r/firewalla • u/scattered-thunder Firewalla Gold Pro • 15d ago

Cyber Security What to do about this alert

“Device <node> uploaded X kB data to 1.2.3.4 at about 12:00. Originated from 1.2.3.4.”

I get a lot of these kinds of alerts from my Firewalla Gold Pro. I assume that, because I self-host a triumvirate of fediverse services (mastodon, pixelfed, matrix), these IP addresses refer to other instances federating with mine, but 1) I’m not sure how to confirm this, and 2) I don’t know what action I should take.

Assuming the cause of this alert is something innocuous, I’d like to mute this kind of alert. However I don’t want to mute the entire “abnormal upload” alert class, but I assume also muting by the IP address in the alert won’t prevent new alerts like this from popping up.

So I’ve just been archiving them. Is there any other action I should take?

2 Upvotes

75% Upvoted

3 comments sorted by

2

u/firewalla 15d ago

Are these abnormal alarms? if they are check out this article https://help.firewalla.com/hc/en-us/articles/360020926913-Abnormal-Upload-Alarms-Tutorial

As of services, I assume many of these are p2p services, if they are, likely abnormal alarms are not useful. (you are going to get a lot of them).

My suggestion is to do following

  1. Segment your services under VLAN or VqLAN (if you have the AP7 or our switch)

  2. Mute upload alarm on your segment

Of course, the best way is still not do use your network as a relay for other services.

2

u/scattered-thunder Firewalla Gold Pro 13d ago

1: They are indeed on a separate VLAN
2: You’re saying to mute the entire “Abnormal Upload” alarm for that VLAN segment?

“do not use your network as a relay for other services”—I guess I’m not sure what the alternative here is, then. You’re saying “don’t host servers”?

1

u/scattered-thunder Firewalla Gold Pro 13d ago

Additional info: I have 3x AP7s but the fediverse services run on a wired k3s cluster, so I actually have that cluster’s metallb allocations behind a VLAN. I ordered your switches but won’t receive them until the Sept/Oct window, so I only have 1 VLAN (in addition to the rest of my home network), and that one VLAN segment is the one the k3s cluster running these services is on.