topic Re: Strange Firewall logic for DHCP discover packets in General Topics

Strange Firewall logic for DHCP discover packets

Serhii_Yaholnyt — Fri, 26 Oct 2018 07:22:14 GMT

Using R77.30 firewall we were trying to allow DHCP discover packets to our gateway which had been configured as DHCP server. We have found DHCP discover packets drop on our firewall. These packets had source IP 0.0.0.0 and destination 255.255.255.255. So, we made a permissive rule with respective source and destination and service bootp. Firewall still drops the packets. TAC recommended us to change source to any, we did it and firewall accepted those packets. On the next step I have created IP address range object with first IP 0.0.0.1 and last IP 255.255.255.255, added it to source instead of any and negated source cell. As a result - firewall accepts our DHCP discover packets. When I change first IP in range to 0.0.0.0, firewall drops DHCP discover packets. Can somebody explain, why we can not use as source host 0.0.0.0 to accept this traffic but when we exclude every IP address except 0.0.0.0 from source, it works properly?

Re: Strange Firewall logic for DHCP discover packets

ED — Fri, 26 Oct 2018 09:21:25 GMT

The IP address 0.0.0.0 has several special meanings on computer networks. However, it can not be used as a general-purpose device address. Probably therefore CP don't understand the range.

Re: Strange Firewall logic for DHCP discover packets

HeikoAnkenbrand — Fri, 26 Oct 2018 21:03:59 GMT

I programmed tcpdump drivers years ago.

The problem is that 0.0.0.0 is used as any address in many IP stacks. The 0.0.0.0 IP address is sometimes called a wildcard address, unspecified address or INADDR_ANY.

Example:

...

# define INADDR_ANY ((unsigned long int) 0x00000000)
...

Therefore the address is not used as a real IP address. Furthermore, in some old IP stacks there are mathematical problems with 0.0.0.0, so it would never be allowed as real IP.

I think Check Point firewalls also intercepts the address 0.0.0.0. I would even prevent the SmartConsole software from entering the 0.0.0.0 address. But I haven't tried the input yet to see if it works.

At R77.30 you can enter the IP 0.0.0.0. What side effects this will have:-)

Regards

Heiko

Re: Strange Firewall logic for DHCP discover packets

AlekseiShelepov — Sat, 27 Oct 2018 13:39:29 GMT

Check Point will also drop your traffic if it has source or destination port defined as 0. It is done for similar reasons and for security.

SmartView Tracker drop logs show "Invalid TCP packet - source / destination port 0"...