Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 3 subscribers
  • Views 12053 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

inbound 443 & 80 connections

ICT Department1

Hi, I have set up a UTM all working fine outgoing for internet but started getting lots of [RST] connection which are inbound on ports 80 & 443.  I understand this to be normal and are dropped connections.  My question is how can I create a rule to stop them logging as they are just flooding the log !!!!

We are using a SG135 on firmware 9.504-1

 

Any advice??

15:56:18 Default DROP TCP  
52.94.217.61 : 443
→
10.1.3.208 : 33577
 
[RST] len=40 ttl=64 tos=0x00 srcmac=00:1a:8c:4c:0f:7c
15:56:22 Default DROP TCP  
18.194.108.186 : 443
→
10.1.3.169 : 57663
 
[RST] len=40 ttl=64 tos=0x00 srcmac=00:1a:8c:4c:0f:7c


This thread was automatically locked due to age.
Parents
  • 0

    There's no way to  selectively filter out RST packets, but you can filter out all HTTP/S responses not automatically accepted by conntrack by dropping them with a firewall rule.  Since you only showed lines from the Live Log, I can't give any more precise advice.

    Alone among the logs, the Firewall Live Log presents abbreviated information in a format easier to read quickly.  Usually, you can't troubleshoot without looking at the corresponding line from the full Firewall log file.

    Cheers - Bob

  • 0 in reply to BAlfson

    thanks bob, will this help?

    2017:10:23-00:01:04 gw2 ulogd[4789]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth4" srcmac="00:1a:8c:4c:0f:7c" srcip="216.58.198.164" dstip="10.1.3.151" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="60538" tcpflags="RST"
    2017:10:23-00:01:07 gw2 ulogd[4789]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth4" srcmac="00:1a:8c:4c:0f:7c" srcip="216.58.198.164" dstip="10.1.3.151" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="60538" tcpflags="RST"

Reply
  • 0 in reply to BAlfson

    thanks bob, will this help?

    2017:10:23-00:01:04 gw2 ulogd[4789]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth4" srcmac="00:1a:8c:4c:0f:7c" srcip="216.58.198.164" dstip="10.1.3.151" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="60538" tcpflags="RST"
    2017:10:23-00:01:07 gw2 ulogd[4789]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth4" srcmac="00:1a:8c:4c:0f:7c" srcip="216.58.198.164" dstip="10.1.3.151" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="60538" tcpflags="RST"

Children