5
My firewall logs are being flooded with logs of packets being blocked that i don't want to be blocked:
Every 3 seconds there are 2 packets being broadcast from my machine:
- Interface:
LAN - Source IP:
fe80::742c:6fb9:aac3:8dc8(my desktop pc) - Source Port:
56904(randomly assigned outgoing port) - Destination IP:
ff02::c(IPv6 link local multicast address) - Destination Port: 1900 (Simple Service Discovery Protocol)
- Protocol:
UDP
These are IPv6 packets on the LAN interface that are being blocked. Except i allow all traffic on the LAN interface:
And just for good measure i allow all IPv4 traffic on my LAN interface:
Why are SSDP multicast packets on my LAN being blocked, and how do i stop blocking them?
Note: The reason i am seeing them in the log is because i've asked m0n0wall to log packets blocked by the default rule:
i did this to confirm that no packets should be blocked, because no packets should be blocked
Looking at the logs in "raw" mode:
07:31:47.282546 rl0 @0:16 b fe80::742c:6fb9:aac3:8dc8,56904 -> ff02::c,1900 PR udp len 40 194 IN low-ttl multicast
Reveals nothing interesting:
- Time:
07:31:47.28546 - Interface:
rl0(LAN) - Group/Rule:
@0:16 - Action:
b(Block) - From address:
fe80::742c:6fb9:aac3:8dc8(my desktop pc) - From port:
56904 - To address:
ff02::c(IPv6 link local multicast address) - To port:
1900(SSDP) - Protocol:
PR udp(UDP) - Packet length:
len 40(40 bytes) - Other:
194 IN low-ttl multicast
With m0n0wall's status.php page showing for ipfstat -nio:
ipfstat -nio
...
@16 block in log quick on rl0 all head 100
...
# Group 100
@1 pass in quick from 192.168.0.0/16 to 192.168.1.1/32 keep state group 100
@2 pass in quick from any to any keep state group 100
...
See also
Ian Boyd
Posted 2011-08-03T11:32:39.837
Reputation: 18 244
