OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 18.1 Legacy Series »
  • FW log - Live View - incorrect logging compared to rule config
« previous next »
  • Print
Pages: [1]

Author Topic: FW log - Live View - incorrect logging compared to rule config  (Read 2810 times)

scrensen

  • Newbie
  • *
  • Posts: 23
  • Karma: 1
    • View Profile
FW log - Live View - incorrect logging compared to rule config
« on: February 05, 2018, 12:16:33 pm »
Hi all,

Just upgraded (Currently running OPNsense 18.1.1-amd64) and I see something weird in the new log Live View.

Attached 3 files, fw_rules.png, fw_log.png and fw_log2.png

In fw_log.png you will see:
Blocked on interface VLAN99, source 192.168.x.20 to destination 192.168.1y.y port 8880 rule description 'Allow guestnet to guestportal'

In fw_rules you see the second rule says:
Allow from source VLAN99 net to destination 192.168.1y.y port 8880 rule description 'Allow guestnet to guestportal'

So in logging it seems traffic is blocked by a rule that actually allows the traffic.

Am I missing something here ?

And to make it more strange, when I change the logging page to show 5000 lines and look for the lines in fw_log.png, I see again something strange, see fw_log2.png

Any idea?
Logged

h4p4t3

  • Newbie
  • *
  • Posts: 35
  • Karma: 0
    • View Profile
Re: FW log - Live View - incorrect logging compared to rule config
« Reply #1 on: February 06, 2018, 08:13:10 am »
I have a similar effect, but (as I thought until now) that results from another problem. I have a problem with the resolving of host names, behind which there is a load balancer. But the effects I see in the log are similar: https://forum.opnsense.org/index.php?topic=7168.msg32022#msg32022

But your problem doesn't seem to be a DNS-problem.
Logged

scrensen

  • Newbie
  • *
  • Posts: 23
  • Karma: 1
    • View Profile
Re: FW log - Live View - incorrect logging compared to rule config
« Reply #2 on: February 06, 2018, 08:28:46 am »
It seems similar indeed.

I see it all the time now. For all sorts of rules the Live View messes it up and showing strange results.
Logged

JeGr

  • Hero Member
  • *****
  • Posts: 1825
  • Karma: 208
  • old man standing
    • View Profile
Re: FW log - Live View - incorrect logging compared to rule config
« Reply #3 on: February 06, 2018, 02:56:39 pm »
As those are TCP Hits - how about showing the corresponding TCP Flags? It wouldn't surprise me if the blocks are a strange/bad combination of TCP flags and the passes are simple straight S/SYNs.
Logged
"It doesn't work!" is no valid error description! - Don't forget to [applaud] those offering time & brainpower to help you!
Better have some *sense as no(n)sense! ;)

If you're interested in german-speaking business support, feel free to reach out via PM.

scrensen

  • Newbie
  • *
  • Posts: 23
  • Karma: 1
    • View Profile
Re: FW log - Live View - incorrect logging compared to rule config
« Reply #4 on: February 07, 2018, 09:28:49 am »
I'm currently logging a lot which makes it a bit hard to find those lines back. I rebooted my opnsense box last night since it was unstable (all since upgrade to 18.1), and it seems OK now.

I will keep an eye on it and report back if I see this happening again
Logged

  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • Archive »
  • 18.1 Legacy Series »
  • FW log - Live View - incorrect logging compared to rule config
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2