Firewall – WatchGuard blocking internal UDP packets

firewallwatchguard

I'm seeing lots of packets that our WatchGuard firewall is dropping.

They're all hitting either 255.255.255.255. or 224.0.0.1 using UDP 8612 / 1947 / 17500.

Since I've started seeing these messages our internet seems a lot slower. How can I allow these through?

Best Answer

This is broadcast and multicast traffic. It sounds like your internal network is becoming more noisy then it once was. I know UDP 17500 is the Dropbox discovery protocol.

Check your network and you may need to implement multicast and broadcast limitations on your switches.

Related Solutions

Firewall – Ping responses don’t make it back to mailserver behind watchguard firewall

Did you check the NAT configuration on the firewall to account for the new ip addresses? It sounds like a NAT or an ARP issue to me. Look at the NAT rules and the ARP table on the firewall and see if there's an entry that corresponds to the MAC address of the NIC in the server with the .4 ip address.

Linux – Iptables rules for Caching Nameserver

IMHO, you should specifically permit egress DNS queries on your OUTPUT chain (on both UDP and TCP, of course), and then drop the port- and protocol- specific flags from the RELATED ingress rule, e.g.:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Or, in other words, use egress policy to control outbound traffic on a per-protocol basis, and stateful matching to control the inbound responses.

The default RHEL/CentOS iptables rules work like this, albeit they default to permit any OUTPUT packet.

And yes, you will quite often see rejected packets because they were too late to match the stateful matching.

Best Answer

Related Solutions

Firewall – Ping responses don’t make it back to mailserver behind watchguard firewall

Linux – Iptables rules for Caching Nameserver

Related Topic