>>>> I'm still getting the blocked outbound requests to port 3680 on my >>>> firewall and I'm running the above script (changed 993 to 3680) on the >>>> local system indicated by SRC in the firewall log, but mystery.log >>>> remains empty. I tested the script with other ports and it seems to >>>> be working fine. >>>> >>>> Also the MAC indicated in the firewall log is 14 blocks long and the >>>> local system in question has a MAC address 6 blocks long according to >>>> ifconfig, but the 6 blocks from ifconfig do match 6 of the blocks >>>> reported by the firewall. >>>> >>>> Does this make sense to anyone? >>> >>> Does not make sense to me, sorry. :-( >> >> Since my local firewall is rejecting the outbound requests, the time >> elapsed between the request and the block should be very short. Is it >> possible the 'sleep 1' portion of the script is causing the failure to >> log the connection request? The outbound connection is only attempted >> a few times per day. If so, how would you recommend fixing that? > > Try configuring your local firewall to log the request. There may be > something useful, such as logging an associated PID or user, that you > can add there. I don't know. > > Alternately, you could DROP the outbound packet rather than REJECT it; > that should cause the connecting process to wait several seconds until > it times out.
I've just done this at your's and Michael Orlitzky's suggestion. Waiting for another connection attempt now. >> I'm also wondering if there is a command I could run on the >> router/firewall machine that would log something from the outbound >> request. Even if the information logged isn't useful, it would be >> nice to see a confirmation of the outbound requests logged from >> somewhere besides the firewall. > > Ow. We need to get a bit more specific. Is the 'local firewall' on the > connecting host, or is it on your router? The firewall runs on the router (which is a Gentoo system) in the local network. > As far as logging goes, you can set up a rule (prior to your DROP or > REJECT) with a target of LOG. The packet will show up in syslog. I just started running this on the router: tcpdump -i eth1 -n | grep the.offending.ip.address where eth1 is my LAN interface. I figure this will tell me if any requests are being made to the offending IP, including any that aren't being logged by the firewall. Nothing yet. - Grant
