NTP via IPv6 on lo0 Clogging Firewall Logs?

asayler

I've been suing the 2.2 snapshots for a few months now. I recently upgraded to the RC (Sat Dec 13 13:26:22 amd64 build). I'm not sure if this issue only started happening after the upgrade or has persisted for a while, but I thought I'd mention it in case anyone has a fix or further thoughts.

I don't use any IPv6 on my network yet, so I have it disabled in pfSense via the System > Advanced > Networking > Allow IPv6 option. I also have NTP enabled and set to listen on all of my internal interfaces (e.g. DMZ, LAN, etc).

Recently, in my firewall logs, I started noticing that the system is both sending and blocking IPv6 NTP traffic on the lo interface, about once every second:


Dec 14 17:51:38 - Direction=OUT - lo0 - Block all IPv6 (1000000002) - [::1]:53650 - [::1]:123 - UDP
Dec 14 17:50:37 - Direction=OUT - lo0 - Block all IPv6 (1000000002) - [::1]:32320 - [::1]:123 - UDP
Dec 14 17:49:35 - Direction=OUT - lo0 - Block all IPv6 (1000000002) - [::1]:2603  - [::1]:123 - UDP
...

Furthermore, when I click the Easy Add Rule button to allow this traffic, I am greeted with an error page that reads:


https://myfirewall/easyrule.php?action=pass&int=lo0&proto=udp&src=[::1]&dst=[::1]&dstport=123&ipproto=inet6

Firewall: EasyRule help

This is the Easy Rule status page, mainly used to display errors when adding rules. If you are seeing this, there apparently was not an error, and you navigated to the page directly without telling it what to do.

This page is meant to be called from the block/pass buttons on the Firewall Logs page, Status > System Logs, Firewall Tab.

While this doesn't really break anything, it does clog up the logs, and may point to other issues. Thus:

Is there a way to disable IPv6 NTP traffic to avoid these messages all together?
Why is lo traffic showing up in the Firewall logs at all? It's not like there is a lo firewall rule list that controls this traffic, and I see no other lo traffic in the firewall logs.
I assume it's an artifact of (2), but the Easy Add Rule button seems broken in this case.

I'm happy to file one or more Redmine bugs if peopel think there are underlying issues going on here. But maybe that "just the way it works"?

jimp

Sounds related to this:

https://redmine.pfsense.org/issues/4074

Check the option mentioned there.

asayler

Yep. That seems like the issue. Thanks for the pointer! I'll monitor that bug.