Messages

Is it possible you have promiscuous mode enabled on the interfaces?

Regards,
S.

Hey Seimus, thanks for the reply. Interfaces are not promiscuous:

Code Select Expand

igc1: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
options=4802028<VLAN_MTU,JUMBO_MTU,WOL_MAGIC,HWSTATS,MEXTPG>
ether f4:90:ea:01:6f:2e
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

vlan0.634: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
description: INTERNET (wan)
options=4000000<MEXTPG>
ether f4:90:ea:01:6f:2e
inet x.x.x.x netmask 0xffffffc0 broadcast x.x.x.x
groups: vlan
vlan: 634 vlanproto: 802.1q vlanpcp: 0 parent interface: igc1
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>


While the source MAC is the same on the WAN and LAN interface, is there a chance that there are 2 VMware instances using the same MAC? One on the WAN, one on the LAN side?

Hey mooh,

nice one. But on the LAN side there is a Proxmox environment, so I am afraid that's not the case.

Hi,

any other input?

Nope, it's a OPNsense physical box (DEC2752). It has a single physical connection to an upstream switch, and one physical connection to a downstream L3 switch.
The Vmware MAC OUI you see it's because there are probably some VMs on the upstream switch.
I was wondering if NAT might have be interfering with this somehow. I have a NAT outbound rule with source 192.168.0.0/16 (the subnets part of the test environment). The traffic incoming on igc1 with tag 643 is also within that range. The legit network for the WAN with the correct tagging belongs to the 172.16.0.0/12.

I also tried to make additional VLANs interfaces with tag 643. Still the traffic goes through. When I enable promiscuous mode on that interface and enable "block private networks", then I see the traffic blocked in the logs (default block rule)... but i still see the traffic on the downstream switch.

Totally

This should definitely not be the case and I cannot see a way for this to happen at all if there is no assignment and hence no layer 3 configuration on the physical port.

Are you perchance running OPNsense in transparent filtering bridge mode?

Totally agree, and I am also very puzzled. There is no bridging and OPNsense is running in normal, routed mode.

This is what I see inbound igc1 (agree, it's normal to see this traffic):


This is what I see inbound the downstream switch connected to the OPNsense LAN interface:


How is that tagged traffic ending up on the LAN segment?

Hi Patrick and thanks for the quick reply. The physical interface is not assigned.

[igc1]

Hi,

I have noticed quite a concerning problem with traffic filtering affecting my setup.
I have an Opnsense DEC2752 box running Opnsense Community 25.1.7_2.

This box is connected to the WAN using a physical copper connection. In order to reach the internet, the traffic needs to be tagged with a specific dot1q tag and therefore I have configured a sub-interface. Therefore I have a parent interface igc1 with a single sub-interface vlan0.100.
Now, the connection between igc1 and the upstream switch appears to be a trunk with different VLANs allowed. With wireshark, I can see a lot of broadcast and multicast traffic with different VLAN tags reaching igc1. This traffic is for some reason not filtered and it is being forwarded to the LAN segment.

This is a corporate environment, and the firewall is used to isolate a test environment from the main corporate network. I have no control over the rest of the corporate network so changing the allowed VLANs on the trunk is not an option. Besides, I still would like to understand this particular behavior.