-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 06/05/2017 11:44 PM, Vieri Di Paola via Shorewall-users wrote:
> Hi,
>
> My last Shorewall rule is DROP with logging options (:info:polbl).
> It's a custom DROP action identical to the upstream version, except
> it includes the SRC IP addr. in an ipset.
>
> I usually get messages in the log such as Shorewall:polbl:DROP...
> However, I sometimes get messages such as the one below:
>
> Jun 5 16:47:51 kernel: Shorewall:polbl:COUNT:IN=enp9s5 OUT=
> MAC=00:0d:88:cd:7f:c5:00:13:f7:23:ef:b4:08:00 SRC=1.2.3.4
> DST=192.168.100.2 LEN=60 TOS=0x00 PREC=0x00 TTL=124 ID=10689
> PROTO=255 MARK=0x2
>
- From your most recent dump:
Chain DROPBL (24 references)
pkts bytes target prot opt in out source
destination
4 1667 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6 prefix "Shorewall:polbl:COUNT:"
0 0 ~log640 icmp -- * * 0.0.0.0/0
0.0.0.0/0 [goto] icmptype 3 code 4 /* Needed ICMP types */
> What is the reason for which the packet was DROPped? What does
> COUNT mean exactly, especially with PROTO=255?
That rule doesn't indicate that the packet is being dropped -- it
simply means that it is being logged and counted.
- -Tom
- --
Tom Eastep \ Q: What do you get when you cross a mobster with
Shoreline, \ an international standard?
Washington, USA \ A: Someone who makes you an offer you can't
http://shorewall.org \ understand
\_______________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJZOHO4AAoJEJbms/JCOk0QgPoQAKpdXbyBI+Sic7Q9BaZ9HSU8
T2n3qI/A+1gBA7nmA2WV4FKoKitLaCwwb1lItJEzCMn5PXhv+IdijGsuqZI+Su+C
lKe2zW3O8tHCjMu1FUfSl/cWiDq0tltPNqNjWaz5LRuPaKPk5oEntCqMnGTTsZ2J
HqaDY8htyYi/Ls6yta54NAjfK9QCwQBRJFWIWhUoi02uk+qncbEJu5XVZTiSa6Yu
x0C/Bu0BzF238Gav/6Gwd9qf9aMy4a0/X/vhxvwlNFyFpiaETi3Q5Ux7XmJy51p8
aYgU14QxGGQ6v8L0e0+w5KxRoBw9o2uFJeu55SEg1iHoFVGLC6DIVisrx6nPZPwG
4DjKtQFFAG+bhJFLpK5e9KCkctQE56VCW/ERIpQb0ZnsL5wTA0KxBd/HmAInI6Z1
Kq33Ji+Ntn92067dSloy4ENEMvJhsOK5i+EwS2Vl0ckj9S0yZj1QUT5eVkJ0wEPy
pVaXpo5SpnHRbozHJWipNuzjKbK8m0HS3L5pkZSh9RYN+oy9blN0aHZ7l06zXCSX
3VfqpSo4pL/mjEjqP7sTcI1eETRyt4vTDZLeuN5yXmx7ZZxsC3t1wRlIscoLUHJo
A0F9lazraxDJ+S0DqS7QSXXeuY9wdpvQrRzZgquxKZw6w6ufUKs8jCAzQtTaddL8
CER2+ovcJddpT3IIGpXX
=G6FS
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users
