Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 27 replies
  • Subscribers 2 subscribers
  • Views 164606 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Default drop although last rule is "reject any any any"

ChrisH1
Title says it all:
Although I have a rule "reject from any to any using any service" at the bottom, I still see "DEFAULT DROP" entries in the live firewall log. Why is that? 
UTM 9 Essential edition, so no IDS or Threat detection or whatever active.


This thread was automatically locked due to age.
Parents
  • 0
    My day was great, thanks for asking. Can we get back to firewalls?
  • 0 in reply to ChrisH1
    Hi Chris

    Let´s explain it that way.

    Any drops with 60000ies fwrule are internal drops of any of the internal services as IDS/IPS, Proxies, flooding Protection etc. which are based from the implicit (automatic rules) required to run those services. As those are handled before userbased rules or bypasses userbased rules (already mentioned: input chain instead forward) the last reject rule isn´t effective for those drops.

    I also use 2 last rules with reject w.log and drop w/o log to minimize packetfilter logging...however, those internal drops are always logdrops and cannot be modified.

    Also have a look into that one:
    Packetfilter logfiles on the Astaro Security Gateway

    Hope that explanation shed some light on that matter.

    /Sascha
Reply
  • 0 in reply to ChrisH1
    Hi Chris

    Let´s explain it that way.

    Any drops with 60000ies fwrule are internal drops of any of the internal services as IDS/IPS, Proxies, flooding Protection etc. which are based from the implicit (automatic rules) required to run those services. As those are handled before userbased rules or bypasses userbased rules (already mentioned: input chain instead forward) the last reject rule isn´t effective for those drops.

    I also use 2 last rules with reject w.log and drop w/o log to minimize packetfilter logging...however, those internal drops are always logdrops and cannot be modified.

    Also have a look into that one:
    Packetfilter logfiles on the Astaro Security Gateway

    Hope that explanation shed some light on that matter.

    /Sascha
Children
No Data