Multicasts port 5353, 224.0.0.251, unblockable!
-
Hello,
I have two networks, 192.168.1.0/24 and 192.168.100.0/24. The router and firewall is ofcourse pfsense between these networks. On my 192.168.1.0/24 I have a machine that multicasts mDNS that for some traverse into the 192.168.100.0/24 network, something I dont want. I have been blocking UDP port 5353 on the WAN interface and Floating interface (!) and still the damn packets come though. I have also blocked 224.0.0.251 IP that is the multicastadress it uses.
Anyone have any idea how I can block this kind of traffic?
-
Dude. You block traffic where it first hits the firewall. If you get a traffic from 192.168.1.0/24, you block it on that interface, NOT on WAN. WTF.
-
Dude. You block traffic where it first hits the firewall. If you get a traffic from 192.168.1.0/24, you block it on that interface, NOT on WAN. WTF.
Well, it hits the WAN interface first. Its a lab env. But I think it should block it if I put the rule on Floating?
-
I'm not going to waste time guessing what are your networks set up like. Post info here. (Firewall logs, firewall rules, network setup).
-
You didn't specify, but we're to assume that 192.168.1.0/24 is your WAN net and 192.168.100.0/24 is your LAN?
-
@KOM:
You didn't specify, but we're to assume that 192.168.1.0/24 is your WAN net and 192.168.100.0/24 is your LAN?
192.168.1.0 is my WAN and 192.168.100.0 is my LAN.
-
Please post a screenshot of your WAN rules.
-
here are the rules…
and a a wireshark sniff on the mDNS traffic.
My network looks like this
labnetwork +---------------------+ imaginary WAN. :) | | | | +--------------+ | pfsense with two | +----------------------+ | | | interfaces. | | | | 192.168.100.0/24 | | | 192.168.1.0/24 | | LAN | | | | WAN | +--------------+ | | +----------------------+ | | | | | | | | +---------------------+
-
Where is your trace coming from, WAN or LAN? I have no idea why it's acting this way. Lots of other users complaining about those packets being blocked when they actually want them.
-
@KOM:
Where is your trace coming from, WAN or LAN? I have no idea why it's acting this way. Lots of other users complaining about those packets being blocked when they actually want them.
I should said they come from a client on the 192.168.100.0/24 network. :) I have tried all kind of ACL, and I dont manage to block the mDNS traffic. Other traffic works as it should. Its just a lab env so I might install a new pfsense fw and see of its somekind of configuration issue.
-
I should said they come from a client on the 192.168.100.0/24 network. :)
OMG. Which part of "you must block where the traffic comes from" is unclear? Put the blocking on LAN, not WAN!!!
-
It's very hard to diagnose and fix a problem when you provide incorrect details. Knowing your WAN from your LAN is kind of important to get right.
-
Yeah. For starters, why don't you just MOVE whatever to a completely different space? Why don't you use 10.x.x.x. or 172.16.x.x on one or the other to make it much more clear?
As a side note: hope you did not install shit like Avahi on your pfSense. That will reflect those mDNS multicasts among different networks by default and by design.
-
I should said they come from a client on the 192.168.100.0/24 network. :)
OMG. Which part of "you must block where the traffic comes from" is unclear? Put the blocking on LAN, not WAN!!!
I have had the blocking on WAN and LAN and Floating. Still is the traffic mDNS traffic comming trough the interfaces.
I have not changed network address space yet. My WAN is on a private address space. :)
No Avahi on pfsense. But it is Avahi from my mediaplayer that seend out these requests.
-
I see the mDNS traffic on both the LAN and WAN interface if I do a packet capture in pfsense. But its not seen in the webinterface, even if I make a rule that should log mDNS traffic.
Blocking 224.0.0.251, and even 224.0.0.0/6, UDP port 5353 and the source adress of the mDNS server!!
-
Is it possible that you have IGMP snooping misconfigured on your switch, or a switch with a defective IGMP snooping implementation? It might be that pfSense has nothing to do with this.
I hope you are running LAN and WAN on separate VLANs or separate switches, otherwise you have a single broadcast domain for both networks.
-
I change to class b network. 172.16.199.0/16 and still getting mDNS packet…
-
"and still the damn packets come though."
Sorry but multicast is not going to pass through pfsense.. And it sure and the F is not going to come from wan to lan.. So clearly you have your wan and lan connected at layer2.. multicast is not going to route through pfsense..
So how exactly do you have pfsense connect to what on its lan and wan?
