Firewall INPUT Chain

dondario · Sun Jun 05, 2022 4:58 pm

Since some days (without changing anything in the Router) my Internet-Connections seems to be slow (for the first Packet of a connection).
When examin the behavior i looked at the firewall table i observe a strange behavior:
The last Firewall-Rule in INPUT and FORWARD Chain drops and logs all packets.
The Log Prefix are: "INPUT LAST RULE" and "FORWARD LAST RULE"

When I examine the LOG I see the following entries

15:45:21 firewall,info INPUT LAST RULE input: in:br-lan out:(unknown 0), src-mac b8:27:eb:69:2e:21, proto TCP (SYN), 192.168.66.130:48362->45.93.106.241:80, len 60
...[40 identical entries] ....
15:46:10 firewall,info INPUT LAST RULE input: in:br-lan out:(unknown 0), src-mac b8:27:eb:69:2e:21, proto TCP (SYN), 192.168.66.130:48344->45.93.106.241:80, len 60

My questions

Why was this Packet processed by the INPUT-Chain?
The Destination Adress belongs to the internet and should be FORWARDED.
Why is the out-Interface unknown

Here the routing table:

  
   DAv 0.0.0.0/0         PPPoE                  1
   DAc 185.39.84.13/32   PPPoE                  0
   DAc 192.168.23.0/24   br-iot                 0
   DAc 192.168.42.0/24   br-guest               0
   DAc 192.168.66.0/24   br-lan                 0
   DAc 192.168.88.0/24   wg-road                0

Sun Jun 05, 2022 5:18 pm

Based on the information provided, it's a mystery, which is why you should post the rest of your configuration, scrubbed of sensitive info.

Keep in mind that if you knew what the problem was, you'd have it solved already. Don't leave out any detail you aren't certain is irrelevant, and even then, second-guess yourself.

anav · Sun Jun 05, 2022 5:20 pm

WHY is not a mystery. The router allows traffic flow and routing as you have set them.
So the question is what did you do?
Without seeing the config, hard to say.
/export hide-sensitive file=anynameyouwish

dondario · Mon Jun 06, 2022 2:19 am

SHAME ON ME
The IP Address was my own public IP Address.

But I don't know why my Wallbox (OpenWB) tries to connect to Port 80 of my own Public IP.

I think I have to deal with Hairpin Nat.

Thanks for your Help.

Firewall INPUT Chain

Firewall INPUT Chain

Re: Firewall INPUT Chain

Re: Firewall INPUT Chain

Re: Firewall INPUT Chain

Who is online