"
Hi,
I've had a quick look for info on this subject but there are a *lot* of posts that seem related but the ones I've read don't help (me).
I'm getting lots of default blocks for traffic I *think* shouldn't be possible, in particular where both the source and destination are on a different subnet than that of the interface in the log message. In some cases the source and destination are on the same subnet (VLAN) which confuses me more.
Everything seems to be working fine so I'm more curious and interested in reducing "noise" if possible, not looking for a fix as such.
Example screenshots attached.
In this case the TRUSTED interface is VLAN 10 with IP range 192.168.10.0/24, the .20. subnet is for VLAN 20, and I'm using Dnsmasq DNS on both VLANs (forwarded from Unbound).
It looks like a DNS query from one host on the .20. subnet to the Dnsmasq server on 20.1 so I'm curious why it's even seen by the firewall *and* why the log claims it's on the TRUSTED interface (how did that happen?).
My topology is roughly: opnsense on Proxmox on Zimaboard 2 with 2 NICs, one for WAN, one for LAN, 4 VLANs on the LAN (one the default), LAN port connects to a switch, switch connects to 3 access points with an SSID per VLAN, all ports on the switch in trunk mode (no adding or removing of tags).
I've omitted a lot of detail as I don't *think* much of it is relevant but LMK what other info I should provide (and apologies in advance).
Thanks in advance for any info.
I've had a quick look for info on this subject but there are a *lot* of posts that seem related but the ones I've read don't help (me).
I'm getting lots of default blocks for traffic I *think* shouldn't be possible, in particular where both the source and destination are on a different subnet than that of the interface in the log message. In some cases the source and destination are on the same subnet (VLAN) which confuses me more.
Everything seems to be working fine so I'm more curious and interested in reducing "noise" if possible, not looking for a fix as such.
Example screenshots attached.
In this case the TRUSTED interface is VLAN 10 with IP range 192.168.10.0/24, the .20. subnet is for VLAN 20, and I'm using Dnsmasq DNS on both VLANs (forwarded from Unbound).
It looks like a DNS query from one host on the .20. subnet to the Dnsmasq server on 20.1 so I'm curious why it's even seen by the firewall *and* why the log claims it's on the TRUSTED interface (how did that happen?).
My topology is roughly: opnsense on Proxmox on Zimaboard 2 with 2 NICs, one for WAN, one for LAN, 4 VLANs on the LAN (one the default), LAN port connects to a switch, switch connects to 3 access points with an SSID per VLAN, all ports on the switch in trunk mode (no adding or removing of tags).
I've omitted a lot of detail as I don't *think* much of it is relevant but LMK what other info I should provide (and apologies in advance).
Thanks in advance for any info.
