Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 2456 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Multiple UDP Port 31500 blocks from all hosts on internal network

sdengscherz
Hey all,


we setup our new Sophos UTM 220 as production Firewall here today. Everything is working fine. Except some strange blocked UDP connection attempts from plenty of hosts in my internal networkt to the external interface address: 

2012:10:16-15:37:08 gw-rat01-1 ulogd[4663]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:3:79:3:63:4a" dstmac="0:1a:8c:32:2:20" srcip="10.50.14.38" dstip="10.50.18.16" proto="17" length="45" tos="0x00" prec="0x00" ttl="62" srcport="33503" dstport="31500" 

2012:10:16-15:37:08 gw-rat01-1 ulogd[4663]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="0:3:79:3:63:4a" dstmac="0:1a:8c:32:2:20" srcip="10.50.14.38" dstip="10.50.18.16" proto="17" length="56" tos="0x00" prec="0x00" ttl="62" srcport="33503" dstport="31500"


15:41:51 Default DROP UDP
10.50.14.39 : 33502
→
10.50.18.16 : 31500
len=45 ttl=62 tos=0x00 srcmac=0:3:79:3:63:4a dstmac=0:1a:8c:32:2:20
15:41:51 Default DROP UDP
10.50.91.4 : 33500
→
10.50.18.16 : 31500
len=45 ttl=64 tos=0x00 srcmac=0:17:c5:74:cb:8 dstmac=0:1a:8c:32:2:20
15:41:51 Default DROP UDP
10.50.91.4 : 33500
→
10.50.18.16 : 31500
len=56 ttl=64 tos=0x00 srcmac=0:17:c5:74:cb:8 dstmac=0:1a:8c:32:2:20
15:41:51 Default DROP UDP
10.50.14.38 : 33503
→
10.50.18.16 : 31500
len=45 ttl=62 tos=0x00 srcmac=0:3:79:3:63:4a dstmac=0:1a:8c:32:2:20
15:41:52 Default DROP UDP
10.50.91.5 : 33501
→
10.50.18.16 : 31500
len=56 ttl=64 tos=0x00 srcmac=0:17:c5:74:cb:8 dstmac=0:1a:8c:32:2:20
15:41:52 Default DROP UDP
10.50.91.5 : 33501
→
10.50.18.16 : 31500
len=45 ttl=64 tos=0x00 srcmac=0:17:c5:74:cb:8 dstmac=0:1a:8c:32:2:20
15:41:52 Default DROP UDP
10.50.91.4 : 33500
→
10.50.18.16 : 31500
len=45 ttl=64 tos=0x00 srcmac=0:17:c5:74:cb:8 dstmac=0:1a:8c:32:2:20


What's up with these connection attempts?


This thread was automatically locked due to age.
Parents
  • 0
    Can you identify the reason for the traffic?  SpeedGuide.net says that it's "Kingpin: Life of Crime, developer: Xatrix Entertainment/Gray Matter Interactive".

    If these are folks trying to access a DNAT on the External interface, you will want to apply one of the two techiques in: Accessing Internal or DMZ Webserver from Internal Network.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    Can you identify the reason for the traffic?  SpeedGuide.net says that it's "Kingpin: Life of Crime, developer: Xatrix Entertainment/Gray Matter Interactive".

    If these are folks trying to access a DNAT on the External interface, you will want to apply one of the two techiques in: Accessing Internal or DMZ Webserver from Internal Network.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Cookie Information Banner