UDP port 4500 sometime get blocked when allowed over bridge

PeterUK
PeterUK Posts: 3,391  Guru Member
100 Answers 2500 Comments Friend Collector Seventh Anniversary
edited February 29 in Security

VPN300

V5.37(ABFC.2)

This dose not happen all the but have confirmed it by packet capture on VPN300 I see UDP 4500 on LAG0 and not out LAG1 over the bridge when it is allowed fix is to reboot the VPN300

Here is a cut down of the network setup

udp 4500 br0.png
Screenshot 2024-02-29 105218.png
Screenshot 2024-02-29 105105.png

«1

All Replies

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,230  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Dear @PeterUK

    We observed VPN disconnection log messages. Regarding the topology, could you please provide details on the VPN300's site-to-site VPN connection with which destination device? Thanks.

    VPN disconnection log.png


    241015_Speak-up,-Win-WiFi-7_Community-CSO-signature_1920x200.jpg

    Share your feedback through our survey, make your voice heard, and win a WiFi 7 AP! https://bit.ly/2024_Survey_Community

  • Nicholas185
    Nicholas185 Posts: 1
    First Comment
    edited March 4

    It seems there is an intermittent issue on the VPN300 with firmware version V5.37(ABFC.2). Confirming through packet capture, UDP 4500 is observed on LAG0 but not on LAG1 over the bridge, and this problem is resolved by rebooting the VPN300. If this issue persists, it may require further investigation or contacting the device's support for potential firmware updates or resolutions. Sports accessories and equipment

  • PeterUK
    PeterUK Posts: 3,391  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited March 1

    Yes that is correct @Nicholas185

    So the connection goes like this for site to site:

    VPN300 Ge4 DHCP to > Nighthawk M2 Mobile Router EE ISP in IP passthrough > in on my virgin media throughout VPN300 bridge setup > to FLEX200 DHCP WAN on SFP

    the VPN300 as a bridge allows all traffic its reason is to BWM for all USG downstream from it

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,230  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Hi @PeterUK

    OK, thank you for your update. Let's check it.


    241015_Speak-up,-Win-WiFi-7_Community-CSO-signature_1920x200.jpg

    Share your feedback through our survey, make your voice heard, and win a WiFi 7 AP! https://bit.ly/2024_Survey_Community

  • PeterUK
    PeterUK Posts: 3,391  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited March 14

    10 days uptime it happened again

    Would the team like to check the LAG0 in LAG1 out as to why port 4500 is not being forwarded as I will leave it in this state should it not fix its self for checking thanks.

    Small update test I did but the problem is ongoing I did a UDP scan for 4500 https://www.ipvoid.com/udp-port-scan/

    and that goes through so its very odd why the true VPN connection for 4500 is being blocked

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,230  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Hello Peter,

    May we know if there have been any ADP blocked messages, such as UDP flooding or others?


    241015_Speak-up,-Win-WiFi-7_Community-CSO-signature_1920x200.jpg

    Share your feedback through our survey, make your voice heard, and win a WiFi 7 AP! https://bit.ly/2024_Survey_Community

  • john856
    john856 Posts: 1
    First Comment

    Get a font style you like today from Dafont to make your designs better. Da Font has many fonts you can get for free.

  • PeterUK
    PeterUK Posts: 3,391  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited March 16

    https://community.zyxel.com/en/discussion/comment/63253#Comment_63253

    I don't see any ADP blocked messages and I tried disabling ADP but didn't fix the issue

    Currently its in a loop at some point my EE 4G will change IP out CGNAT so that might cause it to start working?

    peer.png
    peerw.png

    capture before getting to LAG0

  • PeterUK
    PeterUK Posts: 3,391  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary

    shows in session view

    Screenshot 2024-03-16 225436.png

  • PeterUK
    PeterUK Posts: 3,391  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary

    and my 4G IP changed to 31.94.60.122 with the VPN up and running fine.

    some type of problem that the LAG bridge stops forwarding port 4500

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）