Home
Help
Search
Login
Register
OPNsense Forum
»
Archive
»
18.1 Legacy Series
»
FW log - Live View - incorrect logging compared to rule config
« previous
next »
Print
Pages: [
1
]
Author
Topic: FW log - Live View - incorrect logging compared to rule config (Read 4162 times)
scrensen
Newbie
Posts: 24
Karma: 1
FW log - Live View - incorrect logging compared to rule config
«
on:
February 05, 2018, 12:16:33 pm »
Hi all,
Just upgraded (Currently running OPNsense 18.1.1-amd64) and I see something weird in the new log Live View.
Attached 3 files, fw_rules.png, fw_log.png and fw_log2.png
In fw_log.png you will see:
Blocked on interface VLAN99, source 192.168.x.20 to destination 192.168.1y.y port 8880 rule description 'Allow guestnet to guestportal'
In fw_rules you see the second rule says:
Allow from source VLAN99 net to destination 192.168.1y.y port 8880 rule description 'Allow guestnet to guestportal'
So in logging it seems traffic is blocked by a rule that actually allows the traffic.
Am I missing something here ?
And to make it more strange, when I change the logging page to show 5000 lines and look for the lines in fw_log.png, I see again something strange, see fw_log2.png
Any idea?
Logged
h4p4t3
Newbie
Posts: 35
Karma: 0
Re: FW log - Live View - incorrect logging compared to rule config
«
Reply #1 on:
February 06, 2018, 08:13:10 am »
I have a similar effect, but (as I thought until now) that results from another problem. I have a problem with the resolving of host names, behind which there is a load balancer. But the effects I see in the log are similar:
https://forum.opnsense.org/index.php?topic=7168.msg32022#msg32022
But your problem doesn't seem to be a DNS-problem.
Logged
scrensen
Newbie
Posts: 24
Karma: 1
Re: FW log - Live View - incorrect logging compared to rule config
«
Reply #2 on:
February 06, 2018, 08:28:46 am »
It seems similar indeed.
I see it all the time now. For all sorts of rules the Live View messes it up and showing strange results.
Logged
JeGr
Hero Member
Posts: 1945
Karma: 226
old man standing
Re: FW log - Live View - incorrect logging compared to rule config
«
Reply #3 on:
February 06, 2018, 02:56:39 pm »
As those are TCP Hits - how about showing the corresponding TCP Flags? It wouldn't surprise me if the blocks are a strange/bad combination of TCP flags and the passes are simple straight S/SYNs.
Logged
"It doesn't work!" is no valid error description!
- Don't forget to [applaud] those offering time & brainpower to help you!
Better have some *sense as no(n)sense!
If you're interested in german-speaking business support, feel free to reach out via PM.
scrensen
Newbie
Posts: 24
Karma: 1
Re: FW log - Live View - incorrect logging compared to rule config
«
Reply #4 on:
February 07, 2018, 09:28:49 am »
I'm currently logging a lot which makes it a bit hard to find those lines back. I rebooted my opnsense box last night since it was unstable (all since upgrade to 18.1), and it seems OK now.
I will keep an eye on it and report back if I see this happening again
Logged
Print
Pages: [
1
]
« previous
next »
OPNsense Forum
»
Archive
»
18.1 Legacy Series
»
FW log - Live View - incorrect logging compared to rule config