# Martian source against Wireguard Client IP

**URL:** <https://community.ipfire.org/t/martian-source-against-wireguard-client-ip/15024>\
**Category:** WireGuard\
**Created:** [13 September 2025 13:30 UTC](https://community.ipfire.org/t/martian-source-against-wireguard-client-ip/15024 "2025-09-13T13:30:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![velifire](https://community.ipfire.org/user_avatar/community.ipfire.org/velifire/32/15693_2.png) [@velifire](https://community.ipfire.org/u/velifire)\
**Post date:** [13 September 2025 13:30 UTC](https://community.ipfire.org/t/martian-source-against-wireguard-client-ip/15024/1 "2025-09-13T13:30:38Z")

</div>

Hi

I am seeing the following martian sources on my firewall logs

```auto
 1 Time(s): IPv4: martian source 104.20.26.55 from 10.0.0.2, on dev green0
 1 Time(s): IPv4: martian source 173.194.183.137 from 10.0.0.2, on dev green0
 1 Time(s): IPv4: martian source 18.172.153.95 from 10.0.0.2, on dev green0
 1 Time(s): IPv4: martian source 216.239.34.223 from 10.0.0.2, on dev green0
 1 Time(s): IPv4: martian source 3.166.49.14 from 10.0.0.2, on dev green0
 1 Time(s): IPv4: martian source 74.125.168.106 from 10.0.0.2, on dev green0
 1 Time(s): IPv4: martian source 74.125.168.134 from 10.0.0.2, on dev green0
 10 Time(s): ll header: 00000000: 00 e0 4c 22 6e 1e 8c 5a f8 eb e8 d5 08 00
 1 Time(s): net_ratelimit: 11 callbacks suppressed

```

This is a wireguard roadwarrior setup, allowing my laptop to access Home LAN servers, but not internet (`AllowIPs: 192.168.1.0/24`)

The firewall has been setup to

1. Allow traffic from `10.0.0.0/24` → `ppp0` as I want other wg clients to be able to connect to internet via IPFire.
2. SourceNAT traffic from `10.0.0.0/24` → `192.168.1.0` in order to make use of DNS and other local services

 ![image](https://community.ipfire.org/uploads/default/original/2X/8/84a539a92fa54c72818ad8133e559066ae9133c6.png)

I have a suspicion that the VPN client was active when I transitioned from work network into my local LAN and tried to connect.

Could this be the reason of the martian source logs ?

* * *

```auto
IPFire version	IPFire 2.29 (x86_64) - core196
Pakfire version	2.29-x86_64
Kernel version	Linux ipfire 6.12.34-ipfire #1 SMP PREEMPT_DYNAMIC Tue Jul 15 14:11:05 GMT 2025 x86_64 GNU/Linux

```
