News: This forum is now permanently frozen.
Pages: [1]
Topic: Firewall Logs Showing Blocked Packets That Should Be Allowed  (Read 2698 times)
« on: December 13, 2012, 23:07:50 »
ThePacketSlinger *
Posts: 3

I've recently inherited my first monowall device (net45xx) and seem to be having some strange issues with it. Basically, I've got an IPSEC tunnel between my data center and new branch office using a cisco Pix on each side. This vpn tunnel has it's own T1 connection, separate from the monowall, but sharing the same internal network. The monowall is the default gateway for clients. In an attempt to simplify the integration, I added a static route on the monowall. This route points traffic destined for the datacenter to the Pix (same subnet).

For the most part, this configuration works. If I initiate a connection from the branch office side, I can talk to devices in the datacenter without issues. However, when I attempt to initiate a connection from the datacenter to the branch office I get no response... Until a connection (of any kind) is initiated on the branch office side of things. Once that machine hits something in the datacenter, I'm able to ping, RDP, VNC, etc without issues.

My LAN firewall is set to any any, so no packets should be dropped by the firewall. I am still seeing packets being dropped in the firewall log, though. Initially, I thought it may be related to this article:
http://m0n0.ch/wall/list/showmsg.php?id=197/40

However, the firewall logs coincide too closely with the issues that I'm seeing for me to be sure. Is there any way to turn off the showing of dropped packets that aren't really being "blocked" by a rule? I'm having difficulty troubleshooting this because my visibility is being flooded by blocked packets that probably aren't really being blocked....


Halp!?
 
Pages: [1]
 
 
Powered by SMF 1.1.20 | SMF © 2013, Simple Machines