Add comment to network optimizations ? (martian logging)

[fiveangle]

I was alerted to massive influx of martian hosts from the default gateway being logged on my proxmox host shortly after playing with ProxMenux for the first time:

Jan 28 02:52:07 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:52:23 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:52:23 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:52:24 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:52:24 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:52:26 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:52:26 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:53:07 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1022i0
Jan 28 02:53:07 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1011i0
Jan 28 02:53:07 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1004i0
Jan 28 02:53:07 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1010i0
Jan 28 02:53:07 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1009i0
Jan 28 02:53:07 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:54:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1022i0
Jan 28 02:54:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1011i0
Jan 28 02:54:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1004i0
Jan 28 02:54:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1010i0
Jan 28 02:54:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1009i0
Jan 28 02:54:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:55:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1022i0
Jan 28 02:55:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1011i0
Jan 28 02:55:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1004i0
Jan 28 02:55:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1010i0
Jan 28 02:55:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1009i0
Jan 28 02:55:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:56:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1022i0
Jan 28 02:56:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1011i0
Jan 28 02:56:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1004i0
Jan 28 02:56:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1010i0
Jan 28 02:56:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1009i0
Jan 28 02:56:08 richie kernel: IPv4: martian source 192.168.50.255 from 192.168.50.1, on dev fwbr1003i0
Jan 28 02:56:51 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.9, on dev fwbr1009i0
Jan 28 02:56:51 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.9, on dev fwbr1022i0
Jan 28 02:56:51 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.9, on dev fwbr1011i0
Jan 28 02:56:51 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.9, on dev fwbr1004i0
Jan 28 02:56:51 richie kernel: IPv4: martian source 255.255.255.255 from 192.168.50.9, on dev fwbr1010i0

For any user that has a few very common configurations, this is going to spew an incessant stream of logs to journald in perpetuity. Less-aware homelabbers will likely be pulling their hair out thinking there is some misconfigured host on their network.

The most common issue is having any port-forwarded VM/LXC hosts configured with their FQDN terminating to the public IP of the router connected to their ISP. As local LAN clients must access these services via the same public FQDN if they use SSL (like via letsencrypt on your reverse proxy server) the router will happily accept the broadcast traffic from the VM/LXC and rebroadcast it from itself as if the router is the NATed VM/LXC (via hairpin NAT).

While very useful in security conscious enterprise environments, due to Proxmox being so prolific in the homelab scene, I think it might be good to warn users before blindly applying these settings to their PVE environment:

net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

Thoughts ?

[insert "change my mind" meme here :]

-=dave

[MacRimi]

Hi Dave,
Thanks a lot for the detailed explanation and for taking the time to describe the scenario so clearly — this is very valuable feedback.
This is a good point, and it makes sense to improve how this is handled. I’ll review this part so users are properly informed before these settings are applied, and consider making it more visible or optional to avoid unexpected log flooding.