Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 14 replies
  • Answers 1 answer
  • Subscribers 3 subscribers
  • Views 14007 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[help]60001 again!

FrankBarmentlo 
2013:03:23-16:05:27 UTM ulogd[4440]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth1" srcmac="4c:ac:a:12:14:4c" dstmac="0:22:15:33:22:fa" srcip="92.238.83.22" dstip="192.168.2.248" proto="17" length="105" tos="0x00" prec="0x00" ttl="115" srcport="15402" dstport="6112" 
2013:03:23-16:05:27 UTM ulogd[4440]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth1" srcmac="4c:ac:a:12:14:4c" dstmac="0:22:15:33:22:fa" srcip="175.136.108.112" dstip="192.168.2.248" proto="17" length="108" tos="0x00" prec="0x00" ttl="107" srcport="6112" dstport="6112" 


how can I fix this? I already made those rules to accept the following traffic: 
those ports:
0:65###(full range) to 6112
6112 to 6112 
6112 to full range
are allowed from any to any. (Can't access the exact rules, needed to bypass as soon as possible.),
but it still get's dropped by rule 60001, what can I do to avoid this?


This thread was automatically locked due to age.
Parents
  • 0
    Dilandau nailed the answer.  It's what I call Rule #4:

    When creating DNATs for traffic arriving from the internet, in "Going to:" always use the
    "(Address)" object created by WebAdmin when the interface or the Additional Address was defined.
    Using a regular Host object will cause the DNAT to fail as the packets won't qualify for the traffic selector.


    192.168.2.248 is my external interface.

    As you can see now, this was the important detail.  It was confusing that the packets were being "default dropped out of the INPUT chain" (60001) when going to a private IP.  You might see if you can bridge your modem and get your public IP onto your External interface so that there's no double-NAT.

    Cheers - Bob
Reply
  • 0
    Dilandau nailed the answer.  It's what I call Rule #4:

    When creating DNATs for traffic arriving from the internet, in "Going to:" always use the
    "(Address)" object created by WebAdmin when the interface or the Additional Address was defined.
    Using a regular Host object will cause the DNAT to fail as the packets won't qualify for the traffic selector.


    192.168.2.248 is my external interface.

    As you can see now, this was the important detail.  It was confusing that the packets were being "default dropped out of the INPUT chain" (60001) when going to a private IP.  You might see if you can bridge your modem and get your public IP onto your External interface so that there's no double-NAT.

    Cheers - Bob
Children
No Data