Lots of Steam "protocol" Drops in Firewall Live Log after adding DNAT for internal game server.

Hi Tom E,

Thank you for reaching out to the Community! 

The rule id "60001" drop means it could be one of the following reason: 

" The UTM can't forward traffic that is sent to a Masqueraded WAN IP address unless it was requested by a client behind the UTM, or there’s a NAT rule to redirect the traffic to an internal server (with the exception of services running on the UTM itself). If a packet arrives and isn’t for one of the UTM's services, and isn't part of an established connection, and there’s no NAT rule for it, it’ll be dropped as fwrule 60001.

Most of the time, fwrule="60001" means that you need to configure a NAT rule (likely DNAT), or review the configuration of your existing NAT because the packet isn’t matching the intended rule. Check for Interface Binding, that the source and destination port are correct, that you’re matching the correct protocol (TCP, UDP, Both), and that the IP addresses are correct." 

• Reference KBA: Packetfilter logfiles on the Sophos UTM

Try to add both UDP and TCP ports and see if that helps. 

The "Steam" comes from the application control app="703"

<M> h_patel:/etc/afc # cat applications | grep 703
703,Games,Steam

Thanks,

Thank you for the reply.

So is all this rejected traffic just to be expected unless I expand the DNAT to more than just my friend's IP addresses into the server on my network?

I tried adding TCP as well and the drops are still happening on the "Steam" tag. I have a feeling it has something to do with the game server having a server browser feature. Maybe all the hits are coming from the online server element trying to advertise itself to other players.

Or is there a way to drop those Steam entries silently? 

Hi Tom E,

If your friend is the only person who needs access to this game server, you don't have to add more IP addresses than you see in the logs. Yes, some external game services may be trying to make the connection to your game server. 

If you don't want to see the log entries, you could turn off the firewall rule's log traffic. If the log traffic is turned off, you won't see any log entries for that firewall. 

Thanks,

Hi Tom and welcome to the UTM Community!

Is that your friend's IP in the default drop log line?

Cheers - Bob

BAlfson, That IP is just one of many being dropped, not my friend's IP. I can see the friend's IP get successfully identified by my DNAT rule and it gets forwarded as desired when he connects to my game server.

But since adding the DNAT my log looks like this:

Never had all those "Steam" hits before the DNAT was added to pass the friend through to my server.

Thanks for the welcome! Your posts and others have been very helpful as I continue learning.

~Tom

Perhaps I should look into changing the external port used and pick a random high port for my friends to point to and then DNAT that to the 2457 port on the inside.

Check #2 in Rulz (last updated 2021-02-16) - DNATs come first, so you could make a firewall rule that drops or rejects the unwanted traffic without logging it.

Cheers - Bob

Check #2 in Rulz (last updated 2021-02-16) - DNATs come first, so you could make a firewall rule that drops or rejects the unwanted traffic without logging it.

Cheers - Bob