This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Explicitly Allowed Packets Still Being Blocked!

I've been watching my live packet filter logs and notice that there are a lot of incoming packets being blocked which are explicitly allowed via Packet Filter rules.  Do the PF rules show blocked IPS packets as well or something?  The packets in question are logged as being from the Internet to Astaro's externally facing interface address.  There is an ADSL router between Astaro and the Internet.

I also enabled logging of allowed packets but it doesn't seem to be letting anything in!  The rule is:

Source: Internet (also tried 'Any')
Service: App service definition
Destination: Internal App Server IP
No other restrictions

There are also no explicit blocking PF rules configured.

How can I determine what is blocking these packets?  The IPS live logs and stats show no packets blocked (although enabling all attack pattern rules definitely affects traffic flow!).

Does anyone have any ideas what might be going on here?

This thread was automatically locked due to age.

Parents

0 Sambo over 15 years ago

Sure, not much relevant info however AFAICS:

15:54:20	Connection using NAT	UDP	202.151.18.226:51242 	→ (Astaro Ext IP:App Listening Port)			len=131	ttl=109	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

15:54:23	Connection using NAT	UDP	83.37.32.26:48560	→ (Astaro Ext IP:App Listening Port)			len=131	ttl=115	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

15:54:25	Connection using NAT	TCP	94.64.24.216:10519 	→ (Astaro Ext IP:App Listening Port)	[SYN]		len=48	ttl=111	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

15:54:25	Default DROP		TCP	61.6.236.242:55215 	→ (Astaro Ext IP:App Listening Port)	[ACK PSH FIN]	len=108	ttl=45	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

15:54:26	Connection using NAT	UDP	93.33.2.147:54110 	→ (Astaro Ext IP:App Listening Port)			len=131	ttl=102	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

15:54:28	Connection using NAT	UDP	95.83.26.176:29317 	→ (Astaro Ext IP:App Listening Port)			len=131	ttl=115	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

...

15:55:54 	Default DROP 		UDP	115.113.212.16:1700 	→ (Astaro Ext IP:App Listening Port)			len=131 ttl=107 tos=0x00	srcmac=(ADSL Router Int Mac) 	dstmac=(Astaro Ext Mac)

15:55:54 	Connection using NAT 	UDP 	115.113.212.16:1700 	→ (Astaro Ext IP:App Listening Port)			len=131 ttl=108 tos=0x00 	srcmac=(ADSL Router Int Mac) 	dstmac=(Astaro Ext Mac)

[/B][/I]...

15:56:34 	Default DROP 		TCP 	61.6.236.242:55215 	→ (Astaro Ext IP:App Listening Port)	[ACK PSH FIN] 	len=108 ttl=45 	tos=0x00 	srcmac=(ADSL Router Int Mac) 	dstmac=(Astaro Ext Mac)[/code]



The italicized pair of entries is interesting.

Reply

0 Sambo over 15 years ago

Sure, not much relevant info however AFAICS:

15:54:20	Connection using NAT	UDP	202.151.18.226:51242 	→ (Astaro Ext IP:App Listening Port)			len=131	ttl=109	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

15:54:23	Connection using NAT	UDP	83.37.32.26:48560	→ (Astaro Ext IP:App Listening Port)			len=131	ttl=115	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

15:54:25	Connection using NAT	TCP	94.64.24.216:10519 	→ (Astaro Ext IP:App Listening Port)	[SYN]		len=48	ttl=111	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

15:54:25	Default DROP		TCP	61.6.236.242:55215 	→ (Astaro Ext IP:App Listening Port)	[ACK PSH FIN]	len=108	ttl=45	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

15:54:26	Connection using NAT	UDP	93.33.2.147:54110 	→ (Astaro Ext IP:App Listening Port)			len=131	ttl=102	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

15:54:28	Connection using NAT	UDP	95.83.26.176:29317 	→ (Astaro Ext IP:App Listening Port)			len=131	ttl=115	tos=0x00	srcmac=(ADSL Router Int Mac)	dstmac=(Astaro Ext Mac)

...

15:55:54 	Default DROP 		UDP	115.113.212.16:1700 	→ (Astaro Ext IP:App Listening Port)			len=131 ttl=107 tos=0x00	srcmac=(ADSL Router Int Mac) 	dstmac=(Astaro Ext Mac)

15:55:54 	Connection using NAT 	UDP 	115.113.212.16:1700 	→ (Astaro Ext IP:App Listening Port)			len=131 ttl=108 tos=0x00 	srcmac=(ADSL Router Int Mac) 	dstmac=(Astaro Ext Mac)

[/B][/I]...

15:56:34 	Default DROP 		TCP 	61.6.236.242:55215 	→ (Astaro Ext IP:App Listening Port)	[ACK PSH FIN] 	len=108 ttl=45 	tos=0x00 	srcmac=(ADSL Router Int Mac) 	dstmac=(Astaro Ext Mac)[/code]



The italicized pair of entries is interesting.

Children

No Data