What does it mean if QuFirewall shows blocking packets from 127.0.0.1 (localhost)?
Applicable Products:
- QuFirewall
Note: This article doesn't explain how to know which IP address tries to access the NAS.
- If you wan to know the IP addresses currently blocked by QuFirewall. The blocked IP address can be found under QuFirewall > Firewall Profile > Basic Protection > IP access Protection and click [...]
- If you want to record the incoming packet for further analyzing, you may use PacketCapture function in QuFirewall.Please visit the Frequently Asked Questions about QuFirewall for details.
You may be receiving notification warning messages like this:
“System 127.0.0.1 QuFirewall Firewall Events [QuFirewall] In time of 2021-07-06 16:44:00 ~ 2021-07-06 16:49:00, the denied amount reach the set threshold: 50.”
Or in QuLog center like this
The source IP is 127.0.0.1, but this does not mean that QuFirewall is blocking packets from the system (127.0.0.1). In this case the source IP does not correspond to the IP that has blocked the packet, the Source IP 127.0.0.1 corresponds to the Notification Center origin IP, which is the NAS. That means the system is generating the message, so it is correct to see displayed IP 127.0.0.1.
The same happened with other system messages.
The source IP will always be 127.0.0.1 if the message is from the NAS. This is the System IP where the notification is generated.
The "Capture Events" feature will capture all the denied packets during a specified duration of time. During your video watching test, all packets were allowed, thus there is nothing recorded in the pcap file.
