This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall violations

Hello friends,

I think I have an invisible threat on my network and I am wondering if someone could help me.

I have a high bandwidth usage and very high memory usage on one of my servers that I can see on my UTM.
The thing is when I see logging and reporting-->Network protection-->Firewall I can see some IPs from Austria that is using some tcp services with customize ports.Is there any way to disconnect them.
Also I have a high number of violations in Firewall daily.
I used Country Blocking traffic for Austria.Also except well-known services there is no other port open on my UTM Firewall.

Any advice or idea would be highly appreciated.
Thank you.

This thread was automatically locked due to age.

sogolzanganeh over 8 years ago

Problem solved.Thank you.
Cancel
Vote Up 0 Vote Down

Cancel
BAlfson over 8 years ago in reply to sogolzanganeh

And, the solution was ... ???

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
Emile Belcourt over 8 years ago

For others who get similar stuff like this and you want to quickly, with the least amount of resources, block them until you resolve the cause then you can do the following:

Go to Interfaces & Routing > Static Routing

Create a Blackhole route and set the source as a network group containing the host definitions of the IPs your want to send *cue Talking Heads* on the roooadd to nowhere!

But yes, what was your fix, leaving us on a cliffhanger!

Emile
Cancel
Vote Up 0 Vote Down

Cancel
sogolzanganeh over 8 years ago in reply to Emile Belcourt

Thank you for your advice Emile.

I did the following which looks like OK:

I trace the IP address and ask my Internet Provider to block the IP addresses.

Also I Block the country on the UTM Firewall country blocking section.Fortunately the company does not need any traffic flow through that country.

But definitely I will do the solution you've mentioned.Thank you.

Sogol
Cancel
Vote Up 0 Vote Down

Cancel
sogolzanganeh over 8 years ago in reply to BAlfson

I asked my Internet providers to block the IP address also block it by country blocking in firewall section which looks fine.but there are better solutions

like the one Emile offered.

Thank you

Sogol
Cancel
Vote Up 0 Vote Down

Cancel

Jas Man over 8 years ago

It looks like that the IPs are a part of ctldl.windowsupdate.com. Could be a Win10 Update or something like this.

Firewall violations

Submitted a Tech Support Case lately from the Support Portal?