This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem with odd IPS issue.

Hey all,

Recently I have been receiving numerous errors like this.

Message........: Closed dest port used: local dest, syn: 0.8604
Time...........: 2006:02:20-22:57:15
Packet dropped.: no
IP protocol....: 6 (TCP)

Source IP address: xxx.xxx.xxx.xxx (Evilmuffin)
Source port: 54157
Destination IP address: 212.83.87.22 (b87022.upc-b.chello.nl)/Destination IP address: 70.85.152.130 (130.70-85-152.reverse.theplanet.com)/24-183-176-47.dhcp.oxfr.ma.charter.com/rr-236.pmtpa.wikimedia.org/etc.

Eventually there is a such a congregation that the firewall buffers the message. I don't understand how this is happening and why neither the packet filter nor IPS is stopping it. And I can't find the rule to stop the packets.

Flood protection is enabled and the system is in MASQ mode, packet filter has outbound priveleges but not a rule to block all from External (Network), should this be done?

Thanks!

Aodhan
Destination port: 80 (http)

This thread was automatically locked due to age.

0 BarryG over 19 years ago

Default is block, so you don't need a block all ext rule.

What is Evilmuffin?

It could be a false positive on syn flood protection, but it's hard to tell as you haven't specified which IPs are your and which are foreign.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 InlineFive over 19 years ago in reply to BarryG

Sorry, Evilmuffin is the name of my Astaro firewall. The IP is the WAN address on my internet connection.

If the packet was dropped why does the data say that it was not?

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel