This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall Logging

All-

I am seeing in the firewall log since the upgrade to version 9.101-12 an enormous number of dropped entries for firewall rule 6003, tcpflags="ACK PSH FIN". They appear from an number of sources. One of the source sites is this one. I created a firewall rule any>WebGroup>drop and placed it right after websurfing. WebGroup contains http>source 1:65535> destination 80, and the same for https substuing port 80 with port 443. The log traffic box is unchecked. Can the fwrule 6003 be edited to turn off logging? My hair is now in a pile on the floor....Thanks, Jim

2013:06:08-09:52:47 Oasis ulogd[4425]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth1" srcmac="0:1b:21:59:59:3d" srcip="209.123.109.176" dstip="192.168.1.2" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="1632" tcpflags="ACK PSH FIN"
2013:06:08-09:52:48 Oasis ulogd[4425]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth1" srcmac="0:1b:21:59:59:3d" srcip="209.123.109.177" dstip="192.168.1.2" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="1638" tcpflags="ACK PSH FIN"
2013:06:08-09:52:48 Oasis ulogd[4425]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth1" srcmac="0:1b:21:59:59:3d" srcip="209.123.109.177" dstip="192.168.1.2" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="1639" tcpflags="ACK PSH FIN"
2013:06:08-09:53:06 Oasis ulogd[4425]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth1" srcmac="0:1b:21:59:59:3d" srcip="85.115.22.9" dstip="192.168.1.2" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="1671" tcpflags="ACK PSH FIN"
2013:06:08-09:53:59 Oasis ulogd[4425]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth1" srcmac="0:1b:21:59:59:3d" srcip="85.115.22.9" dstip="192.168.1.2" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="1671" tcpflags="ACK PSH FIN"

This thread was automatically locked due to age.

Parents

0 BAlfson over 12 years ago

Freddie, try https://community.sophos.com/products/unified-threat-management/astaroorg/f/52/t/28958 and https://community.sophos.com/products/unified-threat-management/astaroorg/f/55/t/45913

Frank, please show the Web Filtering log lines for the same accesses.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 scottj_01 over 12 years ago in reply to BAlfson

Bob,

I tried setting the proxy to standard. Strangely enough there were no ACK PSH FIN logs appearing connecting to DSL reports. Then I realized there is a firewall rule running internet ipv4>http responce (80 to 1:65535>internal network 192.168.1.0/24.  Logging unchecked. Back intransparent mode I disabled  the rule. Many of the same entries suddenly appeared however not as verbose. The rule was restarted. I left firefox pointed to http proxy 192.168.1.1 port 8080. DSL Reports was opened the whole time and logging nothing for the last  several minutes. Using the live log for diagnosis I received the following noted entries below. The normal dropped inbound ping/country block/Syn are still logged. So I think this configuration may help in the interum. Please gie it a try. (Maybe I just got lucky.....)

Set the browser http proxy to internal address, port 8080.
Set ASG Web Proxy to trans parent.
Create firewall rule internet ipv4>http responce (80 to 1:65535>internal network 192.168.1.0/24. Leave logging disabled.  A thank you to Bob for his help with this rule.
Clear the firewall logs observe and report back.

Bob I think you correctly called the it, the web proxy may have some issues.

Thanks,
Jim

17:53:34 Default DROP UDP
199.180.116.147 : 5064
→
173.49.152.126 : 5060

len=446 ttl=251 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
17:55:09 Default DROP ICMP
5.255.146.133
→
173.49.152.126

len=52 ttl=251 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
17:58:26 Default DROP TCP
173.76.126.233 : 53317
→
173.49.152.126 : 173

[SYN] len=52 ttl=121 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
17:58:29 Default DROP TCP
173.76.126.233 : 53317
→
173.49.152.126 : 173

[SYN] len=52 ttl=121 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
17:58:48 Country blocked TCP
210.209.69.188 : 6000
→
173.49.152.126 : 1433

[SYN] len=40 ttl=250 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
18:01:07 Default DROP TCP
198.13.97.232 : 6000
→
173.49.152.126 : 1433

[SYN] len=40 ttl=244 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 scottj_01 over 12 years ago in reply to BAlfson

Bob,

I tried setting the proxy to standard. Strangely enough there were no ACK PSH FIN logs appearing connecting to DSL reports. Then I realized there is a firewall rule running internet ipv4>http responce (80 to 1:65535>internal network 192.168.1.0/24.  Logging unchecked. Back intransparent mode I disabled  the rule. Many of the same entries suddenly appeared however not as verbose. The rule was restarted. I left firefox pointed to http proxy 192.168.1.1 port 8080. DSL Reports was opened the whole time and logging nothing for the last  several minutes. Using the live log for diagnosis I received the following noted entries below. The normal dropped inbound ping/country block/Syn are still logged. So I think this configuration may help in the interum. Please gie it a try. (Maybe I just got lucky.....)

Set the browser http proxy to internal address, port 8080.
Set ASG Web Proxy to trans parent.
Create firewall rule internet ipv4>http responce (80 to 1:65535>internal network 192.168.1.0/24. Leave logging disabled.  A thank you to Bob for his help with this rule.
Clear the firewall logs observe and report back.

Bob I think you correctly called the it, the web proxy may have some issues.

Thanks,
Jim

17:53:34 Default DROP UDP
199.180.116.147 : 5064
→
173.49.152.126 : 5060

len=446 ttl=251 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
17:55:09 Default DROP ICMP
5.255.146.133
→
173.49.152.126

len=52 ttl=251 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
17:58:26 Default DROP TCP
173.76.126.233 : 53317
→
173.49.152.126 : 173

[SYN] len=52 ttl=121 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
17:58:29 Default DROP TCP
173.76.126.233 : 53317
→
173.49.152.126 : 173

[SYN] len=52 ttl=121 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
17:58:48 Country blocked TCP
210.209.69.188 : 6000
→
173.49.152.126 : 1433

[SYN] len=40 ttl=250 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
18:01:07 Default DROP TCP
198.13.97.232 : 6000
→
173.49.152.126 : 1433

[SYN] len=40 ttl=244 tos=0x00 srcmac=0:90:1a:a1:41:27 dstmac=0:24:7e:0:c1:82
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data