Hi
I am seeing the following martian sources on my firewall logs
1 Time(s): IPv4: martian source 104.20.26.55 from 10.0.0.2, on dev green0
1 Time(s): IPv4: martian source 173.194.183.137 from 10.0.0.2, on dev green0
1 Time(s): IPv4: martian source 18.172.153.95 from 10.0.0.2, on dev green0
1 Time(s): IPv4: martian source 216.239.34.223 from 10.0.0.2, on dev green0
1 Time(s): IPv4: martian source 3.166.49.14 from 10.0.0.2, on dev green0
1 Time(s): IPv4: martian source 74.125.168.106 from 10.0.0.2, on dev green0
1 Time(s): IPv4: martian source 74.125.168.134 from 10.0.0.2, on dev green0
10 Time(s): ll header: 00000000: 00 e0 4c 22 6e 1e 8c 5a f8 eb e8 d5 08 00
1 Time(s): net_ratelimit: 11 callbacks suppressed
This is a wireguard roadwarrior setup, allowing my laptop to access Home LAN servers, but not internet (AllowIPs: 192.168.1.0/24)
The firewall has been setup to
- Allow traffic from
10.0.0.0/24→ppp0as I want other wg clients to be able to connect to internet via IPFire. - SourceNAT traffic from
10.0.0.0/24→192.168.1.0in order to make use of DNS and other local services
I have a suspicion that the VPN client was active when I transitioned from work network into my local LAN and tried to connect.
Could this be the reason of the martian source logs ?
IPFire version IPFire 2.29 (x86_64) - core196
Pakfire version 2.29-x86_64
Kernel version Linux ipfire 6.12.34-ipfire #1 SMP PREEMPT_DYNAMIC Tue Jul 15 14:11:05 GMT 2025 x86_64 GNU/Linux