Bug #4383
closedFirewall log contains IGMP for rules that do not have logging on
Added by Phillip Davis over 11 years ago. Updated over 11 years ago.
0%
CB Updated by Chris Buechler over 11 years ago Actions #1
- Status changed from New to Confirmed
- Target version set to 2.2.2
I suspect the root issue here is logging of passed traffic with IP options regardless of whether logging is enabled on the matching rule.
PD Updated by Phillip Davis over 11 years ago Actions #2
Target for 2.2.2 looks good. This does not effect actual firewall functions from a security point of view - packet passing and blocking happen as per the rules. It is just nuisance noise in the firewall log with some rule combinations and traffic.
CB Updated by Chris Buechler over 11 years ago Actions #3
- Target version changed from 2.2.2 to 2.2.3
BC Updated by Bill Crowder over 11 years ago Actions #4
I too have ran into this. Very irritating. :)
AL Updated by Arion Lawrence over 11 years ago Actions #5
Just adding a "me too". I have default rule logging turned off, but still seeing lots of entries in firewall log of "Pass" traffic destined to 224.0.0.22 with Proto IGMP.
HH Updated by Hollander Hollander over 11 years ago Actions #6
Me too, as I also wrote here: https://forum.pfsense.org/index.php?topic=92387.msg511674#msg511674
EL Updated by Ermal Luçi over 11 years ago Actions #7
This needs a patching on pf(4) that forces logging on packets with ip options dropped if not allowed and does not check the rule settings.
Line 6332 on pf.c.
CB Updated by Chris Buechler over 11 years ago Actions #8
- Assignee set to Ermal Luçi
- Priority changed from Normal to High
this makes the firewall logs basically completely useless in some networks. Sounds like it shouldn't be too difficult to fix.
EL Updated by Ermal Luçi over 11 years ago Actions #9
- Status changed from Confirmed to Feedback
Patched.
PD Updated by Phillip Davis over 11 years ago Actions #10
2.2.3-DEVELOPMENT (i386)
built on Wed Jun 10 19:49:59 CDT 2015
FreeBSD 10.1-RELEASE-p11
No more flood of unasked-for IGMP messages in the firewall log. I also tried purposely passing and logging IGMP and that shows up correctly in the Firewall log with the correct associated rule number/description.
Fixed for me.
KB Updated by Kill Bill over 11 years ago Actions #11
Hooray! I finally can see something useful in firewall logs on the previously affected site once again! Sanity restored. :-)
CB Updated by Chris Buechler over 11 years ago Actions #12
- Status changed from Feedback to Resolved
fixed
Also available in: Atom