|
||||||||
Hi there, When I pick a look to my filter log, I can see a lot of these errors: Jul 30 16:19:25 router1 ipmon[75]: 16:19:25.174400 sis1 @0:18 b x.x.209.66,80 - > x.x.209.75,1579 PR tcp len 20 48 -AS IN Jul 30 16:19:25 router1 ipmon[75]: 16:19:25.174452 sis1 @0:18 b x.x.209.66,80 - > x.x.209.75,1577 PR tcp len 20 48 -AS IN Jul 30 16:26:46 router1 ipmon[75]: 16:26:45.484354 sis1 @0:14 b x.x.24.181,5554 -> x.x.71.229,4331 PR tcp len 20 40 -AR IN Jul 30 16:26:47 router1 ipmon[75]: 16:26:46.156576 sis1 @0:14 b x.x.24.181,9898 -> x.x.71.229,4790 PR tcp len 20 40 -AR IN Jul 30 16:28:39 router1 ipmon[75]: 16:28:38.775352 4x sis0 @0:18 b 142.217.205.70,80 -> x.x.209.76,1100 PR tcp len 20 762 -A IN Jul 30 16:35:53 router1 ipmon[75]: 16:35:52.475592 sis1 @0:14 b x.x.24.181,2745 -> x.x.4.128,3155 PR tcp len 20 40 -AR IN Jul 30 16:35:53 router1 ipmon[75]: 16:35:52.488054 sis1 @0:14 b x.x.24.181,1025 -> x.x.4.128,3167 PR tcp len 20 40 -AR IN Jul 30 16:35:53 router1 ipmon[75]: 16:35:52.493003 sis1 @0:14 b x.x.24.181,3127 -> x.x.4.128,3195 PR tcp len 20 40 -AR IN Jul 30 16:35:53 router1 ipmon[75]: 16:35:52.498031 sis1 @0:14 b x.x.24.181,6129 -> x.x.4.128,3254 PR tcp len 20 40 -AR IN Jul 30 16:35:53 router1 ipmon[75]: 16:35:52.508042 sis1 @0:14 b x.x.24.181,80 - > x.x.4.128,3326 PR tcp len 20 40 -AR IN Jul 30 16:35:56 router1 ipmon[75]: 16:35:55.483284 sis1 @0:14 b x.x.24.181,2745 -> x.x.4.128,3155 PR tcp len 20 40 -AR IN Jul 30 16:35:56 router1 ipmon[75]: 16:35:55.488119 sis1 @0:14 b x.x.24.181,1025 -> x.x.4.128,3167 PR tcp len 20 40 -AR IN Jul 30 16:35:56 router1 ipmon[75]: 16:35:55.493363 sis1 @0:14 b x.x.24.181,3127 -> x.x.4.128,3195 PR tcp len 20 40 -AR IN Jul 30 16:35:56 router1 ipmon[75]: 16:35:55.493441 sis1 @0:14 b x.x.24.181,6129 -> x.x.4.128,3254 PR tcp len 20 40 -AR IN Jul 30 16:35:56 router1 ipmon[75]: 16:35:55.500710 sis1 @0:14 b x.x.24.181,80 - > x.x.4.128,3326 PR tcp len 20 40 -AR IN Jul 30 16:36:02 router1 ipmon[75]: 16:36:01.515966 sis1 @0:14 b x.x.24.181,80 - > x.x.4.128,3326 PR tcp len 20 40 -AR IN Jul 30 16:36:02 router1 ipmon[75]: 16:36:01.520890 sis1 @0:14 b x.x.24.181,6129 -> x.x.4.128,3254 PR tcp len 20 40 -AR IN Jul 30 16:36:02 router1 ipmon[75]: 16:36:01.526013 sis1 @0:14 b x.x.24.181,3127 -> x.x.4.128,3195 PR tcp len 20 40 -AR IN Jul 30 16:36:02 router1 ipmon[75]: 16:36:01.526280 sis1 @0:14 b x.x.24.181,1025 -> x.x.4.128,3167 PR tcp len 20 40 -AR IN Jul 30 16:36:02 router1 ipmon[75]: 16:36:01.526618 sis1 @0:14 b x.x.24.181,2745 -> x.x.4.128,3155 PR tcp len 20 40 -AR IN Jul 30 16:36:10 router1 ipmon[75]: 16:36:09.815477 sis1 @0:18 b x.x.209.66,80 - > x.x.209.75,1808 PR tcp len 20 48 -AS IN Jul 30 16:36:13 router1 ipmon[75]: 16:36:12.762818 2x sis1 @0:18 b x.x.209.66,80 -> x.x.209.75,1808 PR tcp len 20 48 -AS IN Jul 30 16:36:19 router1 ipmon[75]: 16:36:18.784630 2x sis1 @0:18 b x.x.209.66,80 -> x.x.209.75,1808 PR tcp len 20 48 -AS IN Jul 30 16:38:21 router1 ipmon[75]: 16:38:21.444225 sis1 @0:14 b x.x.24.181,2745 -> x.x.54.116,1883 PR tcp len 20 40 -AR IN Jul 30 16:38:21 router1 ipmon[75]: 16:38:21.449306 sis1 @0:14 b x.x.24.181,1025 -> x.x.54.116,1885 PR tcp len 20 40 -AR IN Jul 30 16:38:21 router1 ipmon[75]: 16:38:21.456479 sis1 @0:14 b x.x.24.181,3127 -> x.x.54.116,1889 PR tcp len 20 40 -AR IN Jul 30 16:38:21 router1 ipmon[75]: 16:38:21.461417 sis1 @0:14 b x.x.24.181,6129 -> x.x.54.116,1893 PR tcp len 20 40 -AR IN Jul 30 16:38:24 router1 ipmon[75]: 16:38:24.432198 sis1 @0:14 b x.x.24.181,2745 -> x.x.54.116,1883 PR tcp len 20 40 -AR IN Jul 30 16:38:24 router1 ipmon[75]: 16:38:24.434274 sis1 @0:14 b x.x.24.181,1025 -> x.x.54.116,1885 PR tcp len 20 40 -AR IN