Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 2 replies
  • Answers 1 answer
  • Subscribers 3 subscribers
  • Views 5159 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM Default drop rule on DNS and DHCP traffic

Steve Kuzma

I've been doing some network refreshing over the past week. Today I spun up a new DHCP server pointing to new DNS servers. 

The setup is pretty straightforward - we have two VLANs phones and data. The new DHCP and DNS Servers worked fine on the Data network but I had issues getting addresses on the Phone VLAN. I made a rule for DHCP in the firewall from the Phone network to my Data network and that cleared up my issue with DNS. 

I then began to wrestle an issue where I was getting default drops from between my phone VLAN and Data VLAN - I am able to pickup an address from the DHCP server just fine now.

18:30:54 Default DROP UDP 192.168.xx.xx:53→192.168.xx.xx:43448 len=164 ttl=127 tos=0x00 srcmac=00:50:56:83:b3:bd dstmac=00:1a:8c:f0:ae:e0

18:32:44 Default DROP UDP 192.168.xx.xx:67→192.168.xx.xx:68 len=164 ttl=127 tos=0x00 srcmac=00:50:56:83:b3:bd dstmac=00:1a:8c:f0:ae:e0

After wrestling it for awhile, I then descided to try to put the old DNS servers in line - I did tha and rebooted my phone and it linked up and connected with no issues. 

So there is a rouge DNS setting I am missing somewhere that is causing the default drops - these are two brand new DNS server. I have verified the phone VLAN and Data network are in "Network Services > DNS > Allowed Networks" and I have also updated the firewall rules to allow traffic from the DNS servers over DNS ports to all IPv4 addresses.

Is there something else missing? 



This thread was automatically locked due to age.
  • 0

    Hi Steve, and welcome to the UTM Community!

    Alone among the logs, the Firewall Live Log presents abbreviated information in a format easier to read quickly.  Usually, you can't troubleshoot without looking at the corresponding line from the full Firewall log file.  Please post a line corresponding to each line above.

    Maybe a simple diagram would help understand your topology.  When obfuscating IPs, please leave enough information so that we can tell if the IPs are in the same network and whether they're public or private.

    You might want to review DNS best practice.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Thanks, I went through that already and it was no help. 

    I guess a weekend away from the problem represented a little clarity. We have no reason to segregate traffic from the two networks, it is just for addressing at this point. I made a rule from VLAN network to the Data network to allow traffic over all ports. 

Unfiltered HTML