# Security Testing: Issues with Traffic Forwarding and Firewall Rules **URL:** \ **Category:** Network\ **Created:** [11 March 2024 18:59 UTC](https://community.ipfire.org/t/security-testing-issues-with-traffic-forwarding-and-firewall-rules/11291 "2024-03-11T18:59:48Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ulissess](https://community.ipfire.org/user_avatar/community.ipfire.org/ulissess/32/13210_2.png) [@ulissess](https://community.ipfire.org/u/ulissess)\ **Post date:** [11 March 2024 18:59 UTC](https://community.ipfire.org/t/security-testing-issues-with-traffic-forwarding-and-firewall-rules/11291/1 "2024-03-11T18:59:48Z")
Hi, I am currently conducting some security testing within my network and have encountered a challenge… Here is a brief overview of my setup and the problem: Attacker Machine: MacOS with IP address 192.168.0.82 Target Machine: IP address 192.168.0.254 On the attacker machine, I have configured port forwarding and created a redirect rule intended for use with the tool sslsplit. The configurations are as follows: sysctl net.inet.ip.forwarding=1 pf.conf: rdr pass on en0 inet proto tcp from any to any port 443 → 127.0.0.1 port 8443 rdr pass on en0 inet proto tcp from any to any port 80 → 127.0.0.1 port 8080 When I disable the pf.conf rules, arp spoofing functions perfectly. However, upon enabling the pf.conf rules, the target machine loses internet connectivity. Although the forwarding to ports 8443 and 8080 appears to be operational, when examining the firewall rules, I encounter messages indicating “DROP\_CTINVALID.” I am concerned that ipfire might be blocking the traffic… Specifically, I’m trying to figure out why, with the firewall rules enabled on my MacOS (pf.conf), the traffic does not seem to forward back to the target machine properly. Could you provide guidance on how to analyze this traffic and determine the underlying issue with the forwarding and firewall configurations? Thank you for your assistance. ---
**Author:** ![pike\_it](https://community.ipfire.org/user_avatar/community.ipfire.org/pike_it/32/16763_2.png) [@pike\_it](https://community.ipfire.org/u/pike_it)\ **Post date:** [12 March 2024 11:45 UTC](https://community.ipfire.org/t/security-testing-issues-with-traffic-forwarding-and-firewall-rules/11291/2 "2024-03-12T11:45:54Z")
How IPFire is involved in this? ---
**Author:** ![ulissess](https://community.ipfire.org/user_avatar/community.ipfire.org/ulissess/32/13210_2.png) [@ulissess](https://community.ipfire.org/u/ulissess)\ **Post date:** [13 March 2024 18:11 UTC](https://community.ipfire.org/t/security-testing-issues-with-traffic-forwarding-and-firewall-rules/11291/3 "2024-03-13T18:11:20Z")
ok i understand i try to figure out ---
**Author:** ![pike\_it](https://community.ipfire.org/user_avatar/community.ipfire.org/pike_it/32/16763_2.png) [@pike\_it](https://community.ipfire.org/u/pike_it)\ **Post date:** [13 March 2024 18:23 UTC](https://community.ipfire.org/t/security-testing-issues-with-traffic-forwarding-and-firewall-rules/11291/4 "2024-03-13T18:23:11Z")
I do not understand, sorry. May I guess that you’re not actually talking about a IpFire installation? ---
**Author:** ![ulissess](https://community.ipfire.org/user_avatar/community.ipfire.org/ulissess/32/13210_2.png) [@ulissess](https://community.ipfire.org/u/ulissess)\ **Post date:** [13 March 2024 18:29 UTC](https://community.ipfire.org/t/security-testing-issues-with-traffic-forwarding-and-firewall-rules/11291/5 "2024-03-13T18:29:22Z")
it’s not about the ipfire installation… i’m just testing the security of my network ---
**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\ **Post date:** [13 March 2024 19:21 UTC](https://community.ipfire.org/t/security-testing-issues-with-traffic-forwarding-and-firewall-rules/11291/6 "2024-03-13T19:21:16Z")
> [@ulissess](#): > > I encounter messages indicating “DROP\_CTINVALID.” You may find this informative. > [@DROP\_CT\_INVALID message since upgrading](https://community.ipfire.org/t/drop-ct-invalid-message-since-upgrading/7831): > > Hi! Since upgrading to core 167 today, I’m seeing many DROP\_CTINVALID messages on firewall log: Raw format: 11:47:15 IN=red0 OUT= MAC=00:0d:b9:47:66:e9:74:42:7f:4a:e0:27:08:00 SRC=81.3.27.54 DST=172.17.0.2 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=853 DPT=47344 WINDOW=0 RES=0x00 RST URGP=0 MARK=0x4000ca66 11:47:12 IN=red0 OUT= MAC=00:0d:b9:47:66:e9:74:42:7f:4a:e0:27:08:00 SRC=81.3.27.54 DST=172.17.0.2 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=853 DPT=4734…