michael hall wrote: > I realized after I sent the dump file that the IP address of the machine > had changed from 192.168.1.3 to 192.168.1.2 so I modified the rules and > re-executed the connection attempt and produced a new DUMP file > (attached). Based upon the initial response to my inquiry I did not > think this would get any further attention, so I did not think this new > DUMP would be needed or reviewed. Sorry for the confusion. And thank you > for the continued interest.
I'm not particularly interested -- I was just pointing out that there
were no connections through your Bering box at all. You can look at the
output of 'shorewall dump' yourself; you don't need to send it to me.
The 'loc2net' chain handles all connection attempts from the 'loc' zone
to the 'net' zone.
From that chain:
3 144 DROP tcp -- * * 192.168.1.2
63.135.80.47 tcp dpt:80
3 144 DROP tcp -- * * 192.168.1.2
216.178.39.11 tcp dpt:80
3 144 DROP tcp -- * * 192.168.1.2
216.178.39.12 tcp dpt:80
So your firewall did drop 9 packets from 192.168.1.2 headed for banned
IP addresses. For managing loc->net, REJECT is a better approach than
DROP since it stops the client from retrying.
But if you look at the current connections (they are right after the
Mangle Table rules), you see the following (I've deleted UDP connections):
tcp 6 431928 ESTABLISHED src=192.168.1.6 dst=207.46.209.124
sport=3493 dport=80 src=207.46.209.124 dst=71.196.133.42 sport=80
dport=3493 [ASSURED] use=1 mark=0
tcp 6 431978 ESTABLISHED src=192.168.1.6 dst=207.46.209.124
sport=3575 dport=443 src=207.46.209.124 dst=71.196.133.42 sport=443
dport=3575 [ASSURED] use=1 mark=0
So there are two connections from 192.168.1.6 to 207.46.209.124:80.
Since neither of those are reflected in your rules, I don't understand
what you are reporting. Again, if 192.168.1.2 is connected to any web
site, it isn't connected through the Bering box.
-Tom
--
Tom Eastep \ Nothing is foolproof to a sufficiently talented fool
Shoreline, \ http://shorewall.net
Washington USA \ [EMAIL PROTECTED]
PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
