Re: [pfSense Support] Understand log entry

[Bill Marquette]

Looks like a packet from MyIPWasHere destined for 209.86.93.236 port 25 with the flags FIN/PSH/ACK set was blocked.  This happens frequently for traffic that is out of state - most commonly because it's a delayed packet.  There are other reasons, but it usually has something to do with timing of the packet involved.

--Bill

On 9/15/05, Mojo Jojo <[EMAIL PROTECTED]> wrote:

Can anyone tell me what this log entry means?

Sep 15 20:36:16 pf: 594200 rule 65/0(match): block in on dc2:
MyIPwasHere.1284 > 209.86.93.236.25: FP 0:6(6) ack 1 win 16954

I have replaced my IP with "MyIPwasHere"...

It looks to me like a packet going out from my server (MyIPwasHere) on the
dc2 interface (my DMZ interface) to 209.86.93.236 on port 25 was blocked by
PfSense.

Is this all correct? If so, I am not sure why because I have a rule setup to
specifically allow this.

In fact, if the rule wasn't working I would have serious phone calls at this
point because customers wouldn't be getting their mail.

I don't see a ton of these but I do see enough to make me wonder why things
are being rejected on port 25 out from my DMZ on occassion.

Thanks in advance for any help.

Todd


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]