Jul 30 16:38:24 router1 ipmon[75]: 16:38:24.439241 sis1 @0:14 b x.x.24.181,3127 -> x.x.54.116,1889 PR tcp len 20 40 -AR IN Jul 30 16:38:24 router1 ipmon[75]: 16:38:24.444148 sis1 @0:14 b x.x.24.181,6129 -> x.x.54.116,1893 PR tcp len 20 40 -AR IN Jul 30 16:38:30 router1 ipmon[75]: 16:38:30.452031 sis1 @0:14 b x.x.24.181,6129 -> x.x.54.116,1893 PR tcp len 20 40 -AR IN Jul 30 16:38:30 router1 ipmon[75]: 16:38:30.457070 sis1 @0:14 b x.x.24.181,3127 -> x.x.54.116,1889 PR tcp len 20 40 -AR IN Jul 30 16:38:30 router1 ipmon[75]: 16:38:30.464507 sis1 @0:14 b x.x.24.181,1025 -> x.x.54.116,1885 PR tcp len 20 40 -AR IN Jul 30 16:38:30 router1 ipmon[75]: 16:38:30.469522 sis1 @0:14 b x.x.24.181,2745 -> x.x.54.116,1883 PR tcp len 20 40 -AR IN Jul 30 16:51:01 router1 ipmon[75]: 16:51:00.697845 sis1 @0:18 b x.x.209.66,80 - > x.x.209.75,1834 PR tcp len 20 48 -AS IN I'm using now Monowall 1.1b15 (previously last release, I try beta to solve this probs..) I'm using a soekris 4821 board with 3 interfaces. Here is (from status.php page) rules list: @1 pass out quick on lo0 from any to any @2 pass out quick on sis1 proto udp from x.x.209.65/32 port = 67 to any port = 68 @3 pass out quick on sis2 proto udp from x.x.209.94/32 port = 67 to any port = 68 @4 pass out quick on sis0 proto udp from any port = 68 to any port = 67 @5 pass out quick on sis1 from any to any keep state @6 pass out quick on sis0 from any to any keep state @7 pass out quick on sis2 from any to any keep state @8 block out log quick from any to any @1 pass in quick on lo0 from any to any @2 block in log quick from any to any with short @3 block in log quick from any to any with ipopt @4 pass in quick on sis1 proto udp from any port = 68 to 255.255.255.255/32 port = 67 @5 pass in quick on sis1 proto udp from any port = 68 to x.x.209.65/32 port = 67 @6 pass in quick on sis2 proto udp from any port = 68 to 255.255.255.255/32 port = 67 @7 pass in quick on sis2 proto udp from any port = 68 to x.x.209.94/32 port = 67 @8 block in log quick on sis0 from x.x.209.64/29 to any @9 block in log quick on sis0 from x.x.209.80/28 to any @10 block in log quick on sis0 proto udp from any port = 67 to x.x.209.64/29 port = 68 @11 pass in quick on sis0 proto udp from any port = 67 to any port = 68 @12 skip 2 in on sis1 from x.x.209.72/29 to any @13 skip 1 in on sis1 from x.x.209.64/29 to any @14 block in log quick on sis1 from any to any @15 skip 1 in on sis2 from x.x.209.80/28 to any @16 block in log quick on sis2 from any to any @17 skip 1 in proto tcp from any to any flags S/FSRA @18 block in log quick proto tcp from any to any @19 block in log quick on sis1 from any to any head 100 @1 pass in quick from x.x.209.64/29 to x.x.209.65/32 keep state group 100 @2 pass in quick from any to any keep state keep frags group 100 @20 block in log quick on sis0 from any to any head 200 @1 pass in quick from any to any keep state keep frags group 200 @21 block in log quick on sis2 from any to any head 300 @1 pass in quick from any to any keep state keep frags group 300 @22 block in log quick from any to any There is a lot of stuff in there, because the only rules configured in web interface are: WAN: source:any Dest.:any (allow frag packets) LAN: source:any Dest.:any (allow frag packets) OPT1: source:any Dest.:any (allow frag packets) Last thing, I'm using monowall as 'real' router. No NAT. On all 3 interface there is a public IP add. And when one error occurs in filter log, a web page (or outlook freeze in retreiving mail) cannot be displayed in browser. I hope someone here can help me, Best Regards, eric. ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/ |