Hia folks,
I have setup my own firewall using the Shoreline Firewall.
Now - I have identified that users using the IE 6 or 7 get dropped quite
fast by my system.
As a little Explanation:
Firewall is a Lex-Mini ITX System, 3 ethernet 100/10, 1 USB Wlan, 1 USB
ADSL Modem connected. I'm using Busybox to boot the system, e.g. to copy
the Root-FS from a CF-Card to a Ram-FS, before the system initialises.
Shoreline Firewall is setup to block everything - and logging is done
using the ulogd extension to a remote Mysql Database inside the Service
Network (Some people also know this as DMZ - but this term is wrong for
this).
The Ulog Daemon will store the tagged packets by shorewall as beeing
rejected, dropped or accepted, depending on the per interface policy I
have set up.
Now - as I don't like people to scan my systems - I have written a little
Daemon that watches the mysql-Ulog DB for dropped packets, initialises a
counter - and every site that produces a certain number of dropped packets
- get's marked as Blacklisted, and the firewall adds this site in a matter
of 1/minute to the shorewall dynamic blacklist.
Now - the Internet Explorer 6 or 7 produces strange packets - that the
shorewall system dropps immediatly - this users using the IE 6 or 7 get
blacklisted fast...
IMHO - I don't mind blocking people using M$ Software out of my site - but
I'm interested as to why the system drops these packets... And the point
is - I don't know why this happens ...
OK - here is a clean entry:
oob_time_sec 2007-05-16 17:46:58
oob_time_usec 15754
oob_prefix Shorewall:world_dnat:DNAT:
oob_in ppp0
ip_saddr 83.171.189.186
ip_daddr 212.114.251.235
ip_protocol 6
ip_ttl 126
ip_totlen 52
ip_ihl 5
ip_csum 2876
ip_id 4036
ip_fragoff 16384
tcp_sport 49506
tcp_dport 80
tcp_seq 3710813843
tcp_window 8192
tcp_syn 1
And now the one the firewall has dropped:
oob_time_sec 2007-05-16 17:47:01
oob_time_usec 130066
oob_prefix Shorewall:world2fw:DROP:
oob_in ppp0
ip_saddr 83.171.189.186
ip_daddr 212.114.251.235
ip_protocol 6
ip_ttl 126
ip_totlen 52
ip_ihl 5
ip_csum 2833
ip_id 4079
ip_fragoff 16384
tcp_sport 49516
tcp_dport 80
tcp_seq 4235568596
tcp_window 8192
tcp_syn 1
It seems that this packet is not identified as having to be forwarded to
the Webserver behind - but as the destination would be the firewall
itself. Which is IMHO odd ...
I have asked a friend to access my site and captured the requests. The IE
request produced a Dropped packet, the Firefox not... So i could send
these in if anyone is interested (I attached the IE-capture to this Mail).
You can identify the requests by checking the sourceports in the pcap-file
(using ethereal or wireshark)...
Have you seen this before ? Note that this happens only with Microsoft
Internet Explorer since version 6 and later ...
All other browsers have no issues ...
I am using Shorewall 3.2.4-1 on an Ubuntu 6.06.1 LTS based system.
Thx for your Time ;)
PS: I prefere not to send the shorewall dump to the list - can be missused
by people accessing the archives - as the entire network infrastructure
can be read out of it. Anyone who is si kind to help me - let me know -
I'll send you the dump. Thx.
--
------------------------------------------------------------------------
| Joerg Mertin : [EMAIL PROTECTED] (Home)|
| in Forchheim/Germany : [EMAIL PROTECTED] (Alt1)|
| Stardust's LiNUX System : |
| Web: http://www.solsys.org |
------------------------------------------------------------------------
PGP Fingerprint: AF0F FB75 997B 025F 4538 5AD6 9888 5D97 170B 8B7A
Title:
Stargate - The Gate to the Stars
Ôò¡ ÿÿ q p'KFy"[EMAIL PROTECTED]>ß +J ¬p'[EMAIL PROTECTED]>ß!Ðz ¬p'KFg 8 8 E ([EMAIL PROTECTED]>ß!8Jn«Pä p'[EMAIL PROTECTED] MS«½ºÔrûëÁZ P¡>ß!8Jn«PÍ GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-ms-application, application/vnd.ms-xpsdocument, application/xaml+xml, application/x-ms-xbap, application/x-shockwave-flash, */*
Accept-Language: de
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0)
Host: www.solsys.org
Connection: Keep-Alive
Cookie: PHPSESSID=6d87e4b75e522f77da4dafd7964365cb
p'KF
¯ 8 8 E ([EMAIL PROTECTED]>á.PÀÜB q'[EMAIL PROTECTED]>á.PÀ¦W HTTP/1.1 200 OK
Date: Wed, 16 May 2007 15:46:56 GMT
Server: Apache/2.0.55 (Ubuntu) mod_ssl/2.0.55 OpenSSL/0.9.8a
Expires: 0
Cache-Control: no-cache, must-revalidate, max_age=0
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=ISO-8859-1
7733
|
|
|
Why not sign up for an account? |
[
-
-
]
|
Wednesday, May 16 2007 |
| |