[ previous ] [ next ] [ threads ]
 From:  Wilko Lunenburg <wilko at sassenheim dot net>
 To:  monowall <m0n0wall at lists dot m0n0 dot ch>
 Subject:  strange entry in firewall logs
 Date:  Thu, 17 Jul 2008 22:08:33 +0200
Hello everyone,

For quite some time it puzzles me why there are entries in the 
firewall-log about blocking smtp connections coming in from my OPT 
interface, where my access point is connected to. Most of the time there 
is nothing using this accesspoint at all.

But shorty I began logging valid smtp accesses from the WAN too and now 
I see that for some (not all?!?!) smtp accesses from the WAN there is a 
corresponding one that seems to come from OPT.

The setup I use is: one network-card connected to a modem to the 
internet provider. Another card directly connected to the LAN and the 
third card connected to an accesspoint. The last one is brigded to the LAN.

It looks like this in the log:

21:38:49.235667	OPT, port 1966,	port 25	TCP
21:38:49.233888	WAN, port 1966,	port 25	TCP

Where the first line is being blocked and the second accepted, can 
anyone explain why this happens?

Met vriendelijke groet,

Wilko Lunenburg

There are some things so serious you have to laugh at them. - Niels Bohr