anyway.
-
How can you disable logging?
-
Notice a couple of things here - why do you have bogon blocked on your lan? And what is the point of the wan rule?? You do understand that your server can talk back via states that client would create when talking to that outside IP.
As already stated out of state is common to see. If you don't want to log anything?? Then you can turn off logging of the default block rule under status, system logs, settings - I would post a picture but seems to be getting 500 error on trying to post pictures.
-
Notice a couple of things here - why do you have bogon blocked on your lan? And what is the point of the wan rule?? You do understand that your server can talk back via states that client would create when talking to that outside IP.
I saw there are some blocked traffic from WAN interface: from REMOTE_IP to WAN_IP but I can't capture it here, that's why I added that rule. But perhaps it's pointless as you're saying.
As already stated out of state is common to see. If you don't want to log anything?? Then you can turn off logging of the default block rule under status, system logs, settings - I would post a picture but seems to be getting 500 error on trying to post pictures.
No, I really want to log everything to see if there's any wrong. I'm curious why there were so many blocked entries in FW log and my users (MS outlook) were having trouble with synching.
Thanks everybody for commenting, I found out I also have to allow both HTTP and HTTPS to REMOTE_IP from LAN. I haven't had any issues since.
-
Most likely blocked from wan because it is OUT Of state - even with that rule you put out of state traffic would still be blocked. That rule allows a connection to be made from that server to you.. Not a reply from that server.
Why do you have bogon enabled on your lan?? Completely pointless rule if your lan rules are all lan net as the source.
