Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 299 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[IPS] IRC Traffic crash IPv6

TuxBrother
Astaro is running fine for weeks. But suddenly, I noticed that IRC didn't connect anymore. My IPv6 was down. (IPv4 is working however)

After some research, it seems stopping IPS did the trick. It blocks all traffic due to this rule:

snort[7352]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="ATTACK-RESPONSES id check returned root" group="500" srcip="192.87.102.107" dstip="x.x.x.x" proto="17" srcport="5072" dstport="59443" sid="498" class="Potentially Bad Traffic" priority="2" generator="1" msgid="0"


Where x.x.x.x is my WAN IP. So, this happens straight after IRC joins a channel.

I need to restart IPS before the IPv6 internet is up again. Perhaps a faulty IPS rule?

Thanks for the help.
TuxBrother


This thread was automatically locked due to age.