Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 1011 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Astaro passing illegal traffic

SalishSwede
Watching my live logs I'm seeing traffic that is being passed that is not authorixed by any rule in the packet filters.


Here are my rules:
1  All_Local_Nets      NTP-Async                        0.0.0.0/0  Any
2  Comcast Bootp     ???.???.64.1  Bootp             255.255.255.255 Broadcast32
3  Internal (Net)    10.1.0.0/16      HTTPS            0.0.0.0/0 Any
4  Internal (Net)    10.1.0.0/16      Messengers_All 0.0.0.0/0
5  Basement (Net)  192.168.1.0/24 HTTPS            0.0.0.0/0 Any
6  Basement (Net)  192.168.1.0/24 Messengers_All 0.0.0.0/0 Any
7  Wifi (Net)          10.3.0.0/16      HTTPS            0.0.0.0/0 Any
8  Wifi (Net)          10.3.0.0/16      Messengers_All 0.0.0.0/0 Any

Here is an example:  These packets were allowed through... WHY?
I've cross referenced all of the services above.  port 3478 does not exist anywhere in my definitions.  What's causing this?

19:27:27  192.168.1.253  12968  ->  64.15.206.213  3478  UDP  20  36  127 
19:27:27  192.168.1.253  14668  ->  64.15.206.213  3478  UDP  20  36  127 
19:27:27  192.168.1.253  14668  ->  66.35.251.197  3478  UDP  20  36  127 
19:27:27  192.168.1.253  14668  ->  216.34.130.245  3478  UDP  20  36  127 
19:27:30  192.168.1.253  14668  ->  222.190.4.182  42790  UDP  20  23  127


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to ClausP
    I looked at the IANA references but I guess I missed this.
    I don't have the SIP proxy enabled at present.
    Do you know how to characterize the traffic that is traversing the NAT?
    I have the whole network masqueraded so I'm still puzzled and even more intrigued.

    Thanks