(Another) Issue with torrents post - Rules appear correct but all incoming traffic from outgoing torrent connections being dropped.

Hi, Allister, and welcome to the UTM Community!

Alone among the logs, the Firewall Live Log presents abbreviated information in a format easier to read quickly.  Usually, you can't troubleshoot without looking at the corresponding line from the full Firewall log file.  Please post one line corresponding to those above.

There has been plenty of discussion here about torrents, so you might try a google on:

site:community.sophos.com/products/unified-threat-management/f torrent

Cheers - Bob

Hi Bob

Had already looked at a few threads and guides on setting up and appears all exactly the same as those.

As said issue appears that the returning connections are being dropped. I can see in the Firewall log the outgoing connections followed by incoming traffic being blocked usually on low ports in the Bittorrent range (1024-65535).

Just can't figure why its all behaving this way.

And, about that line I requested above, Alister?

Cheers - Bob

Hi Bob

I have gone as having my ISP change my connection from their AP/Router to PPPOE so their device is bridged removing any possibility of the double natting having caused issues. After this I have also factory reset the Sophos UTM. Still the exact same issue remains of what appears to be the incoming data from outgoing successful connections being blocked and I cannot get torrents to download any faster than 100-200 KB/s when I should be getting at least 10x that. Have tested with Ubuntu torrents and confirm compared to tethered speed.

I have followed every guide or bit of info on this setup I can find without any luck. Is there some setting or something I am missing as this behavior just seems wrong would be like me accessing a website and my firewall blocking the incoming traffic from that allowed outgoing connection...

Here should be the a quick snippet of requested logs. I have just changed the external IP entry to "external-ip".

2017:02:20-23:43:32 home-firewall ulogd[4520]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="ppp0" srcip="86.168.236.236" dstip="external-ip" proto="6" length="52" tos="0x00" prec="0x00" ttl="103" srcport="55993" dstport="62187" tcpflags="SYN"
2017:02:20-23:43:33 home-firewall ulogd[4520]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="ppp0" srcip="1.161.214.56" dstip="external-ip" proto="6" length="48" tos="0x00" prec="0x00" ttl="42" srcport="6168" dstport="1898" tcpflags="SYN"
2017:02:20-23:43:35 home-firewall ulogd[4520]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="ppp0" srcip="86.168.236.236" dstip="external-ip" proto="6" length="52" tos="0x00" prec="0x00" ttl="103" srcport="55993" dstport="62187" tcpflags="SYN"
2017:02:20-23:43:38 home-firewall ulogd[4520]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="ppp0" srcip="63.228.236.232" dstip="external-ip" proto="6" length="40" tos="0x00" prec="0x00" ttl="103" srcport="51851" dstport="8999" tcpflags="ACK RST"
2017:02:20-23:43:38 home-firewall ulogd[4520]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="ppp0" srcip="85.250.160.8" dstip="external-ip" proto="6" length="48" tos="0x00" prec="0x00" ttl="100" srcport="11941" dstport="1800" tcpflags="SYN"

Allister Wade said:

2017:02:20-23:43:38 home-firewall ulogd[4520]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="ppp0" srcip="63.228.236.232" dstip="external-ip" proto="6" length="40" tos="0x00" prec="0x00" ttl="103" srcport="51851" dstport="8999" tcpflags="ACK RST"  

Looks like your firewall is blocking incoming port 8999 and that is why all the other incoming connections are randomized and blocked. Double check your DNAT rule and test that the port 8999 is actually open. You can use something like grc.com https://www.grc.com/x/ne.dll?bh0bkyd2 to check incoming connections. 

Appears the rules are working correctly just blocking some traffic still and torrent speeds still like 10% of what they should be.

Turned on the logging on the NAT rule so it is showing as working now:

Allister, did you check the Intrusion Prevention log (#1 in Rulz)?

Cheers - Bob

Sorry, my mistake. That was a reset packet that was dropped. If Bob's suggestion above doesn't work, you can try an allow ANY ANY firewall rule for your particular torrent client as a last ditch effort.

P.S. I have to admit, I haven't used torrents in a while even for linux downloads because of the stigma associated with them and the automatic assumption by many ISPs in the US that torrent = illegal download. 

Sorry, my mistake. That was a reset packet that was dropped. If Bob's suggestion above doesn't work, you can try an allow ANY ANY firewall rule for your particular torrent client as a last ditch effort.

P.S. I have to admit, I haven't used torrents in a while even for linux downloads because of the stigma associated with them and the automatic assumption by many ISPs in the US that torrent = illegal download.