Network Protection Firewall Violations - Where am I going wrong and how to fix

RE: Network Protection Firewall Violations - Where am I going wrong and how to fix

Budgie2 — Sat, 04 Dec 2021 17:58:56 GMT

Many thanks to both Dirk and Amodin for putting my mind at rest.

I do had one minor problem with the second WAN connection as the configuration options which Dirk linked me to are not quite as I find on the UTM.

Rather than set the second WAN connection as a fallback if my main connection fails I have set the percentage 90% to 10% between primary and secondary connection and will see how I get on. May need to tweak a bit.

Meanwhile my thanks to all,

Budge.

RE: Network Protection Firewall Violations - Where am I going wrong and how to fix

Amodin — Sat, 04 Dec 2021 17:19:41 GMT

This is normal and showing you the UTM is doing its job.

RE: Network Protection Firewall Violations - Where am I going wrong and how to fix

dirkkotte — Sat, 04 Dec 2021 16:18:26 GMT

Firewall-violations are ok.

Here are all packets counted, you don't allow passing the firewall.

Even if you use an "any - any - any" rule you will see/count dropped packets. These may be broadcasts or packets directed to interface-IP of the firewall.

if your services are available .. without problems ... you can ignore the dropped packets / Firewall-violations (we have multiple hundred per minute at the company)

You can open the firewall-live-log and take a look to the allowed/dropped packets. You may post these logs if there are questions.

PS: IPS-violations = 0 is good too.

RE: Network Protection Firewall Violations - Where am I going wrong and how to fix

Budgie2 — Sat, 04 Dec 2021 10:20:07 GMT

Hi and thanks for the reply.

The screenshot is what is worrying me and I have no idea where the problem lies.

I can copy and past log but I shall need some guidance on which log please

RE: Network Protection Firewall Violations - Where am I going wrong and how to fix

Amodin — Fri, 03 Dec 2021 20:18:26 GMT

I don't really understand what you are asking about/concerned about. Are you seeing IPS violations, dropped destination/source hosts and thinking this is an issue? Is it web traffic being blocked/reported?

Can you copy/paste the log in which you are referring, and/or click and drag a screenshot into the reply window so we can see what you are specifically referring to?